|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
ISSUE 22.05.1 • 2025-02-06 By Susan Bradley If your machine is eligible for Windows 11 — meaning it ticks all the boxes for hardware compatibility — W
[See the full post at: MS-DEFCON 1: Controlling features — 24H2 pushed hard]
Susan Bradley Patch Lady/Prudent patcher
Maybe I’m a bit slow on the uptake but its not clear to me if this warning is relevant to Windows 10 systems that meet the hardware requirements for Windows 11. The alert says “Set your phaser on stun; use InControl to hold your location in the galaxy to Windows 11 23H2.”
It also speaks to the use of InControl. What about those of us on Windows 10 that have used group policy to control Feature Updates? Are we safe?
I sure would appreciate a bit of clarification.
My understanding is that if your computer is eligible for Win 11 that you will be offered Win 11 24H2 even if you are currently running Win 10. Also using Group Policy to control feature updates and keep a current version at, for example, Win10 22H2, or Win11 23H2, should keep Win 11 24H2 from downloading and installing. The Group Policy method should work if you are currently running either Win 10 OR Win 11.
That’s my take, but I too would like a confirmation from one of the experts here.
Win10 22H2 or Win11 23H2?
Yes, the GP settings will hold for Win10 and Win11. The Group Policy settings work for both – set TRV and Product version to the ones you want to keep.
But InControl is easier an easier way to avoid Win11 24H2.
if this warning is relevant to Windows 10 systems that meet the hardware requirements for Windows 11.
It is relevant to Windows 10 too.
* February updates will install outlook new on Windows 10.
Maybe I’m a bit slow on the uptake but its not clear to me if this warning is relevant to Windows 10 systems that meet the hardware requirements for Windows 11. The alert says “Set your phaser on stun; use InControl to hold your location in the galaxy to Windows 11 23H2.”
It also speaks to the use of InControl. What about those of us on Windows 10 that have used group policy to control Feature Updates? Are we safe?
I sure would appreciate a bit of clarification.
I just arrived here (before coffee) to ask the EXACT same question!!
And based on that email, downloaded InControl to get this. So let me add, if I am blocked in Group Policy, do I need this as well? And if so, IF I ever choose to release, do I do group policy change or InControl? In other words – or in additon – how do they interract?
Let me add this from the email:
“For right now, the only way to prevent this is to adjust Registry keys accordingly, and the simplest, fastest way to do so is with InControl.”
That says that Group Policy might NOT be an answer. Is that correct?? Or is that saying that Group Policy is one way to enter the registry keys?
I wish the email had been a bit more complete and clear.
Lets keep this thread about controlling the update to Windows 11 24H2!!
There are other threads available for discussions of blocking the new Outlook.
It happened to me. I woke up one morning to find that my desktop PC was updated to Windows 11 24H2. I always push off updates for 5 weeks after any updates that I allow. I guess I forgot to check and it was pushed on to my machine. Still, the machine seemed to be running just fine so I left it.
I decided to see about my laptop. Windows 11 24H2 wasn’t pushed to it. I think it was because I had Ubisoft games on it. Me being me I decided to download the windows update manual program and, after uninstalling the Ubisoft games, I pushed the Windows 11 24H2 update to my laptop to keep it in sync with my desktop. It installed without problems and i went on my merry way.
Not so fast….. Within a day I saw an issue. On my laptop I have software that scans my network for WiFi sources. It would not work. Scanning my network was a no go. I did the Google thing and saw that this was an issue with Windows 11 24H2. Sigh….
So for once Microscoff’s process to rollback the update worked. I did the “Go Back” thing and both machines are back to Windows 11 23H2.
I used inControl and my desktop and laptop both are now blocking Windows 11 24H2.
On February 1st I installed Cumulative January 2025 KB5049981 on my Windows 10 Pro 22H2 system, and was not happy after that:
My Microsoft (Wireless) Multimedia Keyboard did not work anymore. I tried changing the driver, reinstalled the software etc. but nothing helped. Ended up restoring my latest backup, but to my surprise that didn’t solve the problem either! Had to restore an end-of-December backup to get everything to work again.
