What you will achieve

Understand how Windows Update behaves on a home PC versus a domain- or Intune-managed machine, and where to change settings on each.

1) Home and unmanaged PCs

Updates come directly from Microsoft via Settings → Windows Update.
You control pause duration, active hours, and optional feature update timing (within what Microsoft allows on Home).
There is no local WSUS server — the PC talks to Windows Update servers on the internet.

2) Domain-joined PCs (WSUS / Group Policy)

Administrators point clients to a WSUS server via Group Policy: Computer Configuration → Administrative Templates → Windows Components → Windows Update → Specify intranet Microsoft update service location.
Approved updates download from the internal WSUS server, not directly from the internet.
Check policy status: Win + R → rsop.msc (Resultant Set of Policy) or gpresult /h C:\gpreport.html.

3) Microsoft Intune / Entra-managed PCs

Update rings and deferrals are set in the Intune admin centre, not locally.
On the PC, open Settings → Accounts → Access work or school to see enrolment.
Some options in Windows Update show Some settings are managed by your organisation.

4) Verify update source on any PC

Admin PowerShell:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -ErrorAction SilentlyContinue | Select-Object WUServer, WUStatusServer

If WUServer is set, the PC uses WSUS. Empty values mean direct Windows Update.

5) Intune Windows Update rings

Admins assign devices to rings (Pilot, Broad) with different deferral and deadline policies.
On device: Settings → Accounts → Access work or school → Connected to <org> → Info shows sync status.

6) Force policy refresh on client

gpupdate /force
UsoClient StartScan

7) Delivery Optimization on work PCs

Settings → Windows Update → Advanced options → Delivery Optimization — domain PCs may disable peer caching via policy.
Verify: Get-DeliveryOptimizationStatus in PowerShell.

8) Windows Update for Business without WSUS

Small business can use Intune cloud policy without hosting WSUS — devices still talk to Microsoft CDN but deferrals apply via cloud MDM.

Hybrid: WSUS for LAN caching plus cloud policy for deferral rings.
Verify dual stack: USOClient StartScan after policy change.

Verification checklist

Document whether WUServer registry key is empty on home PCs and populated on managed ones. Screenshot Settings showing organisation-managed message for audit trail on work laptops.

Reboot once after changes that affect services, drivers, or firmware.
Confirm the original problem is resolved under normal daily use, not only immediately after the fix.
Note date, Windows version (Settings → System → About), and what changed in your personal runbook for next time.