Prevent Windows 10 version update

[simpsonj]

Does anyone know how to stop Windows 10 from auto-upgrading to the latest version?

 

We've hit a snag with the latest Creators update in that it is stopping the ScoMIS connector working with a security error. We're having to manually copy the old Remote desktop files on each machine as it updates (ala this kb article) which is less than ideal...

 

We've got a group policy in place to 'Turn off the upgrade to the latest version of Windows through Windows Update' but this seems to only stop Windows 7/8 from upgrading to 10. Our WSUS doesn't download or install the Creators update, but as soon as staff take their laptops home, Windows update grabs the Creators update and installs...

 

Any help gratefully received!

[ColinP]

i dont know if you can do this via a policy, but you can do it manualy by setting there home wireless network as a metered connection then windows wont down load any updates at home.

[Fazza]

i dont know if you can do this via a policy, but you can do it manualy by setting there home wireless network as a metered connection then windows wont down load any updates at home.

 

We use this Group Policy:

 

 

Computer Configuration > Policies > Administrative Templates > Windows Components > Store

[simpsonj]

We use this Group Policy:

 

[ATTACH=CONFIG]46054[/ATTACH]

 

Computer Configuration > Policies > Administrative Templates > Windows Components > Store

 

Thanks @Fazza put the GP in place, see if it stops the updates.

[ITGURU]

Can this be done for WSUS rather than having to decline the latest version?

[Fazza]

Thanks @Fazza put the GP in place, see if it stops the updates.

 

Not seen it coming up on any PCs since! It seems to work on Windows 8 and 10 machines so no annoying/nagging upgrade messages!

[Michael]

There are five core policies that need to be enabled -

 

Computer Config > Admin Templates > Windows Components > Store - Turn off offer to update to the latest version of Windows

 

Computer Config > Admin Templates > Windows Components > Windows Update - Configure Automatic Updates

 

Computer Config > Admin Templates > Windows Components > Windows Update - Specify intranet Microsoft Update service location

 

Computer Config > Admin Templates > Windows Components > Windows Update - Do not connect to any Windows Update Internet locations

 

Computer Config > Admin Templates > Windows Components > Windows Update > Defer Windows Updates - Select when Feature Updates are received, select CBB

 

These in my experience work (after trial and error), giving you some degree of control back.

[JATSO]

Thanks @Fazza put the GP in place, see if it stops the updates.

 

Unable able to find that here.

Running Windows 10Edu 1703.

 

Any ideas?

 

[Michael]

Unable able to find that here.

Running Windows 10Edu 1703.

 

Any ideas?

 

[ATTACH=CONFIG]46056[/ATTACH]

 

Do you have any GPO filters applied?

[JATSO]

No none at all.

[Michael]

I'd suggest re-copying over a new GPO store, as I can't think of any reason why Store should be missing.

[Fazza]

Unable able to find that here.

Running Windows 10Edu 1703.

 

Any ideas?

 

[ATTACH=CONFIG]46056[/ATTACH]

 

Are you using the latest Group Policy files - have you download/installed the 1703 (or now 1709) .ADMX files?

[Michael]

Have to say though, the only frustrating part of enabling "Do not connect to any Windows Update Internet locations", is that it also blocks connections to Microsoft Update in regards to Device Manager.

 

Not sure there's a solution to this, other than moving machines in and out of GPOs, in the event I cannot track a driver?

[snagrat]

Have to say though, the only frustrating part of enabling "Do not connect to any Windows Update Internet locations", is that it also blocks connections to Microsoft Update in regards to Device Manager.

 

Not sure there's a solution to this, other than moving machines in and out of GPOs, in the event I cannot track a driver?

 

Probably a quick reg edit you can switch temporarily to sort this. Upon reboot it’ll switch back

[Michael]

It's a bit daft though isn't it? I want to restrict Feature/Quality updates accordingly, but allow the device to install drivers from Microsoft Update. Not entirely sure it's possible?

[Arthur]

It's a bit daft though isn't it? I want to restrict Feature/Quality updates accordingly, but allow the device to install drivers from Microsoft Update. Not entirely sure it's possible?

Isn't that what the following GPO is for?

 

Select when Preview Builds and Feature Updates are received

 

Computer Configuration \ Administrative Templates \ Windows Components \ Windows Update \ Defer Windows Updates

 

Enable this policy to specify the level of Preview Build or Feature Updates to receive, and when.

 

• Preview Build - Fast: Devices set to this level will be the first to receive new builds of Windows with features not yet available to the general public. Select Fast to participate in identifying and reporting issues to Microsoft, and provide suggestions on new functionality.
  
• Preview Build - Slow: Devices set to this level receive new builds of Windows before they are available to the general public, but at a slower cadence than those set to Fast, and with changes and fixes identified in earlier builds.
  
• Release Preview: Receive builds of Windows just before Microsoft releases them to the general public.
  
• Semi-Annual Channel (Targeted): Receive feature Updates when they are released to the general public.
  
• Semi-Annual Channel: Feature Updates will arrive when they are declared Semi-Annual Channel. This usually occurs about 4 months after Semi-Annual Channel (Targeted), indicating that Microsoft, Independent Software Vendors (ISVs), partners and customer believe that the release is ready for broad deployment.
  

When selecting a Preview Build:

• You can Defer receiving Preview Builds for up to 14 days.
  
• To prevent Preview Builds from being received on their scheduled time, you can temporarily pause them. The pause will remain in effect for 35 days from the start time provided.
  
• To resume receiving Feature Updates which are paused, clear the start date field.
  

Preview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see: https://aka.ms/wipforbiz

 

When Selecting Current Branch or Current Branch for Business:

• You can Defer receiving Feature Updates for up to 365 days.
  