(KB5049613 .NET 3.5 and 4.8 for Windows 10 22H2 x64 installed without problems.)
Although I haven’t seen anyone having similar problems here on Woody’s, I don’t seem to be only one encountering usb-related troubles when I search online. Most speak of audio usb-related problems, but appearantly my not-current keyboard is based on the same ancient Digital to Analog Converter.
KB5050081 is supposed to rectify these usb-problems, but it often fails to install. Many say that it does indeed fix these problems however.
But just to be sure, I will wait for February’s cumulative update to address all the above.
I’d just like to comment that if the article had said something to the effect that this does or does not affect Windows 10 users as well and if you control updates through Group Policy you do or do not require InControl for additonal or increased protection – then I could have slept in 🙂
Seems to me these are the points of confusion. At least for a few of us.
If you’re on Win11: You will eventually be forced onto 24H2
If you’re on Win10: You will be offered the upgrade to Win11 24H2. The key wording is ‘offered’. There should be the option to select ‘stay on Windows 10’ . I speak from experience as I’ve had this happen to be twice now.
If you’re on Windows 10 and not running InControl, I’d recommend checking the updates screen once a day if updates are not paused. A couple days ago I saw Win11 being offered yet again after I already declined, and had to decline again.
If I didn’t decline after a certain period of time … like say overnight … I’m not sure if it would have eventually just decided to update
^^^ What he said. Windows 10 isn’t getting quite the shove down the stairs, but you don’t get that much of a warning.
If you don’t want Windows 11 24H2 on either 11 on 23H2 OR 10’s that CAN support Windows 11, you want to use incontrol.
Susan Bradley Patch Lady/Prudent patcher
My computer is running Windows 10 22H2. I have inControl set to limit version upgrades to 11 23H2. Will Windows 11 23H2 be offered by Windows Update eventually or is 24H2 the only version Microsoft is offering?
If you’re on Win11: You will eventually be forced onto 24H2
If you’re on Win10: You will be offered the upgrade to Win11 24H2. The key wording is ‘offered’. There should be the option to select ‘stay on Windows 10’ . I speak from experience as I’ve had this happen to be twice now.
If you’re on Windows 10 and not running InControl, I’d recommend checking the updates screen once a day if updates are not paused. A couple days ago I saw Win11 being offered yet again after I already declined, and had to decline again.
If I didn’t decline after a certain period of time … like say overnight … I’m not sure if it would have eventually just decided to update
Much of this may not be true as it does not consider alternate methods of blocking updates. I would not take this for fact. Too many variables and options.
Awaiting Susan to clarify the email on GP, Win Show-Hide, InControl, Registry keys, etc.
Is it possible to determine if Win11 24H2 has been downloaded but not installed? If so, can we easily delete it?
Group Policy is available in Windows PRO, not home and allows administrators to set “policy” for things on user’s computers. Most often used in enterprises to allow or deny numerous things on many computers. Long ago I learned here at AskWoody what to change to prevent, or delay updates for those things offered.
It changes registry keys when set, a lot like InControl. But I am waiting to find out what the other 3 keys are InControl changes not changed by my changes in Group Policy.
Search Group Policy here and I anm sure you will find better explanations and informative threads.
What six Registry keys?
InControl creates and manages the following six Registry keys. As noted above, they must exist and have the proper values for InControl to indicate that the user is in control:
When the user clicks “Release Control” all six of these optional key names & values are deleted from the Registry and Windows Update will return to its normal operation.
For those of you on Win10 OR on Win11, the safest way to stay where you are is InControL. Download Incontrol and place it on your desktop (it doesn’t install, it works from there).
Set the version of Windows, 10 or 11, you want to keep.
Set the Release you want, 22H2 for Win10 or 23H2 for Win11.
Click “Take control”
This will keep you from getting Win11 24H2 no matter what your current OS.
For those of you on Win10 OR on Win11, the safest way to stay where you are is InControL. Download Incontrol and place it on your desktop (it doesn’t install, it works from there).
