Win10 getting forced from 1511 to 1607 in spite of group policy settings

Topic

New Reply

I’ve seen this mentioned many times in the past two days. This from Mike: We have a groups of PCs that were on 1511 and we had added the registry entr
[See the full post at: Win10 getting forced from 1511 to 1607 in spite of group policy settings]

Reply | Quote

Replies

So, I’m confused…
The settings were changed in the registry and WU ignored them.
The settings were removed from the registry and added to GP instead – here’s where I get confused. The machines were already updated at this point, right?

I’m just trying to confirm this before I ring the “MS went full retard and ignored GP” alarm at work. (Since we’re on a domain and if they’re now ignoring GP, we’re in for a whole lot of headaches going forward.)

Reply | Quote

I assume most people who use the deferral set of policies built-in various versions and editions of Windows 10 do not use a managed server like WSUS to control the updates. This set of deferral policies is only a sweetener and not the proper way to control any update, in this particular case the feature upgrades. Managing updates in this way is more suitable for the computers managed by MDM than Group Policy. At least this is how I see it.

More details here:

https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb
Those interested should read the whole section and in particular
https://technet.microsoft.com/en-us/itpro/windows/manage/waas-configure-wufb

Pay special attention to the telemetry configuration note.

It is complicated, it changes from one version to another, but… this is the joy of using Windows 10. 🙂

Reply | Quote

Did they try disabling the Wu service? Looks like Ms made it the last resort and I am not sure for how long.

Reply | Quote

As I said before w10 has failed and Ms is desperate cant let this happen. There is nothing more evil and dangerous than desperate powerful corporations. Evil.

Reply | Quote

Is it true that the ‘metered conection’ trick doesn’t work whether over wifi or ethernet in windows 10 v1511 to avoid the v1607 update?

I had someone moaning about it today, in the real world, and I couldn’t answer them, as I don’t have windows 10 only Win 7 HP/ Pro.

To which they replied, “lucky you!”

Then they asked if they could fresh install Win 7 over Win 10 using their original Win 7 retail disk, as they did not like the new Win 10 update framework/ procedure.

(I don’t think they can, as it was a free upgrade from 7 to 10 but, didn’t say at the time, I directed them here for help..)

Anyone?

Reply | Quote

https://www.cnet.com/news/microsoft-windows-10-forced-updates-auto-restarts-are-the-worst/#ftag=CAD590a51e

Reply | Quote

This says it all.

Evidently a response from MS to Sean Hollister at CNET.

In other words, [good-bye] customers. We will do what we want, when we want, at our convenience. Did Apple write this?

“Once a machine is upgraded to Windows 10, it will remain current through Windows Update for the supported lifetime of the device, with safety and security, productivity, and entertainment value over time. This is what we mean when we talk about delivering Windows as a service, and it is one of our core inspirations for Windows 10. We’ll keep listening to our customers, improving the experience month after month. Windows 10 is an operating system that will run on a range of devices — from Xbox to PCs, phones to tablets and tiny gadgets — all of which are connected and kept up-to-date by Windows Update. Both enterprises and consumers benefit. The optimum way to ensure our customers are running the best Windows is to get them the latest updates for Windows 10. Delivering Windows 10 as a service means we can offer ongoing security updates, new features and capabilities – we’d like to make sure people can get access to the latest Windows 10 updates as soon as they are available.”

Reply | Quote

Did the defer period expire for 1511 yet? If I understand this patchocalypse correctly after the defer period you are back to Microsoft forcing updates even if you don’t want them.

Too bad MS won’t allow the advanced user have control. IMHO, if we were allowed the same control as with Win7 it would not surprise me one bit if Win10 had new installs in droves.

Reply | Quote

Remedy:

Do not use W10.

Reply | Quote

It’s my understanding that the 1607 upgrade did NOT go out over metered connections. Note that, in 1511 (and 1607) only WiFi connections can be marked as “metered.”

Can they fresh install Win7 over Win10? Sure, absolutely. Start here:

https://www.askwoody.com/2016/how-to-install-windows-7-from-scratch/

Reply | Quote

And now it’s time for some satire –

Once a machine is upgraded to Windows 10, it will remain a changing landscape of dubious software delivered through Windows Update for our current and future interpretations of the supported lifetime of the device. Our marketing materials will extoll safety and security, productivity, and entertainment value to mask our real goal of data mining and advertising revenue generation. This is what we mean when we talk about Windows as a service; capitalizing on our monopoly position to increase profits at the expense of consumer privacy and freedom of choice is one of our core inspirations for Windows 10. We’ll keep pretending to listen to our customers, as Windows 10 telemetry intrudes ever deeper into the users’ experience month after month. Windows 10 is an operating system that will run, even if poorly, on a range of devices all of which are kept in a constant state of flux by Windows Update. We will benefit from the software assurance services provided by enterprises and consumers alike by reducing quality control labor costs to drive profits ever upward. The optimum way to ensure our customers are doing all they can to contribute their fair share to our bottom line is to use every means at our disposal to get Windows 10 installed. Delivering Windows 10 as a service means we can continuously implement new features and capabilities, all with a view towards maximizing our return on investment – we’ll do all we can to install the latest Windows 10 updates as soon as they are available to maintain our momentum towards achieving that goal.

Reply | Quote

Much better than soviet propaganda. At least there if u resisted u disappeared. Here its failure to resist is inexcusable.

We deserve all we get.

Reply | Quote

Depends on what you mean by the “defer period.” See the article.

You can always turn off all updates. That’ll keep you at whatever version you’re on.

Reply | Quote

Once again, just my personal opinion (although I’m pretty sure a lot of people agree):

Windows 10 is OK as long as you keep it offline – just like Windows 7 these days.

