Windows Update policy values set in the registry

# Lists every value under the Windows Update policy registry keys. Read-only.

$keys = @(
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate',
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
)

foreach ($path in $keys) {
    if (-not (Test-Path -Path $path)) {
        [pscustomobject]@{ Key = $path; Name = '(key not present)'; Value = $null }
        continue
    }
    $key = Get-Item -Path $path
    foreach ($name in $key.GetValueNames()) {
        [pscustomobject]@{ Key = $path; Name = $name; Value = $key.GetValue($name) }
    }
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check.

Reading the output

• Reads the two policy keys Microsoft documents for Windows Update: ...\Policies\Microsoft\Windows\WindowsUpdate and its AU subkey. Values are shown raw; the linked page explains what they mean.
• Policies delivered through MDM (for example Intune update rings) are not read by this script.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.