Set the version of Windows, 10 or 11, you want to keep.
Set the Release you want, 22H2 for Win10 or 23H2 for Win11.
Click “Take control”This will keep you from getting Win11 24H2 no matter what your current OS.
And what if Group Policy is already set???? Is there a conflict? Change GP first? And why is this “the safest”?
There is no conflict between Group Policy and InControl if they are set the same. Both set TRV, but InControl also sets other reg setting as well. That is why InControl is the safest, but MS should respect Group Policy anyway even without InControl.
FYI, I only have Group Policy settings and I have not seen Win11 any Release (offered or downloaded) on my Win10 Pro 22H2 installations and I have not seen Win11 24H2 (offered or downloaded) on my Win11 Pro 23H2 installations. I will go on those settings.
For those on Win Home Editions (10 or 11), who do not have Group Policy, InControl is also the safest way to off Win11 24H2.
The registry keys that InControl tweaks are documented on its site as shown here –
However, the page on which the above information resides has not been updated for 3 years (since Feb. 2022) –
That raises some doubt in my mind about accuracy.
I plan on sticking with the group policy settings that so far have been effective in maintaining my Win10 22H2 configurations unless current, authoritative sources advise that change is necessary.
That raises some doubt in my mind about accuracy.
I can personally verify it does still control those 6 values in the registry (see my posts in the W10 Grp Policy vs InControl thread for details) and, if you’ve already set any of the Group Policies to control feature updates, it’ll display a message like this when you first run it showing how many of them it sees as already set.
I can also personally verify that, when you click Release Control, it will delete all 6 of those values from the registry; regardless of whether they were set using Group Policy or not!
My doubt about accuracy relates to information provided 3 years ago and whether those same requirements are needed today.
InControl only changes its settings when Microsoft changes the relevant Registry Keys and/or Group Policies.
Microsoft has not changed these keys in the past three years, AFAIK.
-- rc primak
If your machine is eligible for Windows 11 — meaning it ticks all the boxes for hardware compatibility — Windows 11 24H2 will download in preparation for installation, with no way to stop it.
If I have TPM capability on my PC but it is not enabled in the BIOS does MS consider my PC eligible or not eligible for Windows 11?
Asked another way, if I have TPM capability on my PC and it IS enabled (which isn’t my situation) can I prevent installation of Windows 11 by disabling TPM in the BIOS?
Open the Security Processor details screen.
WinKey+R, enter explorer windowsdefender://SecurityProcessor and press Enter.
To determine whether the OS does or doesn’t see the TPM.
If it does and your system is eligible for Windows 11, it will get updated unless the update is specifically blocked using one of the other methods mentioned above.
If it doesn’t, your system can’t be updated!
All you do is download the inControl program and run it as instructed here and at the GRC website. It’s very simple, usually a single mouse-click. The program takes care of all the rest. Works in Pro and Home Editions. If you have previously set all or some of the Group Policies and Registry Keys, in Control won’t undo your settings unless you release control. Then everything would be undone.
-- rc primak
The existing GP settings will remain in effect, unless you release control. Releasing control would reverse those settings. Taking control with inControl won’t change anything which is not in conflict with the settings the program would add. InControl doesn’t change any settings other than the ones it is specifically concerned with.
-- rc primak
My Geekom A8 with an AMD Ryzen 7 got 24H2 pushed onto it and then blue screened on boot. Turns out the BIOS and EC needed updating, which I learned from Geekom’s website. Fortunately I had my trusty Win 10 PC (not Win 11 eligible), with which I was able learn this and prepare the USB drives with the needed updates. I also had to reinstall 24H2, and now the Geekom is running OK. Lesson learned: before MSFT forces a major update like 24H2, check your manufacturer’s website for FAQs and updates.
Likely attributed to the AMD issues mentioned in an earlier post #2745672
MSFT should stop and delay the 24H2 rollout on AMD affected CPU’s as it’s obviously creating unecessary grief as not everyone knows about firmware updates required prior to the rollout.
Group Policy is one way to enter the registry keys?
Setting TRV in Group Policy will be enough.
