Specify intranet Microsoft update service location

What it does

Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them. If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. Note: If the "Alternate Download Server" is not set, it will use the intranet update service by default to download updates. Note: The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. Note: This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. To ensure the highest level of security, Microsoft recommends securing WSUS with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. If a proxy is required, we recommend configuring system proxy. To ensure highest levels of security, additionally leverage WSUS TLS certificate pinning on all devices. In order to keep clients inherently secure, we are no longer allowing intranet servers to leverage user proxy by default for detecting updates. If you need to leverage user proxy for detecting updates while using an intranet server despite the vulnerabilities it presents, you must configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails". Detection for updates against intranet servers will fail when user proxy is needed as a fallback and the alternate proxy behavior is not configured.

What it writes

Hive

HKEY_LOCAL_MACHINE

Registry key

Software\Policies\Microsoft\Windows\WindowsUpdate

When enabled

Software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer = DWORD 1

When disabled

Software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer = DWORD 0

In Intune

Native Intune setting: Yes — Policy CSP

• ./Device/Vendor/MSFT/Policy/Config/Update/AllowUpdateServiceUpdate on Microsoft LearnWindows builds listed: 10.0.10240.
• ./Device/Vendor/MSFT/Policy/Config/Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetectionUpdate on Microsoft LearnSets the option “Do not enforce TLS certificate pinning for Windows Update client for detecting updates.”.Windows builds listed: 10.0.10240.18818, 10.0.14393.4169, 10.0.15063.2108, 10.0.16299.2166, 10.0.17134.1967, 10.0.17763.1697, 10.0.18362.1316, 10.0.18363.1316, 10.0.19041.746, 10.0.19042.746, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/FillEmptyContentUrlsUpdate on Microsoft LearnSets the option “Download files with no Url in the metadata if alternate download server is set.”.Windows builds listed: 10.0.14393.
• ./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForDriverUpdatesUpdate on Microsoft LearnSets the template element CorpWUSetPolicyDrivenUpdateSourceForDriverUpdates.Windows builds listed: 10.0.19041.1202, 10.0.19042.1202, 10.0.19043.1202, 10.0.19044.1288, 10.0.19045.2130, 10.0.20348.371, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForFeatureUpdatesUpdate on Microsoft LearnSets the template element CorpWUSetPolicyDrivenUpdateSourceForFeatureUpdates.Windows builds listed: 10.0.19041.1202, 10.0.19042.1202, 10.0.19043.1202, 10.0.19044.1288, 10.0.19045.2130, 10.0.20348.371, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForOtherUpdatesUpdate on Microsoft LearnSets the template element CorpWUSetPolicyDrivenUpdateSourceForDriverUpdates.Windows builds listed: 10.0.19041.1202, 10.0.19042.1202, 10.0.19043.1202, 10.0.19044.1288, 10.0.19045.2130, 10.0.20348.371, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/SetPolicyDrivenUpdateSourceForQualityUpdatesUpdate on Microsoft LearnSets the template element CorpWUSetPolicyDrivenUpdateSourceForQualityUpdates.Windows builds listed: 10.0.19041.1202, 10.0.19042.1202, 10.0.19043.1202, 10.0.19044.1288, 10.0.19045.2130, 10.0.20348.371, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/SetProxyBehaviorForUpdateDetectionUpdate on Microsoft LearnSets the option “Select the proxy behavior for Windows Update client for detecting updates”.Windows builds listed: 10.0.10240.18696, 10.0.14393.3930, 10.0.15063.2500, 10.0.16299.2107, 10.0.17134.1726, 10.0.17763.1457, 10.0.18362.1082, 10.0.18363.1082, 10.0.19041.508, 10.0.22000.
• ./Device/Vendor/MSFT/Policy/Config/Update/UpdateServiceUrlUpdate on Microsoft LearnSets the option “Set the intranet update service for detecting updates”.Windows builds listed: 10.0.10240.
• ./Device/Vendor/MSFT/Policy/Config/Update/UpdateServiceUrlAlternateUpdate on Microsoft LearnSets the option “Set the alternate download server”.Windows builds listed: 10.0.14393.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

History 2 retained releases

1. 22H2 · 1.015 Jul 2024
   • Description … Update Agent to download updates from…[removed: WSUS Server.][added: the intranet update service.] If the status is set to Enabled,…[removed: C][added: c]onfigures the Windows Update Agent to download files from…[removed: WSUS Server.][added: intranet update service. The option to downl…] Note: If the "Configure Automatic Updates" …[removed: WSUS server][added: intranet update service] by default to download updates. Note: [added: The option to "Download files with no Url..." is only used if the "Alternate Down…]This policy is not supported on Windows RT. Setting this policy will not have any…[added: To ensure the highest level of security, Microsoft recommends securing …]
     Whole description, marked

     Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of [removed: WSUS Server.][added: the intranet update service.] If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them. If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server [removed: C][added: c]onfigures the Windows Update Agent to download files from an alternative download server instead of the [removed: WSUS Server.][added: intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server.] Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. Note: If the "Alternate Download Server" is not set, it will use the [removed: WSUS server][added: intranet update service] by default to download updates. Note: [added: The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. Note: ]This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.[added: To ensure the highest level of security, Microsoft recommends securing WSUS with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. If a proxy is required, we recommend configuring system proxy. To ensure highest levels of security, additionally leverage WSUS TLS certificate pinning on all devices. In order to keep clients inherently secure, we are no longer allowing intranet servers to leverage user proxy by default for detecting updates. If you need to leverage user proxy for detecting updates while using an intranet server despite the vulnerabilities it presents, you must configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails". Detection for updates against intranet servers will fail when user proxy is needed as a fallback and the alternate proxy behavior is not configured.]

