Windows 10 22H2 · 1.0

Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built-in firewalls. To do this, Windows [added: Defender ]Firewall opens TCP port 2869 and UDP port 1900. If you enable this policy setting, Windows [added: Defender ]Firewall opens these ports so that this computer can receive Plug and Play messages. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is selected and administrators cannot clear it. If you disable this policy setting, Windows [added: Defender ]Firewall blocks these ports, which prevents this computer from receiving Plug and Play messages. If an administrator attempts to open these ports by adding them to a local port exceptions list, Windows [added: Defender ]Firewall does not open the ports. In the Windows [added: Defender ]Firewall component of Control Panel, the "UPnP framework" check box is cleared and administrators cannot select it. If you do not configure this policy setting, Windows [added: Defender ]Firewall does not open these ports. Therefore, the computer cannot receive Plug and Play messages unless an administrator uses other policy settings to open the required ports or enable the required programs. In the Windows[added: Defender] Firewall component of Control Panel, the "UPnP framework" check box is cleared. Administrators can change this check box."

This policy setting controls whether a device will automatically [removed: sign-in][added: sign in and lock] the last interactive user after [removed: Windows Update][added: the system] restarts [added: or after a shutdown and cold boot. This only occurs if ]the [removed: system.][added: last interactive user didn’t sign out before the restart or shutdown.​] If [removed: you enable][added: the device is joined to Active Directory] or [removed: do not configure][added: Azure Active Directory,] this policy [removed: setting, the device securely saves the user's credentials (including the user name, domain][added: only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts] and [removed: encrypted password) to][added: shutdowns.​ If you don’t] configure [removed: automatic sign-in after a Windows Update restart. After][added: this policy setting, it is enabled by default. When] the [removed: Windows Update restart,][added: policy is enabled,] the user is automatically signed[removed: -][added: ]in and the session is automatically locked with all [removed: the ]lock screen apps configured for that [removed: user. If][added: user after the device boots.​ After enabling this policy,] you [removed: disable this policy setting,][added: can configure its settings through] the [removed: device does not store][added: ConfigAutomaticRestartSignOn policy, which configures] the [removed: user's credentials for automatic sign-in][added: mode of automatically signing in and locking the last interactive user] after a [removed: Windows Update restart.][added: restart or cold boot​. If you disable this policy setting, the device does not configure automatic sign in.] The user[removed: s'][added: ’s] lock screen apps are not restarted after the system restarts.

Disable turns off the launch of all apps from the [removed: Windows][added: Microsoft] Store that came pre-installed or were downloaded. Apps will not be updated. Your Store will also be disabled. Enable turns all of it back on. This setting applies only to Enterprise and Education editions of Windows.

[was: This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. If you enable this policy setting, you can specify the following Clock discipline, General and RODC parameters for this service. If you disable or do not configure this policy setting, Windows Time service uses the defaults of each of the following parameters. Several of the following values are scalar, which means that they only have meaning in relation to one another and are not defined by specific unit measurements. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Values that are too low can lead to overcorrection and instability. Values that are too high can lead to slow synchronization. Default: 4 (scalar). HoldPeriod This parameter indicates how many potentially accurate time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. After a period of not receiving any usable time samples, a time client ceases to evaluate time samples for spikes as soon as the first potentially accurate time sample is received. When a series of time samples (as indicated by HoldPeriod) is received, the time client evaluates subsequent time samples for spikes. A time sample is considered to be a spike when the time difference between a time sample and the client computer's local clock is greater than that of the LargePhaseOffset value. Default: Five time samples. LargePhaseOffset This parameter specifies the time variation from the client computer's local clock (phase offset) that a time sample must have to be considered a spike. Time samples that have time variations larger than the LargePhaseOffset value are considered spikes. Default: 50,000,000 100-nanosecond units (ns), which is five seconds. MaxAllowedPhaseOffset This parameter controls how W32time corrects the clock based on the size of the calculated time variation between the time sample and the client computer's local clock. If a response is received that has a time variation that is larger than this value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection This parameter controls the maximum allowable clock correction that can be made in a reverse direction. If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. If this happens, the Windows Time source logs an event in the System log of Event Viewer. Default: 172,800 seconds. MaxPosPhaseCorrection This parameter controls the maximum allowable clock correction that can be made in a forward direction. If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). PollAdjustFactor This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod This parameter specifies the amount of time that suspicious time samples are received from a time source before these time samples are accepted as accurate. Time samples are considered suspicious when the time difference between the time sample and the client computer's local clock is larger than the value of LargePhaseOffset. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, which is 1 second. General parameters: AnnounceFlags This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal. See the NtpClient\EventLogFlags Subkey documentation on Microsoft's TechNet Library for possible values. EventLogFlags This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. See the NtpClient\EventLogFlags Subkey documentation on Microsoft's TechNet Library for possible values. LocalClockDispersion This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, which is 1,024 seconds. (Should not be set higher than 15.) MinPollInterval This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, which is 64 seconds. RequireSecureTimeSyncRequests This parameter controls whether or not the the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. UtilizeSslTimeData This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 Boolean RODC parameters: ChainEntryTimeout This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. ] → [now: This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. For more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Default: 4 (scalar). HoldPeriod This parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5 LargePhaseOffset If a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds. MaxAllowedPhaseOffset If a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. MaxPosPhaseCorrection If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). PollAdjustFactor This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod This parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second. General parameters: AnnounceFlags This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal EventLogFlags This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. LocalClockDispersion This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.) MinPollInterval This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds. ClockHoldoverPeriod This parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds. RequireSecureTimeSyncRequests This parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. UtilizeSslTimeData This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean ClockAdjustmentAuditLimit This parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM). RODC parameters: ChainEntryTimeout This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. ]