InControl is the easiest way for Home users.
Open the Security Processor details screen. WinKey+R, enter explorer windowsdefender://SecurityProcessor and press Enter. To determine whether the OS does or doesn’t see the TPM.
Looks like I am OK, for now:
But setting “Pause” makes wushowhide worthless.
I am grateful for this information and now have incontrol on all my win 10 computers. Even by microsoft standards this is obnoxious behavior. I plan on using 0patch once microsoft stops supporting windows 10. After that who knows? Mac? Linux?
Well, after doing some more reading I have concluded that for Win10 22H2 Pro where group policy is controlling updates running InControl to add the additional registry entries is not mandatory to avoid Win11 updates. For those who prefer belts and suspenders there’s no harm in running it .
I’m also in the group of Win10 Pro 22H2 users with a PC eligible to update to Win11. I will update that PC before this fall but don’t want to until there’s a version more stable than the current iteration of 24H2, per Susan. So I’m taking her advice and deferring. But I already had feature upgrades blocked in Group Policy. So I had the same question as others here: do I really need to “install” InControl?
Well I checked it out and found that you don’t install InControl, you just download it and click the .exe file, and it changes all settings to block Win11 in a split second, and you’re done with it. When you do want to update, you just again run the downloaded InControl .exe app and this time, click the “Release Control” button in the app, and you should be immediately able to upgrade Windows.
So it’s effective (including for Win10 Home users who can’t edit Group Policy) and much faster than messing with Group Policy or Registry settings. Win win /ba da bum
Click on the “MS-DEFCON System” in the middle of the menubar at the top of the Main Blog page. There is a good description of its meaning.
A word of caution for those who have used Group Policy on Win10 22H2 Pro to control updates and are also using InControl — If you should decide to revert the changes made by InControl by clicking the “Release Control” button it will function as described.
However, the reversion will NOT be reflected in the group policy editor user interface. Don’t be misled by this side effect.
the reversion will NOT be reflected in the group policy editor user interface
Great point on that nuance. I was just about to ask that exact question.
In other words, when “Release Control” is clicked, although the registry entries are deleted, the Group Policy state would NOT be reverted from Enabled to Not configured.
Hope I said that correctly.
the Group Policy state would NOT be reverted from Enabled to Not configured.
That’s right. The group policy editor user interface will appear exactly as it was before. For example, even though the registry key values to control Target Feature Updates were deleted the user interface still looked like this –
Hey Y’all,
I wanted to refresh my understanding of how Group Policy and the Registry interact.
So I fired up Perplexity and asked the question here’s the response:
The Windows Group Policy Editor interfaces with the registry in a one-way manner. When changes are made through the Group Policy Editor, they are reflected in the registry, but changes made directly to the registry are not reflected back in the Group Policy Editor[3][8].
## Group Policy to Registry
When administrators use the Group Policy Editor to configure settings:
1. The changes are stored in
registry.polfiles located inC:\Windows\system32\GroupPolicy[3].
2. These files overwrite the corresponding keys in the registry during group policy refresh events[3].
3. Group policy refresh occurs automatically at regular intervals or can be triggered manually using thegpupdatecommand[3].## Registry to Group Policy
Direct modifications to the registry do not update the Group Policy Editor:
1. The Group Policy Editor does not read from the registry to determine its settings[3][9].
2. It only displays settings based on the local policy files it creates[9].
3. This design allows for the “Not Configured” state in Group Policy, which means the local setting remains untouched by policy[3].## Implications
– Changes made through Group Policy are persistent and will overwrite manual registry modifications during policy refreshes[3].
– Manual registry changes may take effect for the system but won’t be visible or manageable through the Group Policy Editor interface[9].
