How to Enable Windows Automatic Updates in Batch Script

Keeping your system updated is the most effective way to protect against security vulnerabilities, performance bugs, and hardware compatibility issues. If automatic updates were previously disabled, either for a specific project or by a third-party optimization tool, it is essential to re-enable them to ensure your machine remains healthy. While you can do this through the "Settings" app, using a Batch script is a faster way to reset all update-related services and registry policies to their default "on" state. This guide provides a comprehensive script to restoring Windows Update functionality.

Why Re-enable Automatic Updates?

• Security Patches: Receiving the latest definitions to block new malware and exploits.
• Driver Stability: Automatically receiving updated drivers for graphics cards, network adapters, and chipsets.
• Feature Access: Ensuring your OS has the latest improvements and compatibility for new software.
• Compliance: Meeting the security requirements for connecting to corporate or school networks.

Planning the Restoration Script

To fully re-enable updates, a script must:

1. Clear Registry Policies: Remove any "Disable" flags set in the WindowsUpdate keys.
2. Reset Service Start Types: Change update services from "Disabled" to "Automatic" or "Manual (Trigger Start)."
3. Restore Service Recovery Actions: Re-apply default failure-recovery settings so Windows can self-heal the services.
4. Start the Services: Immediately launch the services to begin a background scan.

Creating the Update Restoration Script

The following script restores the services and clears the most common registry "blocks."

@echo off
setlocal

echo ============================================================
echo   RESTORE: Windows Automatic Update Enabler
echo ============================================================

:: 1. Check for Administrative Privileges
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] This script must be run as Administrator.
    pause
    exit /b 1
)

:: 2. Clear Registry Policy Blocks (do this BEFORE starting services)
echo [PROCESS] Removing registry restrictions...

set "REG_PATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

:: Remove the entire AU policy key so Windows reverts to default behavior
reg delete "%REG_PATH%" /f >nul 2>&1

:: Also remove the parent key if it is now empty, to leave no policy residue
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f >nul 2>&1

echo [DONE] Registry policies cleared.

:: 3. Reset Service Configurations
echo [PROCESS] Configuring services to their defaults...

:: Windows Update Service (default: demand / manual trigger-start)
sc config wuauserv start= demand >nul 2>&1
sc failure wuauserv reset= 86400 actions= restart/60000/restart/120000// >nul 2>&1

:: Background Intelligent Transfer Service (default: delayed-auto)
sc config bits start= delayed-auto >nul 2>&1
sc failure bits reset= 86400 actions= restart/60000/restart/120000// >nul 2>&1

:: Update Orchestrator Service (default: demand / manual trigger-start)
sc config UsoSvc start= demand >nul 2>&1
sc failure UsoSvc reset= 86400 actions= restart/60000/restart/120000// >nul 2>&1

:: Windows Update Medic Service (default: manual)
sc config WaaSMedicSvc start= demand >nul 2>&1

echo [DONE] Service start types and recovery actions restored.

:: 4. Start the Services
echo [PROCESS] Starting services...

net start wuauserv >nul 2>&1
net start bits >nul 2>&1
net start UsoSvc >nul 2>&1

:: 5. Verify final state
echo.
echo [VERIFY] Current service states:
set "ALL_RUNNING=1"
for %%S in (wuauserv bits UsoSvc) do (
    sc query %%S | findstr /I "RUNNING" >nul 2>&1
    if errorlevel 1 (
        echo   %%S : NOT RUNNING
        set "ALL_RUNNING=0"
    ) else (
        echo   %%S : RUNNING
    )
)

echo.
if "%ALL_RUNNING%"=="1" (
    echo [SUCCESS] All update services are running.
) else (
    echo [WARNING] One or more services did not start.
    echo          Some services only start on-demand and may show
    echo          as STOPPED until the next update check. This is
    echo          normal for wuauserv and UsoSvc.
)

:: 6. Trigger an immediate update scan
echo.
echo [PROCESS] Triggering an update scan...
usoclient StartScan >nul 2>&1

echo.
echo ============================================================
echo   Automatic Updates have been RE-ENABLED.
echo   Open Settings ^> Windows Update to confirm.
echo ============================================================
pause

Explaining the Service Start Types

• demand (Manual / Trigger Start): This is the default for wuauserv and UsoSvc. The service starts when Windows or an application needs to check for updates, then stops when idle.
• delayed-auto: Standard for bits. It starts a few minutes after boot to avoid slowing down your initial login experience.

Explaining Service Recovery Actions

The sc failure commands restore the default behavior where Windows automatically restarts a crashed update service after 60 seconds on the first failure and 120 seconds on the second. A disable script may have cleared these actions, leaving the services unable to self-heal.

Common Pitfalls and How to Avoid Them

Service "Stuck" in Disabled

Sometimes, the net start command will fail because the service is still set to "Disabled" from a previous script.

Wrong Way:

:: Trying to start without changing the start type first
net start wuauserv
:: Fails with: "The service is not started" or error 1058

Correct Way: Always run the sc config command before the net start command to unlock the service for starting.

sc config wuauserv start= demand >nul 2>&1
net start wuauserv >nul 2>&1

Leftover AUOptions Overriding Default Behavior

If you delete NoAutoUpdate but leave AUOptions set to a non-default value, Windows may still behave unexpectedly, for example, only notifying instead of downloading automatically.

Wrong Way:

:: Removing only one value and adding another in the same policy key
reg delete "%REG_PATH%" /v "NoAutoUpdate" /f >nul 2>&1
reg add "%REG_PATH%" /v "AUOptions" /t REG_DWORD /d 4 /f >nul 2>&1
:: The policy key still exists, so Windows treats it as a managed PC

Correct Way: Delete the entire AU policy key so Windows reverts to its built-in default behavior with no policy override at all.

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /f >nul 2>&1

Not Checking the Medic Service

Modern Windows (1903+) includes the Windows Update Medic Service (WaaSMedicSvc). If this service is disabled, Windows cannot automatically repair broken update components, and your re-enable script may appear to work but updates will silently fail later.

Best Practices for Successful Updating

1. Verify with Settings UI: After running the script, open Settings → Windows Update and click "Check for updates" to visually confirm the system is working.
2. Check the Medic Service: Ensure WaaSMedicSvc is not disabled. The main script above already resets it, but you can verify:

   sc qc WaaSMedicSvc | findstr /I "START_TYPE"

3. Audit All Service States: Use a quick loop to confirm every update-related service is set to its correct start type:

   for %%S in (wuauserv bits UsoSvc WaaSMedicSvc) do (
       echo --- %%S ---
       sc qc %%S | findstr /I "START_TYPE"
       sc query %%S | findstr /I "STATE"
   )

4. Restart if Needed: Some policy changes only take full effect after a reboot. If updates still do not appear, restart the machine once.

Conclusion

Re-enabling Windows automatic updates via Batch script is a critical step in restoring system integrity and security. By systematically resetting service start types and purging restrictive registry policies, you ensure that your computer can once again receive the vital patches it needs to stay functional and safe. This automated approach is the most efficient way to undo "optimization" tweaks and return a system to its recommended configuration, providing a solid foundation for long-term stability and protection against digital threats.