This policy setting specifies a set of parameters for controlling the Windows NTP Client. If you enable this policy setting, you can specify the following parameters for the Windows NTP Client. If you disable or do not configure this policy setting, the WIndows NTP Client uses the defaults of each of the following parameters. NtpServer The Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of ""dnsName,flags"" where ""flags"" is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings. The default value is ""time.windows.com,0x09"". Type This value controls the authentication that W32time uses. The default value is NT5DS. CrossSiteSyncFlags This value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal). ResolvePeerBackoffMinutes This value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes. ResolvePeerBackoffMaxTimes This value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is seven attempts. SpecialPollInterval This NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of [removed: the][added: a variable interval between] MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. [removed: The default][added: SpecialPollInterval must be in the range of [MinPollInterval, MaxPollInterval], else the nearest] value [added: of the range ]is [removed: 3600 seconds (1 hour).][added: picked. Default: 1024 seconds.] EventLogFlags This value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged.

Specifies whether the Windows Update will use the Windows Power Management features to automatically wake up the system from [removed: hibernation,][added: sleep,] if there are updates scheduled for installation. Windows Update will only automatically wake up the system if Windows Update is configured to install updates automatically. If the system is in [removed: hibernation][added: sleep] when the scheduled install time occurs and there are updates to be applied, then Windows Update will use the Windows Power management features to automatically wake the system up to install the updates. Windows update will also wake the system up and install an update if an install deadline occurs. The system will not wake unless there are updates to be installed.[removed: ][added: ]If the system is on battery power, when Windows Update wakes it up, it will not install updates and the system will automatically return to [removed: hibernation][added: sleep] in 2 minutes.

Specify the deadline [removed: in days ]before [removed: automatically executing a scheduled][added: the PC will automatically] restart [removed: outside of active hours. ][added: to apply updates. ]The deadline can be set [removed: between ]2 [removed: and][added: to] 14 days [removed: from][added: past] the [removed: time the ][added: default ]restart [removed: is scheduled. Note that the PC must ][added: date. The ]restart [removed: for certain updates to take effect.][added: may happen inside active hours.] If you [removed: enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you ]disable or do not configure this policy, the PC will restart according to the default schedule. [removed: If any][added: Enabling either] of the following two policies [removed: are enabled, this policy has no effect:][added: will override the above policy:] 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time.

Enable this policy to specify [removed: the type of notification used for ][added: when ]auto-restart reminders [removed: and when they ]are displayed. [removed: Specifies the type of notification used when notifying the user about a scheduled restart to install updates. ]You can specify the amount of time prior to a scheduled restart to notify the user. If you disable or do not configure this policy, the default[removed: style and] period will be used.

Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service. Note: This policy does not apply to Windows RT. This setting lets you specify whether automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting: 2 = Notify before downloading and installing any updates. When Windows finds updates that apply to this computer, users will be notified that updates are ready to be downloaded. After going to Windows Update, users can download and install any available updates. 3 = (Default setting) Download the updates automatically and notify when they are ready to be installed Windows finds updates that apply to the computer and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to Windows Update, users can install them. 4 = Automatically download updates and install them on the schedule specified below. [added: When "Automatic" is selected as the scheduled install time, Windows will automatically check, download, and install updates. The device will reboot as per Windows default settings unless configured by group policy. (Applies to Windows 10, version 1809 and higher) ]Specify the schedule using the options in the Group Policy Setting. [added: For version 1709 and above, there is an additional choice of limiting updating to a weekly, bi-weekly, or monthly occurrence. ]If no schedule is specified, the default schedule for all installations will be every day at 3:00 AM. If any updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is signed in to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.) On Windows 8 and later, you can set updates to install during automatic maintenance instead of a specific schedule. Automatic maintenance will install updates when the computer is not in use[removed: ,] and avoid doing so when the computer is running on battery power. If automatic maintenance is unable to install updates for 2 days, Windows Update will install updates right away. Users will then be notified about an upcoming restart, and that restart will only take place if there is no potential for accidental data loss. [removed: Automatic maintenance can be further configured by using Group Policy settings here: Computer Configuration->Administrative Templates->Windows Components->Maintenance Scheduler ]5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates.[added: (This option has not been carried over to any Win 10 Versions)] With this option, local administrators will be allowed to use the Windows Update control panel to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates.[added: 7 = Notify for install and notify for restart. (Windows Server only) With this option from Windows Server 2016, applicable only to Server SKU devices, local administrators will be allowed to use Windows Update to proceed with installations or reboots manually.] If the status for this policy is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, search for Windows Update using Start. If the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel.

Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of [removed: WSUS Server.][added: the intranet update service.] If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them. If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. The alternate download server [removed: C][added: c]onfigures the Windows Update Agent to download files from an alternative download server instead of the [removed: WSUS Server.][added: intranet update service. The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server.] Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. Note: If the "Alternate Download Server" is not set, it will use the [removed: WSUS server][added: intranet update service] by default to download updates. Note: [added: The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. Note: ]This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.[added: To ensure the highest level of security, Microsoft recommends securing WSUS with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. If a proxy is required, we recommend configuring system proxy. To ensure highest levels of security, additionally leverage WSUS TLS certificate pinning on all devices. In order to keep clients inherently secure, we are no longer allowing intranet servers to leverage user proxy by default for detecting updates. If you need to leverage user proxy for detecting updates while using an intranet server despite the vulnerabilities it presents, you must configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails". Detection for updates against intranet servers will fail when user proxy is needed as a fallback and the alternate proxy behavior is not configured.]

Enable this policy to specify [removed: what type of feature updates ][added: when ]to [removed: receive, and when. The branch readiness level for each new Windows 10 feature update is initially considered a "Current Branch" (CB) release,][added: receive Feature Updates. Defer Updates | This enables devices to defer taking the next Feature Update available to your channel for up] to [removed: be used by organizations for initial deployments. Once Microsoft has verified][added: 14 days for all the pre-release channels and up to 365 days for] the [removed: feature update should be considered for enterprise deployment, it will be declared][added: Semi-Annual Channel. Or, if the device is updating from the Semi-Annual Channel,] a [removed: branch readiness level of "Current Branch for Business" (CBB). You can defer receiving feature updates for up to 180 days. To prevent feature updates from being received on their scheduled time, you can temporarily pause feature updates. The pause][added: version for the device to move to and/or stay on until the policy is updated or the device reaches end of service can be specified. Note: If you set both policies, the version specified will take precedence and the deferrals] will [removed: remain][added: not be] in [removed: effect for 60 days or until you clear the start date field. ][added: effect. Please see the Windows Release Information page for OS version information. Pause Updates | ]To [removed: resume receiving ][added: prevent ]Feature Updates [removed: which are paused, clear the start date field. If ][added: from being received on their scheduled time, ]you [removed: disable or do not configure this policy, Windows Update will not alter its behavior. Note: If][added: can temporarily pause Feature Updates. The pause will remain in effect for 35 days from] the [removed: "Allow Telemetry" policy is set to 0, this policy][added: specified start date or until the field is cleared (Quality Updates] will [removed: have no effect.][added: still be offered).]

Enable this policy to specify when to receive quality updates. You can defer receiving quality updates for up to 30 days. To prevent quality updates from being received on their scheduled time, you can temporarily pause quality updates. The pause will remain in effect for 35 days or until you clear the start date field. To resume receiving Quality Updates which are paused, clear the start date field. If you disable or do not configure this policy, Windows Update will not alter its behavior.[removed: Note: If the "Allow Telemetry" policy is set to 0, this policy will have no effect.]