Preventing Windows Updates During OSD with ConfigMgr

A question came in from the community that hits a very real pain point in ConfigMgr OSD:
“Why is Windows Update suddenly running during my Task Sequence?”

If you’ve spent any time building Task Sequences, you’ve likely seen this in action. You carefully design the flow to deploy Windows, apply drivers, install applications, and run scripts in a controlled order. Then, out of nowhere, Windows Update decides it’s time to do its thing mid-deployment. The result? Paused progress, unpredictable timing, and in some cases, broken application installs.

This post walks you through a simple PowerShell script and Task Sequence integration to disable those updates during OSD, keep your TS deterministic and clean, and bring back control to your deployment workflow

Update January 1, 2026: Restore script added…

Credits: Thank you Matt Wreede (@MattWreede) for initial research and help.

Background – Why this matters

When you use ConfigMgr for OSD, the default behavior is typically to allow Windows Update or Dynamic Update to trigger during setup. That can happen:

• After image apply, but before applications install
• During first boot while apps or drivers are being deployed
• While TS steps are still running and may assume a clean baseline

The result: an update triggers, reboots or driver changes happen unexpectedly, your app installs fail or hang, and your TS ends up taking far longer than it should—or worse, doesn’t complete as expected.
From a performance and reliability standpoint this is one of those “silent villains”.

By explicitly disabling update checks during the TS, you remove the variable. You know exactly what your TS does, when it does it, and what version your machine will be at after imaging.

Workaround

Simply add the below script to your ConfigMgr Task Sequence, to the WinPE phase, so the various registry entries are injected before Windows 11 even boots. To ensure Windows Update didn't have a chance to kick in I enabled settings in three phases of the setup

1. In WinPE (offline) after the image has been applied, but before booting into Windows
2. In Windows, via the unattend.xml, in the specialize pass which runs early
3. In Windows, via the task sequence, after the ConfigMgr client gets installed

Edit the Task Sequence

1. Download the scripts and unattend.xml sample from GitHub: https://github.com/DeploymentResearch/DRFiles/tree/master/Scripts/ConfigMgr/PreventingUpdatesDuringOSD

2. Add the unattend.xml file to a package, and configure the Apply Operating System action to use the Unattend.xml

3. Before the Setup Windows and Configuration Manager action, run the Invoke-DisableWindowsUpdateOffline.ps1 script either embedded in the TS, or in a package.

4. Add an action that copies the Invoke-DisableWindowsUpdateOnline.ps1 script to the task sequence cache, where the unattend.xml will pick it up before the task sequence starts again. Command line when copying from a mapped network share, but you can also copy from a package (requirement if doing Internet-based deployments via CMG):

xcopy H:\Scripts\Invoke-DisableWindowsUpdateOnline.ps1 %_SMSTSMDataPath%\Scripts\ /e /i /y

5. After the Setup Windows and Configuration Manager action, run the Invoke-DisableWindowsUpdateOnline.ps1 script (again) either embedded in the TS, or in a package.

6. Finally, as the last step of your main task sequence, run the Invoke-EnableWindowsUpdateOnline.ps1 script (again) either embedded in the TS, or in a package. This script will remove the configured registry keys and enable the services again.