Control Windows Update Access with Intune: Block Users from Scanning, Downloading, and Installing Updates
Managing Windows Updates in enterprise environments is all about consistency, compliance, and control. One of the most effective ways to achieve this is by removing a user’s ability to manually scan, download, or install updates.
By leveraging Intune Policy and the Windows CSP SetDisableUXWUAccess, administrators can centralize update management and ensure end-users cannot bypass defined schedules or policies.
Why Disable User Access?
When this policy is enabled, users lose access to the Windows Update scan and installation options. That means:
❌ No manual scanning for updates
❌ No downloading updates outside of IT-defined schedules
❌ No installing updates manually
All update activities are now centrally controlled by IT, ensuring:
✅ Compliance with corporate policies
✅ Fewer disruptions to workflows
✅ Greater stability across the organization
Windows CSP Details
The SetDisableUXWUAccess policy applies at the device level (not user level) and is supported on:
Windows 10 Pro, Enterprise, Education, and IoT Enterprise editions
Version 1809 [10.0.17763] and later
Policy Properties
The configuration framework defines:
Format: Integer (int)
Access Type: Add, Delete, Get, Replace
Default Value: 0
✅ Allowed Values
0 (Default): Disabled → Users can still manually scan and install updates
1: Enabled → User access is completely blocked
Takeaway for IT Admins
This policy is a must-have in environments where updates must be tightly managed. By using Intune with the SetDisableUXWUAccess CSP, you’re not just blocking users you’re enforcing stability, compliance, and security across your fleet of devices.
How to Remove User Access to Scan, Download, and Install Updates via Intune
Microsoft Intune allows administrators to control how users interact with Windows Update. By deploying a configuration profile through the Settings Catalog, you can remove end-user access to scan, download, and install updates manually. This ensures updates are managed automatically according to the organisation’s defined policies.
How the Policy Works
A value of 0 (default) means the policy is disabled, allowing users to manually scan, download, and install updates.
A value of 1 (enabled) removes user access to these features, ensuring update activities are fully automated without user involvement.
Step-by-Step Guide
Refer to the screenshot for visual guidance and follow the steps below:
In the Microsoft Intune admin center, go to Devices
Select Windows devices
Under the Policy section, choose Configuration
Click on + Create and then select New Policy
In the Create a profile pane, set the Platform to Windows 10 and later
Set the Profile type to Settings catalog
Click Create to proceed
This will initiate the creation of a settings-based configuration profile where you can search for and apply the Remove User Access to Scan, Download, and Install Updates policy.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of your configuration profile. You’ll need to provide a Name, an optional but highly recommended Description, and confirm the Platform (which will already be pre-selected as Windows 10 and later).
Providing a clear and descriptive name makes it easier to identify and manage the policy later, especially in environments with multiple configuration profiles or complex update strategies.
✅ Suggested Name and Description
Name: Block Windows Update Access
Description: This policy prevents users from scanning, downloading, and installing Windows updates manually. It is designed to enforce centralized update management through Intune and reduce the risk of unauthorized or premature update actions. Ideal for shared devices, Cloud PCs, kiosks, and secure environments where update control is essential to maintain system stability and compliance.
No changes are needed in the Platform field. Once the name and description are filled in, click Next to continue.
Configure the Disable Windows Update Access Setting
In this step, you'll use the Settings Catalog to configure the Set Disable UXWU Access policy a critical setting to block users from scanning, downloading, and installing updates manually through Windows Update.
Follow the instructions below, referring to the image:
On the Configuration settings page, click + Add settings
In the Settings picker pane, type Windows Update for Business into the search bar
Click Search
From the results, expand the Windows Update for Business category
Scroll down and check the box for Set Disable UXWU Access
The setting will now appear in the main configuration pane. Toggle the value to Enabled this will block user access to Windows Update
Click Next to proceed
✅ Observation:
By default, this setting is Disabled, meaning users can still scan, download, and install updates manually.
When set to Enabled, it removes the option for end users to initiate scans or installations, ensuring that update management remains fully under IT control via Intune or WSUS.
This configuration is especially useful in enterprise environments, Cloud PCs, shared workstations, education labs, and healthcare settings, where maintaining update consistency, security, and compliance is critical.
Configuration Settings and CSP Path
The policy Set Disable UXWU Access is stored under the Windows Configuration Service Provider (CSP) structure, in the Update category. This is the exact location Intune and other management tools use to communicate with devices and enforce the configured policy, ensuring that the setting is consistently applied across all targeted endpoints.
Configure Scope Tags (Optional)
The next step is the Scope tags tab. Scope tags are typically used to associate policies with specific groups or administrative units within your organization, especially in larger or delegated environments.
For this particular policy, scope tags are not required. If you don’t need to assign the policy to a custom scope, you can simply leave this section blank.
Click Next to continue to the Assignments step.
Assign the Policy to Target Devices
In the Assignments section, you'll define who will receive this policy. This step is essential, as it determines which users or devices the configuration will apply to.
To deploy this policy to a specific group:
Click on Add groups under the Include groups section. A list of available groups will appear use the search bar to quickly find the target group.
Once you've selected the appropriate group(s), confirm your choice. Click Next to move forward to the final step: Review + Create.
Review and Create the Policy
After completing the Assignments step, you'll land on the final tab: Review + Create.
This is your chance to review a full summary of the configuration including the basic details, selected settings, and group assignments. Take a moment to carefully review all entries to ensure everything is accurate and aligned with your intent.
If you need to make any changes, you can easily navigate back to the previous tabs and update the information as needed.
Once everything looks good, click Create to deploy the policy.
Your configuration will now be saved and pushed to the assigned devices based on the group you selected.
Monitor Policy Deployment Status
After creating and assigning the Disable Windows Update Access policy, it's important to monitor whether the configuration has been successfully deployed to all targeted devices.
By default, Intune policy deployment may take up to 8 hours. To speed up the process, you can manually trigger a device sync using the Company Portal app or initiate a sync via the Intune Management Extension.
✅ How to Verify Deployment Status:
In the Microsoft Intune admin center, navigate to: Devices ➝ Configuration profiles
Use the search bar to locate the profile you created — for example: Block Windows Update Access
Click on the policy name to open its overview page
Review key deployment metrics such as:
This visibility ensures that the Disable Windows Update Access policy has been properly applied, and allows administrators to take corrective actions if devices are non-compliant or facing deployment issues.
Client-Side Verification via Event Viewer
After manually syncing the device or waiting for Intune to automatically apply the policy, you can confirm that the Disable Windows Update Access policy has been successfully enforced using Event Viewer on the client device.
This is especially useful for troubleshooting or auditing deployments in secure environments.
✅ Steps to Verify Policy Application:
Open Event Viewer on the target Windows device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
In the right-hand pane, click Filter Current Log
Look for Event ID 813 or 814 — these events typically indicate successful processing of Intune configuration profiles
In the event details, verify that the Set Disable UXWU Access policy was applied successfully
You may also see additional fields such as Enrollment ID, User SID, and Scope, depending on how the device was enrolled and how the policy was assigned.
Pro Tip: Always ensure the Event ID reflects the correct timestamp and status. This method is one of the most reliable ways to confirm if the policy has been successfully applied on the device — especially when troubleshooting delayed or failed deployments.
More Information
Policy CSP – Update (SetDisableUXWUAccess): https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#setdisableuxwuaccess
Create a Settings Catalog Policy in Intune: https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
Monitor Intune Policy Deployment: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Event Viewer Logs for MDM Diagnostics: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#event-viewer-logs
Policy CSP – WindowsUpdate: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com