The Microsoft Malicious Software Removal Tool, usually known as MRT, is often delivered automatically through Windows Update, Microsoft Update, or WSUS. In some environments, this behavior is not desired because administrators want to control exactly when the tool is installed, or because update management should remain as predictable as possible.
If MRT should still be available as a manual download but must not be offered through the regular update channels, this can be controlled with a registry policy setting.
The solution
Microsoft provides a policy value that prevents MRT from being offered through Windows Update. By setting this registry key, the tool can still be downloaded and installed manually, but it will no longer be distributed through Microsoft Update or WSUS.
Use the following registry configuration:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontOfferThroughWUAU"=dword:00000001How it works
The registry value DontOfferThroughWUAU tells Windows not to offer MRT through the Windows Update Agent. This means the update will not appear as part of the normal update process in Microsoft Update or WSUS.
That can be useful in managed environments where update approvals need to stay under tight control. It also helps avoid unexpected changes during maintenance windows, especially when update content is meant to remain consistent across multiple systems.
Important note
This setting does not block MRT entirely. The tool can still be installed manually if needed, so administrators retain the option to run it when they want to. The change only prevents automatic delivery through the update infrastructure.
That distinction is important, because it allows better control without removing the possibility of using MRT later for troubleshooting or cleanup.
Summary
If MRT should not be installed automatically during Windows Update, the registry policy above is the correct way to suppress it. This keeps the tool available for manual use while preventing it from being pushed through Microsoft Update or WSUS.