Group Policy SearchGroup Policy Search
English

Update security level: registry value UpdateSecurityLevelComputerHKLM\Software\Policies\Microsoft\Windows NT\DNSClient

Policy ID
DNS_UpdateSecurityLevel
Scope
Computer Configuration
Supported on
At least Windows Server 2003 operating systems or Windows XP Professional
Source
Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category
Network › DNS Client

Registry

UpdateSecurityLevel

REG_DWORDComputer
HKLM\Software\Policies\Microsoft\Windows NT\DNSClient Current key
Enabled value
Depends on the option value
Element
Update security level:
Options
ItemStored value
Only secure256
Only unsecure16
Unsecure followed by secure0
Apply with .reg · CMD · PowerShell
.reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient]

; Options (use only one)
; Only secure
"UpdateSecurityLevel"=dword:00000100
; Only unsecure
"UpdateSecurityLevel"=dword:00000010
; Unsecure followed by secure
"UpdateSecurityLevel"=dword:00000000
CMD
:: Options (use only one)

:: Only secure
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "UpdateSecurityLevel" /t REG_DWORD /d 256 /f
:: Only unsecure
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "UpdateSecurityLevel" /t REG_DWORD /d 16 /f
:: Unsecure followed by secure
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "UpdateSecurityLevel" /t REG_DWORD /d 0 /f
PowerShell
# Common: create the key
New-Item -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Force | Out-Null

# Options (use only one)
# Only secure
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'UpdateSecurityLevel' -PropertyType DWord -Value 256 -Force | Out-Null
# Only unsecure
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'UpdateSecurityLevel' -PropertyType DWord -Value 16 -Force | Out-Null
# Unsecure followed by secure
New-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'UpdateSecurityLevel' -PropertyType DWord -Value 0 -Force | Out-Null