Setting up driver update policies with Group Policy

Managing driver updates on one PC is simple enough, but across a fleet of machines you need rules that apply consistently and don't rely on each user remembering to click the right thing. Group Policy gives administrators exactly that: centralized control over whether Windows delivers drivers at all, which quality updates carry them, and even which specific devices are allowed to install new drivers. Set correctly, these policies keep known-good configurations stable while security updates keep flowing. Here's how to reach the relevant settings, apply them, and confirm they took across your machines.

1. 1

   Open the Group Policy Editor

   On a Windows Pro, Enterprise, or Education machine, press Windows+R, type gpedit.msc, and press Enter to open the Local Group Policy Editor. For domain-wide control, use the Group Policy Management Console on a domain controller instead, where you edit a Group Policy Object linked to the right organizational unit. The policy paths are the same in both places. Working through a domain GPO lets one change reach many machines at once, while local gpedit is fine for a handful of standalone PCs you configure individually.

2. 2

   Decide your driver update strategy

   Before flipping switches, settle on what you actually want. Do you want to stop all drivers from arriving through Windows Update, keep them but exclude them from quality updates, or lock down only a few sensitive devices while everything else updates freely? Blanket blocks are simple but can leave hardware without important fixes. Targeted blocks preserve most automatic updating. Write down which machines and which devices each rule should cover, so you apply the narrowest policy that meets your goal rather than an overly broad one that creates support headaches later.

3. 3

   Exclude drivers from quality updates

   To keep monthly quality updates from carrying driver changes, navigate to Computer Configuration, Administrative Templates, Windows Components, Windows Update, and Manage updates offered from Windows Update. Open 'Do not include drivers with Windows Updates,' set it to Enabled, and click OK. This corresponds to the ExcludeWUDriversInQualityUpdate setting. Security and feature updates continue to install, but drivers won't ride along with them. It's a clean fleet-wide way to let your own driver deployment process, rather than Windows Update, decide when hardware drivers change.

4. 4

   Restrict device installation by hardware ID

   For device-level control, go to Computer Configuration, Administrative Templates, System, Device Installation, and Device Installation Restrictions. Open 'Prevent installation of devices that match any of these device IDs,' set it to Enabled, click Show, and enter each hardware ID you want to pin. You can gather IDs from a reference machine's Device Manager under a device's Details tab. Decide whether to apply the rule to matching devices already installed. This stops Windows from installing new drivers for exactly those devices while leaving all others free to update normally.

5. 5

   Allow trusted devices where needed

   Restriction policies can be paired with allow rules so you don't accidentally block hardware you rely on. In the same Device Installation Restrictions folder, the 'Allow installation of devices that match any of these device IDs' policy grants exceptions, and allow rules generally take precedence over prevent rules unless you enable the setting that makes prevention win. Use allow lists to keep standard peripherals like keyboards and storage working smoothly while your prevent list handles only the specific devices you're pinning. Document every ID so future admins understand each entry.

6. 6

   Push the policy and force a refresh

   Local edits apply on the next policy refresh, but you can speed things along. On the target machine, open a Command Prompt as administrator and run gpupdate /force, then wait for confirmation that computer policy updated. For domain GPOs, clients pick up changes at their normal refresh interval, or you can run gpupdate /force per machine or trigger a remote refresh from your management tools. Some device installation changes need a restart to fully take hold, so plan a reboot window for affected machines when rolling out the change broadly.

7. 7

   Verify the policies are in effect

   Confirm each machine received the settings. Run gpresult /r or gpresult /h with an output file to see which policies applied, and look for your Windows Update and Device Installation entries in the report. On a sample machine, force a Windows Update check from Settings and confirm drivers behave as intended: excluded drivers shouldn't arrive, and pinned devices should keep their current versions. Check Device Manager driver versions against your baseline. Verifying on a representative machine before wide rollout catches typos in hardware IDs before they cause fleet-wide surprises.