Skip to main content

How to Defer Quality Updates in Batch Script

Quality Updates in Windows (often called "Patch Tuesday" updates) include security fixes, critical driver updates, and minor bug patches. While these are essential for system security, sometimes a specific patch can cause issues with home-grown software or specific hardware configurations. By using a Batch script to "defer" quality updates, you can create a short buffer period (up to 30 days) to allow for testing before the patch is automatically applied to your systems. This guide explains how to configure these deferral periods using the Windows registry.

Why Defer Quality Updates?​

  • Testing Period: Allowing 3–7 days for the tech community to identify if a new patch has widespread bugs.
  • Rollout Management: Ensuring that all machines update at a coordinated time rather than randomly throughout the week.
  • Critical Operations: Precluding a security patch from installing and potentially requiring a reboot during a high-stakes week of work.
Security Implications

Quality updates often contain critical security fixes for "Zero-Day" vulnerabilities. Deferring these updates should only be done if you have a secondary layer of security or a strict plan to apply them within a few days.

Understanding the Quality Update Registry Keys​

Windows manages quality update deferrals similarly to feature updates, but with a shorter maximum duration.

The key location is: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

The primary values are:

  • DeferQualityUpdates: Enables (1) or disables (0) the deferral policy. The period value is ignored unless this is set to 1.
  • DeferQualityUpdatesPeriodInDays: The number of days to wait (0–30).
Administrative Privileges Required

Modifying system-wide update policies requires elevated permissions. You MUST run your Batch script as an Administrator, or the registry changes will not be saved.

Creating the Quality Update Deferral Script​

The following script sets a 7-day deferral for all quality updates, giving you a one-week testing window for every new security patch.

@echo off
setlocal EnableDelayedExpansion

set "REG_PATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
set "DEFER_DAYS=7"

echo ============================================================
echo   Quality Update (Security Patch) Deferral Configurator
echo ============================================================

:: 1. Check for Administrative Privileges
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] This script must be run as Administrator.
    pause
    exit /b 1
)

:: 2. Validate the deferral value (max 30 days)
if !DEFER_DAYS! gtr 30 (
    echo [ERROR] Quality update deferral cannot exceed 30 days.
    pause
    exit /b 1
)
if !DEFER_DAYS! lss 0 (
    echo [ERROR] Deferral days cannot be negative.
    pause
    exit /b 1
)

:: 3. Ensure the parent key exists
reg add "%REG_PATH%" /f >nul 2>&1

:: 4. Enable the deferral policy (must be set for the period to take effect)
echo [PROCESS] Enabling the Quality Update deferral policy...
reg add "%REG_PATH%" /v "DeferQualityUpdates" /t REG_DWORD /d 1 /f >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Failed to set DeferQualityUpdates.
    pause
    exit /b 1
)

:: 5. Set the deferral period
echo [PROCESS] Setting Quality Update deferral to %DEFER_DAYS% days...
reg add "%REG_PATH%" /v "DeferQualityUpdatesPeriodInDays" /t REG_DWORD /d %DEFER_DAYS% /f >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Failed to set DeferQualityUpdatesPeriodInDays.
    pause
    exit /b 1
)

:: 6. Verify settings by reading them back
echo.
echo [VERIFY] Current quality update deferral settings:
for %%V in (DeferQualityUpdates DeferQualityUpdatesPeriodInDays) do (
    reg query "%REG_PATH%" /v "%%V" 2>nul | findstr /I "%%V"
)

echo.
echo [SUCCESS] Quality updates will be deferred by %DEFER_DAYS% days.
echo ============================================================
pause

Removing the Quality Update Deferral​

Keep this script alongside your deferral script to quickly restore default behavior when needed, especially if a critical zero-day vulnerability is announced.

@echo off
setlocal

set "REG_PATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

echo ============================================================
echo   Remove Quality Update Deferral Policy
echo ============================================================

:: Check for Administrative Privileges
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] This script must be run as Administrator.
    pause
    exit /b 1
)

:: Remove deferral values
for %%V in (DeferQualityUpdates DeferQualityUpdatesPeriodInDays) do (
    reg delete "%REG_PATH%" /v "%%V" /f >nul 2>&1
)

echo [SUCCESS] Quality update deferral removed.
echo          Security patches will now install on their normal schedule.