– This one-way interaction ensures that Group Policy remains the authoritative method for managing system-wide settings in Windows environments.Citations:
[1] https://www.varonis.com/blog/group-policy-editor
[2] https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265982(v=ws.11)
[3] https://superuser.com/questions/1192405/why-gpedit-and-the-corresponding-registry-entries-are-not-synchronized/1192458
[4] https://www.serveracademy.com/courses/group-policy-security-with-windows-server/configuring-registry-settings-with-group-policy/
[5] https://www.howtogeek.com/736545/how-to-open-the-group-policy-editor-on-windows/
[6] https://serverfault.com/questions/1003850/what-is-the-difference-between-group-policy-and-registry-policy-processing-in-wi
[7] https://woshub.com/how-to-create-modify-and-delete-registry-keys-using-gpo/
[8] https://www.techtarget.com/searchwindowsserver/definition/Local-Group-Policy-Editor
[9] https://www.reddit.com/r/sysadmin/comments/svsw8u/win10_if_i_change_local_group_policy_by_modifying/—
Answer from Perplexity: pplx.ai/share
Just FYI…
gpupdate /Target:Computer /Force only updates Computer Group Policies.
gpupdate /Force updates both Computer & User Group Policies.
I always use the second one and included it in the batch file I created that runs every time my PC reboots to reset various personal preferences.
Also note, by default, the /Force option only applies policy settings that have changed.
Just FYI…
gpupdate /Target:Computer /Force only updates Computer Group Policies.
gpupdate /Force updates both Computer & User Group Policies.
I always use the second one and included it in the batch file I created that runs every time my PC reboots to reset various personal preferences.
Also note, by default, the /Force option only applies policy settings that have changed.
Yes, I know. For purposes of my experiment with InControl /Target:Computer was sufficient.
James Bond 007:
What method did you use to block automatic updates in Windows 10 22H2?
I run the Enterprise version of 22H2 on that one computer (that computer also has Windows 10 1809 LTSC and Windows 10 21H2 IoT LTSC in other partitions), I use the Group Policy Editor (gpedit.msc) to disable updates completely :
(1) Open a command prompt or press Windows key + R and then type gpedit.msc to launch the Group Policy Editor (only on Pro / Education / Enterprise versions). I made a shortcut of it as I used it and checked its settings often.
(2) Navigate to “Computer Configuration” > “Administrative Templates” > “Windows Components” > “Windows Update.”
(3) Double-click on “Configure Automatic Updates” to open the settings.
(4) Select the “Disabled” option to turn off automatic updates.
(5) Click on “Apply” and then “OK” to save the changes.
Best to restart the computer after. I have used this method since when Windows 10 was first released (when I tested it inside VMware Workstation and found there was no way to disable the automatic updates in the GUI) and it has never failed on me.
I also use a program called Windows Automatic Updates Manager (WAU Manager) to check and select those updates I want to install, and hide those I don’t want. Works on Windows 10 and Windows 11.
Hope for the best. Prepare for the worst.
GP setting that delayed as much as possible the feature updates, based on the idea that when the update will be forced
With GP nothing is forced. No pause needed.
The simple solution is to set ‘notify=2’. That way you get notifications of new updates with no download/install until you ready.
You can then use WUmgr to hide updates you don’t want to install (drivers, firmware..)
Reading some of these posts border on amusement. Better than saying ‘paranoia,’ but one would think that 24H2 is the woodpecker that will bring down the trees of humanity. I bought a new rig two months ago with 24H2 Pro, and while it is quirky, and the GUI is thoughtlessly throw together and convoluted, I have not experienced the dire consequences heretofore outlined and shouted out for all to hear.
