Microsoft expands Get Windows 10 program to domains, publishes opt-out instructions

[MrKJLS]

f you thought Microsoft was getting ready to ease up on its massive Get Windows 10 upgrade campaign, think again.

The company announced today that it plans to expand the program, pushing the aggressive GWX taskbar icon and pop-up upgrade notification reminders to some domain-joined PCs that had previously been exempt.

 

Today's news did not include any plans to offer a "No, thanks" button on the GWX prompts. However, the company has finally updated its documentation for IT pros to opt out of the automatic upgrade and disable the GWX icon.

As before, PCs running Windows 7 Enterprise, Windows 8.1 Enterprise, and any embedded version of those operating systems aren't eligible for the free upgrade and thus will continue to be immune from the GWX update.

But domain-joined PCs running Windows 7 Professional, Windows 7 Ultimate, or Windows 8.1 Pro that are configured to receive updates directly from Windows Update will begin seeing the GWX taskbar icon shortly. Domain-joined PCs that get updates through another mechanism, such as Windows Server Update Services or System Center Configuration Manager, will continue to be off-limits.

At the same time as today's announcement, Microsoft finally published updated instructions for opting out of the automatic upgrade and disabling the GWX icon. The new instructions, available in KB article 3080351, match those I published last week. (See "How to block Windows 10 upgrades on your business network (and at home, too)" for details.)

To prevent the Windows 10 upgrade from being offered in Windows Update, IT pros can set a Group Policy object. Note that this policy setting is only available if the appropriate updates (first issued last July) are installed: 3065987 is the Windows 7 update; 3065988 is the equivalent for Windows 8.1.

The policy is available on Windows 7 Professional and Ultimate and Windows 8.1 Pro machines using the Local Group Policy Editor (Gpedit.msc).

 

The policy path is Computer Configuration > Administrative Templates > Windows Components > Windows Update Policy.

Enable the setting Turn off the upgrade to the latest version of Windows through Windows Update.

Setting that policy adds the following registry subkey and associated value:

• Subkey: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
  
• DWORD value: DisableOSUpgrade = 1
  

On home and core editions of Windows 7 and Windows 8.1, that registry value needs to be set manually.

There's no corresponding Group Policy object for disabling the GWX notification icon. That task requires requires editing the following subkey and value in the Windows registry:

• Subkey: HKLM\Software\Policies\Microsoft\Windows\Gwx
  
• DWORD value: DisableGwx = 1
  

Those two steps are sufficient to block Windows 10 upgrades and prevent a user from accidentally clicking on one of the pop-up prompts and starting the upgrade process. There's no need to uninstall and block the original GWX update (KB3035583), nor is it necessary to use third-party software. These software policies, which are intended for business use, remain in effect until they're reversed or removed.

I've created .reg files that can be downloaded and used to automate the creation of these two registry keys. The files are located here.

Today's revised KB article also contains instructions for blocking the Windows 10 upgrade screen that appears when performing a clean install of Windows 8.1 that includes theKB3065988 update. Those instructions are useful for IT pros and system builders who are setting up new PCs for employees or clients and want to ensure that the system is not upgraded to Windows 10.

The article also contains instructions for making the GWX icon visible for businesses that want to take advantage of the free upgrade offer immediately via Windows Update.

 

Source: Microsoft expands Get Windows 10 program to domains, publishes opt-out instructions | ZDNet

[linkazoid]

So what's the best way of applying this as it's not available in Group Policy?

[Steve21]

What OS? There's a new GPO available to do it for them but needs update first

 

Steve

[linkazoid]

From the instructions above it seems that this is a local GPO only..

 

We're using Windows 7 and Server 2012 for the DC's.

[rpycroft]

"The policy path is Computer Configuration > Administrative Templates > Windows Components > Windows Update Policy.

Enable the setting Turn off the upgrade to the latest version of Windows through Windows Update."

 

(May only be available on Windows Server 2016 TP4 or Windows 10 Group Policy)

 

Cheers

[Steve21]

Reg key via GPO, and then local GPO is applied/installed via update

 

Steve

[rpycroft]

I've just enabled it by opening Group Policy Management from RSAT on my Windows 8.1 PC and creating a new policy top level to enable the option. Couldn't find the option on any of the group policy servers. Mustn't have the right update installed.

 

https://support.microsoft.com/en-us/kb/3080351

[FN-GM]

So what's the best way of applying this as it's not available in Group Policy?

 

You will need to update the central store with the new ADMX files.

[googlemad]

Great stuff Microsoft. Cheers for that

 

We've already had several laptops returned to us (non domain connected) to find rather than the Windows 7 they departed with they have magically appeared back with Windows 10!

[LeMarchand]

Hmmm... My server has the KB, but not the policy. Grrr.

[sparkeh]

From Making it Easier for Small Businesses to Upgrade to Windows 10 - Windows for IT Pros - Site Home - TechNet Blogs

We will begin to roll out the “Get Windows 10” app to additional devices that meet the following criteria, in the US later this month and in additional markets shortly thereafter:

• Running and licensed for Windows 7 Pro or Windows 8.1 Pro
  
• Configured to receive updates directly from the Windows Update service (i.e. updates are not managed by WSUS or System Center Configuration Manager on those devices)
  
• Joined to an Active Directory domain
  

 

...

 

Large corporations running Windows Enterprise edition or using onsite updating tools. The “Get Windows 10” app will not be introduced to PCs in large corporations who run Enterprise edition or who prefer to manage their own updates with onsite tools (including WSUS or System Center Configuration Manager.)

So if we are running WSUS or SCCM then this does't apply to us.

Edited January 15, 2016 by sparkeh

[Michael]

I can't see why (for a school) why you wouldn't have WSUS setup in some fashion anyway. This is the easiest solution to this problem.

[LeMarchand]

So if we are running WSUS or SCCM then this does't apply to us.

 

I can't see why (for a school) why you wouldn't have WSUS setup in some fashion anyway. This is the easiest solution to this problem.

What if someone decides to search for updates from MS, does the fact that WSUS is set as the primary source prevent the W10 update nag appearing?

[Michael]

What if someone decides to search for updates from MS, does the fact that WSUS is set as the primary source prevent the W10 update nag appearing?

 

Yes as the Primary source is the WSUS server.

 

With regards to the Secondary source (Microsoft Update), you can easily lock users out of it, if you don't want them running it. This encourages them to return the device back to base for other updates too - whatever that may be, such as an MSI deployment.

[sparkeh]

Yes as the Primary source is the WSUS server.

 

With regards to the Secondary source (Microsoft Update), you can easily lock users out of it, if you don't want them running it. This encourages them to return the device back to base for other updates too - whatever that may be, such as an MSI deployment.

I would say its a good idea to disable users being able get updates directly from MS anyway as there are times when you really want to stop an update getting on a machine (recent outlook updates for example).

[LeMarchand]

I would say its a good idea to disable users being able get updates directly from MS anyway as there are times when you really want to stop an update getting on a machine (recent outlook updates for example).

 

I tend to agree, but do find it useful to be able to check with MS as there are often updates that WSUS isn't offering due to my choices.

[MrPstv]

Please enlighten me with regards to automatic updates?