If there’s one thing we can say for certain about Zoom’s “Auto Update” feature on Windows is that it’s not an auto-update. The user must interact with the update process; there is no service running in the background keeping the software up-to-date. However, with options added to recent versions, it’s getting closer. What follows is an explanation of what is there now.
EXE vs MSI
The first thing we need to understand is that the behaviors around Zoom’s Auto Update are different depending on whether the software was installed with the interactive EXE installer or the administrative MSI installer:
- The EXE installer assumes that the person installing the software is the user and will install the software into the user’s \AppData\Roaming\ profile directory, available only to the user and able to be updated by the user, whether they are an Administrator or not. This installation will also, by default, check the version of the software when it is run and alert the user when a newer version is available.
- The MSI installer assumes that the software is being installed administratively by the user’s IT Support Group and that it will be updated by them. By default, the user cannot update the software themselves unless they are an Administrator on the computer and the installation will not perform any version checking on its own. The user will also not be able to use “Check for Updates” via the Zoom application itself.
Unless you (as IT Support) are walking around from machine to machine, manually installing the software with your users using the EXE (unlikely), or your users are expected to download, install, and manage the software themselves (also unlikely), you’re likely using the MSI to install Zoom. In this case, there’s more to do and understand…
Three Settings in Two Places
There are two primary ways to manage the Zoom client’s configuration: via Software registry keys and Policy registry keys. Software registry keys are usually set at the time of installation by MSI switches and are generally wiped and reset every time the software is installed. Policy registry keys are usually set by Group Policy Objects in Active Directory and persist from installation to installation. Either of these sets of keys can also be set directly.
For configuring Zoom’s “Auto” Update on Windows, there are three settings we need to look at:
- EnableClientAutoUpdate: Enable updates through the client by users. When disabled, the Check for Updates button is also hidden.
- EnableSilentAutoUpdate: Allows the desktop client to silently check for updates and install the latest stable version. This option requires AutoUpdate option to be enabled, and will fail if not enabled.
- AlwaysCheckLatestVersion: Allows the desktop client to check for updates and install the latest available version. This option requires AutoUpdate option to be enabled, and will fail if not enabled.
Via MSI/Software Keys (Okay)
To enable these three settings via MSI switches, you would install the software using (at least) the following command:
msiexec /package ZoomInstallerFull.msi ZoomAutoUpdate="true" EnableSilentAutoUpdate="true" AlwaysCheckLatestVersion="true"
It is important to note that, in order to maintain these settings when upgrading via MSI, you must continue to use these settings every time. Installing a newer MSI over an older installation without these setting will wipe out the old values and default to disabling all three of these settings. The same will be true if you directly set the necessary registry keys after installing the software: an unmodified MSI installation will wipe out the settings, defaulting them back to disabled.
Needless to say, this method is not the best…it requires that everything be done the same way every time and is easily broken. Thankfully, there is a better way!
Via GPO/Policy Keys (Better)
To enable these three settings via GPO, you’ll need to load the “ZoomMeetings_HKLM.adm” Administrative Template into the Group Policy Management Editor and then, under Computer Configuration\Policies\Administrative Templates\Classic Administrative Templates\Zoom Meetings\Zoom General Settings, enable the following settings:
- Enable client to auto update
- Enable client to auto update silently
- Enable client to check the latest version instead of the stable version
(Note: That last setting’s name is the worst. thing. ever. The documentation makes no mention of a “stable version”, but we believe the “stable version” is what is required by Duke-wide tenant policy versus the latest available version. The latest available version is in no way “unstable”.)
If you do not wish to (or cannot, for whatever reason) use Group Policy for this, the Policy registry keys can also be set directly:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Zoom\Zoom Meetings\General] "EnableClientAutoUpdate"=dword:00000001 "EnableSilentAutoUpdate"=dword:00000001 "AlwaysCheckLatestVersion"=dword:00000001
When set by either GPO or directly, these Policy key settings will persist from installation to installation, and should override any settings set via MSI switches or Software keys.
Or, Let Us Help! (Best!)
The Zoom installers managed by OIT Device Engineering in both Microsoft Configuration Manager and HCL BigFix already contain the necessary MSI switches to set these values. In addition, the Policy keys can already be set using an OITDE-managed GPO or BigFix Fixlet.
Installers: Look for the “DU – Global – Zoom” under “Approved” Applications in ConfigMgr OR the latest “DUKE Zoom #.#.#### Available” Fixlet in BigFix.
Policy: Look for the “DU-GLOBAL_Enable_Zoom_”Auto”_Update” GPO to link to your OU in Active Directory OR use the “Set Zoom for Windows to Auto Update” Fixlet in BigFix.
We recommend setting the Policy registry keys via GPO or BigFix action in addition to whatever mechanism you use to deploy the Zoom software.
(Note: If you’ve set the Policy registry keys using the “Set Zoom for Windows to Auto Update” Fixlet in BigFix before September 21, 2021, you’ll want to re-deploy the action to set the recently added “AlwaysCheckLatestVersion” setting.)
As always, if you have any questions or concerns about any of this (or anything else, really), you can reach out to OIT Device Engineering via email (oitde@duke.edu) or ServiceNow (Device Engineering – OIT) or discuss it with the Endpoint community via email (endpoints@duke.edu, membership required) or Teams (All University IT > Endpoints).
Enjoy!
Reference documents:
Zoom: Mass deployment with preconfigured settings for Windows
Zoom: Group Policy Options for the Windows desktop client and Zoom Rooms