   • New option [added: Download files with no Url in the metadata if alternate download server is set. (CorpWUFillEmptyContentUrls)]
   • New option [added: Do not enforce TLS certificate pinning for Windows Update client for detecting updates. (CorpWUDoNotEnforceEnterpriseTLSCertPinningForUpdateDetection)]
   • New option [added: Select the proxy behavior for Windows Update client for detecting updates (SetProxyBehaviorForUpdateDetection)]
   • Editor controls or their defaults changed.
2. 1607 · 2.015 Jul 2024
   • Already present in the first release ChangeIntel keeps.

Template

Internal name

CorpWuURL

Namespace

Microsoft.Policies.WindowsUpdate

Template file

WindowsUpdate.admx

Release

Windows 10 22H2 · 1.0 · file set bc15f6a5271783ee…

<policy class="Machine" displayName="$(string.CorpWuURL)" explainText="$(string.CorpWuURL_Help)" key="Software\Policies\Microsoft\Windows\WindowsUpdate" name="CorpWuURL" presentation="$(presentation.CorpWuURL)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.WindowsUpdate:WindowsUpdateCat" />
      <supportedOn ref="Microsoft.Policies.WindowsUpdate:WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT" />
      <enabledList>
        <item key="Software\Policies\Microsoft\Windows\WindowsUpdate\AU" valueName="UseWUServer">
          <value>
            <decimal value="1" />
          </value>
        </item>
      </enabledList>
      <disabledList>
        <item key="Software\Policies\Microsoft\Windows\WindowsUpdate\AU" valueName="UseWUServer">
          <value>
            <decimal value="0" />
          </value>
        </item>
      </disabledList>
      <elements>
        <text id="CorpWUURL_Name" required="true" valueName="WUServer" />
        <text id="CorpWUStatusURL_Name" required="true" valueName="WUStatusServer" />
        <text id="CorpWUContentHost_Name" required="false" valueName="UpdateServiceUrlAlternate" />
        <boolean id="CorpWUFillEmptyContentUrls" required="false" valueName="FillEmptyContentUrls" />
        <boolean id="CorpWUDoNotEnforceEnterpriseTLSCertPinningForUpdateDetection" required="false" valueName="DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection" />
        <enum id="SetProxyBehaviorForUpdateDetection" required="true" valueName="SetProxyBehaviorForUpdateDetection">
          <item displayName="$(string.OnlyUseSystemProxyForUpdateDetection)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.AllowUserProxyAsFallbackForUpdateDetection)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

<presentation id="CorpWuURL" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <textBox refId="CorpWUURL_Name">
          <label>Set the intranet update service for detecting updates:</label>
        </textBox>
        <textBox refId="CorpWUStatusURL_Name">
          <label>Set the intranet statistics server:</label>
        </textBox>
        <textBox refId="CorpWUContentHost_Name">
          <label>Set the alternate download server:</label>
        </textBox>
        <text>(example: https://IntranetUpd01)</text>
        <checkBox defaultChecked="false" refId="CorpWUFillEmptyContentUrls">Download files with no Url in the metadata if alternate download server is set.</checkBox>
        <checkBox defaultChecked="false" refId="CorpWUDoNotEnforceEnterpriseTLSCertPinningForUpdateDetection">Do not enforce TLS certificate pinning for Windows Update client for detecting updates.</checkBox>
        <dropdownList defaultItem="0" noSort="true" refId="SetProxyBehaviorForUpdateDetection">Select the proxy behavior for Windows Update client for detecting updates:</dropdownList>
      </presentation>

Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.WindowsUpdate:category:WindowsUpdateCat
<category displayName="$(string.WindowsUpdateCat)" name="WindowsUpdateCat" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.WindowsUpdate:definition:WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT
<definition displayName="$(string.WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT)" name="WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="3" ref="unresolved(products):MicrosoftWindows2000" />
          <range minVersionIndex="1" ref="unresolved(products):MicrosoftWindowsXP" />
          <range maxVersionIndex="8" minVersionIndex="3" ref="unresolved(products):MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.WindowsUpdate:unresolved:unresolved(products):MicrosoftWindows
<unresolved reference="unresolved(products):MicrosoftWindows" />
Microsoft.Policies.WindowsUpdate:unresolved:unresolved(products):MicrosoftWindows2000
<unresolved reference="unresolved(products):MicrosoftWindows2000" />
Microsoft.Policies.WindowsUpdate:unresolved:unresolved(products):MicrosoftWindowsXP
<unresolved reference="unresolved(products):MicrosoftWindowsXP" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>
Microsoft.Policies.WindowsUpdate:category:WindowsUpdateCat
<category displayName="$(string.WindowsUpdateCat)" name="WindowsUpdateCat" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.WindowsUpdate:WindowsUpdateCat">Windows Update</string></strings>
Microsoft.Policies.WindowsUpdate:definition:WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT
<definition displayName="$(string.WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT)" name="WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="3" ref="unresolved(products):MicrosoftWindows2000" />
          <range minVersionIndex="1" ref="unresolved(products):MicrosoftWindowsXP" />
          <range maxVersionIndex="8" minVersionIndex="3" ref="unresolved(products):MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.WindowsUpdate:WU_SUPPORTED_Win2kSP3_Or_XPSP1_NoWinRT">At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT</string></strings>