A. Windows Update is great for getting the latest fixes; however, you probably want to control change roll-outs, so it's a good idea to stop users from connecting directly to Windows Update. You can do so via a Group Policy:

  1. Start the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in (Start, Programs, Administrative Tools, Active Directory Users and Computers).
  2. Right-click the container of the users (a site/domain or organizational unit--OU), and select Properties.
  3. Go to the Group Policy tab.
  4. Select the policy and click Edit.
  5. Expand User Configuration, Administrative Templates, Start Menu & Taskbar.
  6. Double-click "Disable and remove links to Windows Update."
  7. Set this policy to Enabled and click OK.


  8. Click here to view image

  9. Close all windows.