Turn off the Upgrade to the latest version of Windows GPO
June 11, 2015 8 Comments
I was continuing the reinstall of my lab today, and noticed a new setting in the policy template.
I was surprised to see this to say the least. Of course no doubt you will have read plenty of things about controlling the little Windows 10 flag in the system tray, but i had read, that if a machine was domain joined it would not show up at all. The wording on this policy setting however seems to be a little ambiguous to say the least.
“If you disable or do not configure this setting, Windows Update might offer an upgrade to the latest version of Windows”
Might? What do you mean might?
It was a useful find though as i had been speaking to some other folks about how to make sure this was disabled using a GPO. Whilst i am excited for the release of Windows 10, i don’t think i want to be one of the first over the top.
I was curious how this setting arrived with little fanfare, or none that id seen anyway so i dug a little deeper.
Looking at the Policy Definitions folder i found the WindowsUpdate.adml file and noticed it had modified recently, although the time stamps are a little odd (possibly due to the system install date)
Comparing it to the same file on an identical, but not as up to date Server, confirms the files are indeed different as half of me was thinking i had just missed this setting before.
Looking at the Windows Update history on my Server, i narrowed down the update that applied this change to KB3050265, and visiting the KB Page confirms the files that are changed with this update include the WU Policy. See below Comment from Tony re KB Number for 2012 R2.
So if you are keen to ensure your users do not get this message, this might be the policy for you.
You can find the Setting in your GPO Editor under:
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update
What if your users are not in a domain, and you have no GPO control?
Third Tier have a blog post for you too.