REM 5. Force update and log gpupdate /force /logoff

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose First, export the policy, edit the INF file’s [Privilege Rights] section, then re-import:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 1 /f (Computer Config > Admin Templates > Windows Components > Search)