This policy setting allows you to configure the level of user control for the Windows Update for Windows Mobile service. ...

This policy setting allows you to configure the level of user control for the Windows Update for Windows Mobile service. The setting  allows you to completely turn off the update service, leave it to be configured by the device user, or configure it to be turned on with predefined settings that can not be changed by the device user.  If you enable this policy setting, then you can select from the following options: "Switch Off" - The update service is turned off for the device. The user cannot change the configuration. "Switch On for User Config" – The update service is turned on for the device. The user can change the settings. Note that this option is identical to the behavior of the update service when it is turned on in an unmanaged device. "Switch On for Admin Lockdown" - The update service is turned on for the device and configured to work in automatic mode with cell data connectivity enabled. The user cannot change this configuration. This option puts the update service in automatic mode so that critical security updates are automatically downloaded over any network connection, except when cellular roaming. The user is prompted to install any updates that are downloaded automatically.  If you do not configure this policy setting, then whether the update service is turned on for the device depends on the configuration choice made by the OEM when the device was manufactured.  If you disable this policy setting, then it is the same as enabling the policy and selecting the "Switch On for User Config" option.