So I've given up and am conceding to automatic updates in Windows 10. I can't seem to make sense of the GPO options that configure automatic updates though.

So I've set up two virtual machines, Windows 10 ver. 1607 and Windows 10 ver. 1703.

I've set the following group policy options on them:

**Computer Configuration / Administrative Template / Windows Components / Windows Update**

GPO Setting | Value ---|--- Configure Automatic Updates | Enabled - 4 (Download and Install) & Install during automatic maintenance No auto-restart with logged on users for scheduled automatic updates installations | Enabled Automatic Updates Detection Frequency | Enabled - 1 Hour*

\* I know 1 hour is gratuitous, this is just for testing

**Computer Configuration / Administrative Template / Windows Components / Maintenance Scheduler**

GPO Setting | Value ---|--- Automatic Maintenance Activation Boundary | Enabled - 2000-01-01T02:00:00 Automatic Maintenance Random Delay | Disabled Automatic Maintenance WakeUp Policy | Enabled

With these settings I would expect Windows to download updates whenever but wait until the maintenance window at 2:00 AM to apply them. Following the installation I would expect Windows to reboot automatically if no one is logged in and notify the user if they are.

However the 1703 VM appears to install updates outside of the maintenance window (yesterday it applied some at 7:00 PM and rebooted automatically) and the 1607 VM has been pending a reboot for two days now with no one logged in.

Am I missing something? Any help is appreciated.