KB5077181 has caused unexpected automatic restarts that are beyond the control of the users.

Hi yanhaowen,

This behavior is tied to changes Microsoft made in recent cumulative updates where certain servicing stack components override the legacy NoAutoRebootWithLoggedOnUsers setting. KB5077181 appears to trigger a forced restart because of kernel-level changes that require immediate reboot, regardless of the GPO. You should first confirm in the event logs under Applications and Services Logs\Microsoft\Windows\WindowsUpdateClient\Operational whether the restart was flagged as “RebootRequired” with Event ID 1074 or 1001. If so, the policy is being bypassed by design. The recommended mitigation is to enforce restart control through the newer Windows Update for Business policies (ActiveHoursStart and ActiveHoursEnd) or by configuring Specify deadlines for automatic updates and restarts in GPO, which supersedes the older AU registry key. If you need to block restarts entirely, you can temporarily set HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\AlwaysAutoRebootAtScheduledTime to 0 and validate with gpresult /h report.html that the policy is applied. If the forced reboot persists even with these settings, it is a known regression in the February update and you should monitor Microsoft’s release notes for a servicing stack fix in the March cumulative update.

If the above response helps answer your question, please hit "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Harry.

KB5077181 does not change the documented behavior of the Windows Update restart controls: the NoAutoRebootWithLoggedOnUsers setting and related Group Policy options are legacy mechanisms with important limitations, and newer deadline/compliance behaviors can override the expectation of “no automatic restarts ever.”

Key points from the documented behavior:

1. NoAutoRebootWithLoggedOnUsers is limited and can be overridden
   • NoAutoRebootWithLoggedOnUsers under HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU corresponds to the No auto-restart with logged on users for scheduled automatic updates installations policy.
   • This policy only applies when Configure Automatic Updates is set to 4 - Auto download and schedule the install.
   • If a user explicitly schedules a restart from an update notification, that user action overrides NoAutoRebootWithLoggedOnUsers and the restart occurs at the specified time, even if a user is logged on.
   • Documentation also notes that this policy was never implemented as a CSP and does not behave exactly as described in all cases; it can even result in no quality update reboots at all if users never log off, which is why the recommendation is to move to deadline-based management instead of relying on it alone.
2. Other restart-related policies can take precedence In Computer Configuration > Administrative Templates > Windows Components > Windows Update, several restart policies interact:
   • Turn off auto-restart for updates during active hours
   • Always automatically restart at the scheduled time (legacy)
   • Specify deadline before auto-restart for update installation (legacy)
   • No auto-restart with logged on users for scheduled automatic updates installations
   The documented precedence for Windows 10 (and similar behavior patterns on later versions) is:
   • If No auto-restart with logged on users for scheduled automatic updates installations is enabled, it overrides Always automatically restart at the scheduled time and Turn off auto-restart for updates during active hours.
   • If Always automatically restart at the scheduled time is enabled, it overrides Turn off auto-restart for updates during active hours.
   • Specify deadline before auto-restart for update installation is also disabled if either No auto-restart with logged on users… or Always automatically restart at the scheduled time is enabled.
   If any of these legacy policies were changed, disabled, or not applied as expected on some devices, Windows Update may proceed with automatic restarts after installation.
3. Deadline/compliance policies can force restarts
   • Modern guidance recommends using Specify deadline for automatic updates and restarts to keep devices secure and compliant.
   • When a deadline is configured, Windows can force installation and restart after the deadline expires, even if users would prefer to defer.
   • Once the restart deadline is reached, users are no longer able to postpone the restart; scheduled automatic restart warnings are shown, but the restart will occur.
   If such a deadline policy is configured (for example via Group Policy or Windows Update for Business) and the deadline for KB5077181 was reached, devices can restart automatically even when users are logged on, regardless of older expectations around NoAutoRebootWithLoggedOnUsers.
4. Engaged restart and notification policies are legacy for Windows 11
   • Policies such as Specify engaged restart transition and notification schedule for updates, Configure auto-restart-reminder notifications for updates, and Configure auto-restart warning notifications schedule for updates are documented as legacy and not applicable to Windows 11; they may be removed in future releases.
   • Relying on these legacy policies on Windows 11 can lead to behavior that differs from what was seen on Windows 10 or earlier updates.
5. Recommended direction For Windows 11 devices managed via WSUS/Group Policy:
   • Ensure Configure Automatic Updates is set consistently (typically 4 - Auto download and schedule the install) if NoAutoRebootWithLoggedOnUsers is expected to have effect.
   • Review and standardize the following policies:
     • No auto-restart with logged on users for scheduled automatic updates installations
     • Turn off auto-restart for updates during active hours
     • Any Specify deadline for automatic updates and restarts / compliance deadline settings
   • Prefer deadline-based management for predictable security posture, and use active hours and notification settings to minimize user disruption, rather than relying solely on NoAutoRebootWithLoggedOnUsers.

The behavior observed after KB5077181 is consistent with the documented limitations and precedence of the restart-related policies and the shift toward deadline-based enforcement, rather than a regression in honoring NoAutoRebootWithLoggedOnUsers as an absolute block on automatic restarts.

References:

• Manage device restarts after updates
• WSUS client computers restart automatically without any notification when updates are installed on the client computers
• Step 4: Configure Group Policy settings for automatic updates
• Walkthrough: Use Group Policy to configure Windows Update client policies