Windows 11 automatically restarting after install security Update — With GPO and WSUS.

✅ Accepted Solution – Explanation and Fix

We were able to resolve the issue.
Posting the full solution here in case it helps others facing the same behavior with Windows 11 and WSUS.

Problem Summary

Windows 11 devices were automatically restarting after installing updates delivered through WSUS, even though:

Active Hours were configured

“Turn off auto-restart during active hours” was enabled

Deadlines were set to 0

Install during automatic maintenance was disabled

Users were logged in

This behavior did not occur on Windows 10—only Windows 11.

The affected devices displayed:

“Your organization manages update settings… We will restart and install this update in XX minutes.”

Root Cause

Windows 11 uses a new update orchestration model with Windows Update for Business (WUfB), which introduces mechanisms that override legacy WSUS/GPO restart policies, including:

Restart ASAP

Forced Reboot Timer

UsoSvc Orchestration

These components have higher priority than the traditional Windows Update GPOs used on Windows 10.
If the modern WUfB policies are not explicitly configured, Windows 11 may ignore the legacy policies and enforce a restart to complete updates.

This explains why Windows 10 behaved correctly while Windows 11 did not.

Additional Finding

Our domain was using older ADMX templates, so Windows 11 could not properly interpret or expose the modern Windows Update policies in GPMC.

We updated the ADMX templates using:

Administrative Templates (.admx) for Windows 11 (25H2):
https://www.microsoft.com/en-us/download/details.aspx?id=108394

And replaced:

windowsupdate.admx

windowsupdate.adml

in the Central Store:

\\domain\sysvol\domain\Policies\PolicyDefinitions

After updating the ADMX, the modern policies became available and functional.

Solution (WUfB Policies Required for Windows 11)

The key was enabling the modern Windows Update for Business restart controls.

1) Specify deadlines for automatic updates and restarts (Feature Updates)

Deadline (days): 0

Grace Period (days): 2

2) Don’t auto-restart until the end of the grace period

Enabled

3) Active Hours configured:

Start: 7 AM

End: 9 PM

4) Maintain scheduled installation at 10:00 AM

Using:

4 – Auto download and schedule the install

Why This Works

Deadline = 0
Disables mandatory auto-restarts enforced by Windows 11.

Grace Period = 2 days
Prevents any automatic restart for 48 hours after update installation.

Don’t auto-restart until end of grace period
Explicitly disables the Restart ASAP behavior in Windows 11.

Once these policies were applied, Windows 11 stopped restarting automatically and began respecting Active Hours and user presence—matching the expected behavior.

Updates still install normally through WSUS at 10 AM, but the restart is now fully user-controlled.

Final Result

After applying the updated ADMX files and configuring the modern WUfB restart policies:

✔ No more unexpected restarts on Windows 11
✔ Active Hours (7 AM – 9 PM) are respected
✔ Updates continue installing at 10 AM as scheduled
✔ Restarts occur only when initiated by the user
✔ Windows 10 and Windows 11 now behave consistently