Use this procedure on a disposable pilot computer.
The full native update and installation cycle is not qualified.
Start with one Windows profile that matches the pilot computer.
Keep the existing production update policy in place for the rest of the fleet.
For direct TCP, an example is https://updates.example.net:18531.
For a reverse proxy, an example is https://updates.example.net.
Use the URL root without /Content, /ClientWebService or the console port 9000.
$Endpoint = 'https://updates.example.net:18531'
$uri = [uri]$Endpoint
Resolve-DnsName $uri.DnsSafeHost
Test-NetConnection $uri.DnsSafeHost -Port $uri.Port
Invoke-RestMethod "$Endpoint/healthz"Run these commands in Windows PowerShell.
A successful TCP test checks connectivity only.
A health response checks the listener and TLS path.
Neither test proves that catalogue discovery or installation works.
Use a dedicated pilot GPO or the local Group Policy editor.
On recent ADMX templates, open Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Server Update Service.
On older templates, the setting can appear directly under Windows Update.
gpupdate /force and restart the Windows Update service during the pilot maintenance window.Windows uses these policy names even though Artica does not use a Microsoft WSUS server.
The statistics URL is a Windows policy value.
Artica does not currently provide per-computer installation reporting.
Check existing Windows Update for Business, domain and MDM policies before the pilot.
If the scan source policy is used, manage all four update classes together.
Do not assume that setting an intranet URL overrides every existing scan source policy.
See Microsoft: update service location and Microsoft: scan source policy.
Keep normal Microsoft signature checks enabled.
The policy for allowing updates signed by other publishers is not required.
Do not block all public Windows Update locations for this initial experimental pilot.
Run as Administrator in Windows PowerShell 5.1.
Use this only when no domain GPO or MDM policy owns these values.
The script saves the previous values before changing them.
It disables automatic updates for the pilot and performs no installation.
$ErrorActionPreference = 'Stop'
$Endpoint = 'https://updates.example.net:18531'
$wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
$au = "$wu\AU"
$backup = Join-Path $env:ProgramData 'Artica-WindowsUpdate-policy-before.xml'
if (Test-Path $backup) { throw "Backup already exists: $backup" }
$changes = @(
@{ Path=$wu; Name='WUServer'; Type='String'; Value=$Endpoint },
@{ Path=$wu; Name='WUStatusServer'; Type='String'; Value=$Endpoint },
@{ Path=$au; Name='UseWUServer'; Type='DWord'; Value=1 },
@{ Path=$au; Name='NoAutoUpdate'; Type='DWord'; Value=1 }
)
$before = foreach ($change in $changes) {
$key = Get-Item -LiteralPath $change.Path -ErrorAction SilentlyContinue
$exists = $null -ne $key -and $key.GetValueNames() -contains $change.Name
[pscustomobject]@{
Path = $change.Path
Name = $change.Name
Exists = $exists
Type = $(if ($exists) { $key.GetValueKind($change.Name).ToString() } else { $null })
Value = $(if ($exists) { $key.GetValue($change.Name) } else { $null })
}
}
$before | Export-Clixml -LiteralPath $backup
foreach ($change in $changes) {
if (-not (Test-Path -LiteralPath $change.Path)) {
New-Item -Path $change.Path -Force | Out-Null
}
New-ItemProperty -Path $change.Path -Name $change.Name `
-PropertyType $change.Type -Value $change.Value -Force | Out-Null
}
Restart-Service wuauserv
Get-ItemProperty $wu | Select-Object WUServer, WUStatusServer
Get-ItemProperty $au | Select-Object UseWUServer, NoAutoUpdateUse the managed update source explicitly for the pilot search:
$session = New-Object -ComObject Microsoft.Update.Session
$session.ClientApplicationID = 'Artica Windows Update pilot'
$searcher = $session.CreateUpdateSearcher()
$searcher.ServerSelection = 1
$searcher.Online = $true
$result = $searcher.Search("IsInstalled=0 and Type='Software'")
[pscustomobject]@{
ResultCode = [int]$result.ResultCode
UpdateCount = $result.Updates.Count
InstallationPerformed = $false
}This search can take time and does not download or install updates.
A result code of 2 with zero updates can mean the native dialogue completed against an empty catalogue.
It does not mean that Windows has no missing patches.
The verified empty-scan test used Windows 10 Pro 22H2 x64, build 19045.6466.
Equivalent native installation coverage is not established for every selectable Windows or Server version.
After the test, restore the four policy values from the backup:
$ErrorActionPreference = 'Stop'
$backup = Join-Path $env:ProgramData 'Artica-WindowsUpdate-policy-before.xml'
foreach ($entry in (Import-Clixml -LiteralPath $backup)) {
if ($entry.Exists) {
if (-not (Test-Path -LiteralPath $entry.Path)) {
New-Item -Path $entry.Path -Force | Out-Null
}
New-ItemProperty -Path $entry.Path -Name $entry.Name `
-PropertyType $entry.Type -Value $entry.Value -Force | Out-Null
} else {
Remove-ItemProperty -Path $entry.Path -Name $entry.Name `
-ErrorAction SilentlyContinue
}
}
Restart-Service wuauserv
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
-ErrorAction SilentlyContinue | Select-Object WUServer, WUStatusServerVerify the restored values before removing the backup file.
If you used Group Policy, revert the pilot GPO through the same policy tool.
Refresh policy and verify the effective settings again.
Remove a test CA only if it was added solely for this pilot.
Windows Update source policy does not configure Office Click-to-Run.
Selecting Office in Artica only gates delivery of approved registered files.
Do not set Office UpdatePath or UpdateUrl to this listener as if it were a complete Office repository.
Microsoft 365 Apps has its own update process and repository structure, described in Microsoft: Microsoft 365 Apps update process.