:: Trigger an immediate update scan
usoclient StartScan >nul 2>&1
echo [PROCESS] Update scan triggered.

echo ============================================================
pause

Common Pitfalls and How to Avoid Them​

Setting the Period Without Enabling the Policy​

The DeferQualityUpdatesPeriodInDays value is ignored unless DeferQualityUpdates is set to 1. This is the most common reason the deferral appears to have no effect.

Wrong Way:

:: Setting the period but forgetting the enable flag
reg add "%REG_PATH%" /v "DeferQualityUpdatesPeriodInDays" /t REG_DWORD /d 7 /f
:: Windows ignores this because DeferQualityUpdates is not set to 1

Correct Way:

:: Enable the policy first, then set the period
reg add "%REG_PATH%" /v "DeferQualityUpdates" /t REG_DWORD /d 1 /f >nul 2>&1
reg add "%REG_PATH%" /v "DeferQualityUpdatesPeriodInDays" /t REG_DWORD /d 7 /f >nul 2>&1

Maxing Out the Deferral​

Unlike feature updates which can be deferred for up to a year, quality updates can only be deferred for a maximum of 30 days.

Wrong Way:

:: Trying to defer security patches for 60 days
reg add "%REG_PATH%" /v "DeferQualityUpdatesPeriodInDays" /t REG_DWORD /d 60 /f
:: Windows will silently clamp or ignore this value

Correct Way: Always keep your quality update deferral between 1 and 30 days. For most users, 7 days is the "sweet spot" between safety and security.

Checking Only the Last %errorlevel%​

Running multiple reg add commands but checking the exit code only once at the end silently hides failures in earlier commands.

Wrong Way:

reg add "%REG_PATH%" /v "DeferQualityUpdates" /t REG_DWORD /d 1 /f
reg add "%REG_PATH%" /v "DeferQualityUpdatesPeriodInDays" /t REG_DWORD /d 7 /f
:: Only reflects the second command
if %errorlevel% equ 0 echo [SUCCESS]

Correct Way: Check %errorlevel% immediately after each critical command, as shown in the main script above.

Windows Home Edition​

Similar to feature updates, internal policy controls are often limited in Windows Home Edition. These scripts are designed primarily for Pro and Enterprise editions.

SEO and UX Tip

If you are on Windows Home and need to defer a quality update, use the "Pause Updates" feature in the Settings UI, which is more reliably respected on Home versions than registry policy keys.

Best Practices for Patch Management​

  1. Read the News: If you defer updates, make it a habit to check tech news sites (like BleepingComputer or Reddit) on "Patch Tuesday" to see if any major issues are reported with the latest patches.
  2. Emergency Overrides: If a critical, actively exploited vulnerability is announced, use the removal script above to delete the deferral entirely rather than setting the period to zero, this cleanly removes the policy so Windows returns to its default behavior.
  3. Audit Regularly: Use reg query in your central maintenance scripts to verify the current deferral state across machines: 
    echo --- Quality Update Deferral Audit: %COMPUTERNAME% ---
    for %%V in (DeferQualityUpdates DeferQualityUpdatesPeriodInDays) do (
        reg query "%REG_PATH%" /v "%%V" 2>nul | findstr /I "%%V"
    )
  4. Keep Deferrals Short: A 7-day deferral covers one full business week, long enough for major bugs to surface, short enough to stay current on security.
Driver Updates

Note that deferring quality updates may also defer driver updates delivered via Windows Update. If you are waiting for a critical graphics driver fix, you may need to download it manually from the manufacturer's website.

Conclusion​

Deferring quality updates via Batch script is a strategic way to balance system security with operational stability. By creating a short, manageable buffer period for security patches, you allow time for the broader tech community to vet new updates without leaving your system exposed for too long. This professional approach to lifecycle management provides peace of mind, ensuring that your automated systems don't fall victim to a buggy "Patch Tuesday" release while maintaining a robust security posture throughout the year.

Table of Contents