Disable: 'Always automatically restart at the scheduled time for AlwaysAutoRebootAtScheduledTime' If you enable this policy, a restart timer will always begin immediately after Windows Update installs important updates, instead of first notifying users on the login screen for at least two days. The restart timer can be configured to start with any value from 15 to 180 minutes. When the timer runs out, the restart will proceed even if the PC has signed-in users. If you disable or do not configure this policy, Windows Update will not alter its restart behavior. If the "No auto-restart with logged on users for scheduled automatic updates installations" policy is enabled, then this policy has no effect. Counter Measure: Configure this setting depending on your organization's requirements. Potential Impact: Windows Update will automatically restart based on the configured setting.

(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Always automatically restart at the scheduled time (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AlwaysAutoRebootAtScheduledTime,AlwaysAutoRebootAtScheduledTimeMinutes