• To prevent Feature Updates from being received on their scheduled time, you can temporarily pause them. The pause will remain in effect for 35 days from the start time provided.
  
• To resume receiving Feature Updates which are paused, clear the start date field.
  

To configure Feature Updates you must have a telemetry level setting of 1 or higher.

 

If you disable or do not configure this policy, Windows Update will not alter its behavior.

[Michael]

I'll have to test some more, but without "Do not connect to any Windows Update Internet locations", Windows 10 still checks with MU, despite a WSUS intranet update location being specified. The GPO description also matches what I've concluded -

 

"Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Windows Store."

 

I also have Feature Updates set to CBB, with 180 day period set. Quality Updates left at 'Not Configured'. Not entirely sure why Microsoft have made this simple process complicated.

 

In some scenarios, without the "Do not connect to any Windows Update Internet locations" policy set, we've also seen Sysprep magically request we download the latest Feature Upgrade and appears to ignore other policies set. The computer object is in the right location, as specified in the answer file. Enabling "Do not connect to any Windows Update Internet locations" solves this issue, but is now restricting access to Device Manager driver upgrades.

 

Is it then perfectly possible to have full control of Feature/Quality Updates, with full access to driver updates (which I have little/no issue with)? Just can't see a way around it.

[free780]

https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/

 

If you have certain WUfB policies configured it can trigger the WUAgent to retrieve 1709 even if you are using WSUS.

[RLR]

Does anyone know how to stop Windows 10 from auto-upgrading to the latest version?

 

We've hit a snag with the latest Creators update in that it is stopping the ScoMIS connector working with a security error. We're having to manually copy the old Remote desktop files on each machine as it updates (ala this kb article) which is less than ideal...

 

We've got a group policy in place to 'Turn off the upgrade to the latest version of Windows through Windows Update' but this seems to only stop Windows 7/8 from upgrading to 10. Our WSUS doesn't download or install the Creators update, but as soon as staff take their laptops home, Windows update grabs the Creators update and installs...

 

Any help gratefully received!

 

We have this issue with Scomis also. I spoke to them yesterday and they are doing some updates that should resolve this issue by this afternoon. The fix I found worked was the reg edit:

 

reg.exe Add "HKCU\Software\Microsoft\Terminal Server Client" /V "RDGClientTransport" /T REG_DWORD /D "1"

 

Copying files from one machine to another didn't work for us but this regedit does.

 

Edit: Here's the email I got yesterday from Scomis:

 

Your outstanding request with the Scomis Service Desk (Call reference F0294070) : Error logging into SIMS has now been resolved. An overview of the action taken to resolve this query is below :-

 

Called College and spoke to user,

 

I made user aware of the update we are running after lunch tomorrow which will allow all Windows 10 users to work with any security package errors.

Edited November 7, 2017 by RLR

[Michael]

https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/

 

If you have certain WUfB policies configured it can trigger the WUAgent to retrieve 1709 even if you are using WSUS.

 

Not entirely sure how the "Turn off access to all Windows Update features" is any different from "Do not connect to any Windows Update Internet locations" - pretty much the same thing and both disable driver updates too.

 

There doesn't appear to be a way of only using WU/MU for driver only updates it seems; all or nothing!

[mavhc]

Not entirely sure how the "Turn off access to all Windows Update features" is any different from "Do not connect to any Windows Update Internet locations" - pretty much the same thing and both disable driver updates too.

 

There doesn't appear to be a way of only using WU/MU for driver only updates it seems; all or nothing!

 

Turn off access to all Windows Update features removes the Check For Updates button I think.

 

Do not connect to any Windows Update Internet locations is the new thing, for hybrid updates etc

 

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store.

 

When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working.

 

This policy applies only when the device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.

[Michael]

Just to contribute further to this; if you're using LTSB, you can set - Do not connect to any Windows Update Internet locations, to 'Not Configured' as of course LTSB will only receive Quality updates.

 

For other versions, using the following reg hack works -

 

Enable -

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DoNotConnectToWindowsUpdateInternetLocations"=dword:00000000

 

Disable -

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DoNotConnectToWindowsUpdateInternetLocations"=dword:00000001

 

You can also (where appropriate), import driver updates via the Microsoft Update Catalog into WSUS, then approve them as normal.

[Arthur]

Does anyone know how to stop Windows 10 from auto-upgrading to the latest version?

Apparently disabling the "Microsoft Compatibility Appraiser" scheduled task will also prevent new versions of Windows 10 from downloading. This means you shouldn't need to use any of the hacks above.

 

https://support.microsoft.com/en-us/help/4163525/high-bandwidth-use-when-clients-scan-for-updates-from-local-wsus-serve

 

Alternatively, you can choose to disable the task. To do this, go to Task Scheduler > Task Scheduler Library > Microsoft Windows > Application Experience and disable the task Microsoft Compatibility Appraiser. Or, you can run the following command as an administrator:

 

[b]schtasks.exe /CHANGE /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /DISABLE[/b]

 

Note. Disabling the task prevents Upgrade Analytics from having access to all OS and driver telemetry data and prevents new versions of Windows from being offered automatically.

 

Credit. https://twitter.com/bdam555/status/989867073831624704

Edited April 27, 2018 by Arthur

[Duke5A]

Seems like a lot of hoops to jump through to regain control that we had with previous Windows revisions. I don't even want to think about the support calls that forced revision updates would generate in my district.

 

We're still chugging along merrily with 1607 LTSB. Runs fine on the limited quantity of new hardware we're getting too (8th gen core stuff). We never got in with Office 365 or Microsoft accounts, so having no store access wasn't a loss. Haven't had anyone miss Edge yet either.

 

[ICT_GUY]

I have assumed that declining the update in our WSUS will forestall the 1803 "upgrade".