Do I like 24H2? No. I was happy with Win10 (my work machine is still Win10). But I stopped having network issues with 24H2 after one update, the embedded video player ‘freezing’ issue was resolved, and I haven’t (yet) seen a BSOD or a ‘forced reboot’ after doing this or that. In fact, looking at the laundry list of doom and gloom warnings of the impending apocalypse if your machine downloads and installs 24H2, I haven’t experienced a single issue that I would call ‘troubling’ (irritating, yes, but nothing that keeps me awake at night) much less so potentially catastrophic that will signal the end of the world. <g>
History, well-chronicled in the archives of AW, has proven a fact that a vast majority of people …. myself included …. absolutely HATE upgrades to the O/S. I absolutely adored WinXP, and protested vociferously when Win7 was pushed. I cursed Win7, and despised everything it stood for. But when Win10 came out, I continued to pay my Opatch fee so I had security for my Win7 rig after MS stopped issuing updates. But, eventually, I got a new computer (my current work machine with Win10 pro) and grew to accept the changes, deal with the minor quirks, and actually got comfortable with Win10 pro…. the very O/S that I had cursed for almost a year. Now, having been using 24H2 pro for the past few months, I’m still trying to figure out what the big deal is. Yea, I know it’s a brand new O/S. Sure, I’ve seen a handful —- and literally, just a handful — of minor irritants I could list here. But as much as I dislike Microsoft for their shoddy, flowery, new-age attempts to mimic a MAC by dickering with the GUI, I cannot find anything of dire consequence about 24H2 Pro that would cause me to bang my fist on my desk in frustration, much less finding and paying for a way to do a clean install of 22H2. As I (and many others) have found through the years of WFWG 3.11, Win95, Win98, Vista, XP, Win7, Win8.1, Win10, and now, Win11, after a certain amount of time, we stop complaining and grow used to it. A year from now, 24H2 will likely be just a bad memory, and we’ll all be complaining about the next O/S upgrade MS plans to shove down our throats.
So …… if you awake one morning to find your rig has updated to 24H2, I am here to tell you it is not the end of the world, folks. It isn’t worth fretting about or going into a panic. And it certainly isn’t worth taking the time to roll everything back or trying to reinstall 22H2 or any of that other business. Like any new O/S, there will be issues. Always has been that way. But if you do good backups, and have another machine to use in case of a ‘disaster,’ your blood pressure will remain low, and your bottle of chill-pills will remain full.
"War is the remedy our enemies have chosen. And I say let us give them all they want" ----- William T. Sherman
if you do good backups, and have another machine to use
Those who understand computers and are prepared may be fine, but most users will find 24H2 dumped on them without warning, and we know it causes issues so many will be adversely affected. These people will definitely be tearing their hair out.
cheers, Paul
KB5050411
Windows Recovery Environment update. Hardly a required update.
Make an image backup using your favourite backup app instead.
cheers, Paul
Adding to my decision to push MS-DEFCON all the way to level 1 is that the February updates will include several annoyances, including the installation of Outlook (new).
I am Win10/Pro 22H2. I am confused by this news about Outlook (new). I have had Outlook (new) since March, 2024. Why have I had it for nearly a year now, while others are going to get it for the first time with the February patches?
P.S. I know that one poster said “let’s limit the discussion to the push to Win 11 24H2”, but Susan’s alert in the Consumer section is about Outlook (new), too.
Because you opted-in. You were a beta tester…
According to their website, ThinkOrSwim comes in three different versions, Desktop, Mobile and Web only.
Suggest you goto the Web only login site which “should” work just fine using Firefox and your current login combo without needing to change anything.
If it doesn’t work because it doesn’t like your browser, you can use the User-Agent Switcher add-on to trick it into thinking you’re using Windows 11.
To construct the proper useragent string, you first need to find your existing useragent by going to What’s my user agent.
Copy the info shown in the blue box and post it here and we can help you modify it so it’ll appear as Windows 11.
AJ, MS will probably tell you to re-install – so will we. 🙂
If you have a backup, restore it. If not, a re-install over the top (keeping existing data and apps) will probably fix the issue. And make a backup image before the re-install.
cheers, Paul
To install over the top, run the installation (setup.exe) from within a running Windows (one that booted from C). Using an ISO makes it easy as you can mount it by double clicking.
Restoring a backup will get you a working system and you can then wait for the a fix (hopefully), or at least update one machine and then work with it to sort the issue.
cheers, Paul
I don’t believe an over-install will resolve this
AJ2020
If this helps, I’ve made several over the top repair installs for various vexing issues using an ISO file placed on my C: drive and mounted with a double click. Just run “setup”. They have all worked perfectly when nothing else did.
I’ve always had an image backup at the ready prior to a repair install but have never needed it.
Follow Paul T’s directions.
Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