I have Windows 10 Anniversary Update installed as a dual boot with Linux Mint. After I installed Windows 10 and made sure it was activated and had all the drivers installed I immediately took it offline (Network Adapter disabled) before it installed any other updates or things like Candy Crush, Facebook, Twitter, etc.

I then ran ShutUp10 to disable all the rest of the ‘annoying’ stuff just in case W10 starts complaining about not being able to ‘phone home’.

So, I have a clean install of W10 AU that doesn’t hassle me about wanting to update itself every 5 minutes and I can use it in peace. If I need Internet access while I’m using W10 I have my trusty 10 year old HP laptop (running Mint).

Now, if MS suddenly find a way to mysteriously update my copy of W10 (after Creator’s Update comes out) when it supposedly isn’t connected to the Internet then I’d really start to get worried. 🙂

Reply | Quote

ah, so he may have had the ethernet connected when it updated, that make sense now.
Thanks Woody, emailed him the link 😉

Reply | Quote

Where do you want to go today?

Reply | Quote

Hmmm, I seem to recall being able to offer security updates for the Windows OS prior to W10 being offered as a service. I am beginning to think they should check the lead concentration in the Redmond water supply. Or else they will have to lock up the official corporate hookah!

Reply | Quote

I see by the first article linked by ch100 above that the deferral for feature upgrades is 180 days. So 1511 to 1607, if deferred correctly, should not happen until 5/11/2017. Patchocalypse!

Reply | Quote

Ah! improving the experience month after month…

Gotta love ’em.

Until ms fixes this and gives end user full control over both updates and the privacy control, win10 is a no-go here. Loved the cnet stories btw.!

ms owes the hardware and knows, what’s best for your experience… so lean back, take your time and enjoy the ride…

For the past week I’ve been studying how to move my workflow to Linux and besides of my photography setup, I seems to be able to come close to a complete shift?! One more job to finish off, then it’s time to give up and leave for good…

There is quite a few things, I probably will miss, but I simply can’t accept the direction ms has chosen to take. When I work on a job, there is simply no time to fool around waiting for software interuptions or hi-jacking… trying to make a living and all that…

Just checked, and found my microsoft experience started in 1985. Mostly it’s been a fine and pleasant ride, but all good things apparently comes to an end…

Sorry for the rant (again), but I’m kinda depressed. And upset.

And clinging on to dear w7…

Reply | Quote

Wonder how many hours of work have been wasted world wide?

Any law suits coming?

Not only is this update behaviour thoughtless, it’s directly heartless.

Or do ms consider w10 machines to be toys, as in not working tools?

Reply | Quote

It’s not clear to me how that setting interacts with the “Defer Upgrades” setting. Some say it’s additive – that you get the four-months-or-so between CB and CBB publishing, plus an additional 180 days.

We haven’t lived long enough to know for sure.

Reply | Quote

🙂

Reply | Quote

I have Win 10 Home with ethernet connection and with small reg hack I have been able to defer all my updates so far by tricking OS into thinking it’s metered. For how long, I don’t know.

Reply | Quote

This doesent bode well at all for the future of Win10. We have a few machines out on test right now with 1511 installed as 1607 wasn’t judged ready for use. With out going in to “Proprietary info.” The machines cant be on a Domain and often send data home by either satellite phone, International long distance and or connecting to the Hotels free internet of whatever corner of the world they may be in. Despite the Operators and machines being sent out with a large sheet of “do’s & dont’s” its inevitable that they either get left on overnight or a prolonged connection to expensive “real time” monitoring sporadically. Now it looks like they could be coerced in to upgrading which wouldn’t only be an expensive exercise lost up time etc, 1607 is as yet not tested satisfactorily with our software and, criucially potential data loss and/or corruption. Now the case has to be made for either Education or Enterprise which is over and above the cost of Pro for essentially machines out max. 6 mos. and/or long distance tech. support (me) generally in the middle of the night with time differences. Or if extended “down time” (me) again racking up 15-16 hour long haul jaunts. (not good 🙁 )As a standby our software runs like a “Champ” on Win8.1 and Win7 (remember that M$? the OS that wont die) At least it’ll buy some time before having to “Pitch” to management about the more expensive alternatives but has thrown roughly about 6 mos. of tinkering and work ironing out the discrepancies of, basically, older software on Win10 and the potential of having to splash out on R&D to get the software updated (not me) but not if they are going to throw a monkey wrench in to the works on a regular basis. (not good) Cheers M$ you really bring a whole new meaning to the Chinese curse “May you live in interesting times” 🙁

Reply | Quote

Jan, do what Carl D. did. Just keep your main workstation offline. Set up a Linux flavor for web browsing. It’s what I’m planning, actually. I keep this box Win7. Any file transfers can go via Dropbox, which is the only site this machine will see once security updates end.

Reply | Quote

For those who r interested, check out this Win 7 “SP2” dated June 2016 …….
http://www.mantis.es/noticias/Win7SP1-Update-EN
.
Maybe, need to do an antivirus scan on the downloaded iso file(= 6.3GB in size).

Reply | Quote

That’s how you get left behind 🙂

Reply | Quote

@ Carl D,
You’ve just touched on a terrifying thought I had a while back..

If Windows 10 PC’s were off-line for more than 90 days, then they would be neutered in function and the only way to get full functionality back, was to update on-line to keep in line with the MS patching framework.

BSOD whilst typing that, even my PC hated that thought 😉

That was my prediction where windows 10 was going, which was another reason ‘windows as a service’ is not for us.

Hopefully, I’m wrong but, it is not impossible.

Reply | Quote

The hacks I’ve seen work just fine – but I don’t recommend them because they are, quite precisely, hacks.

The new beta builds include the ability to mark Ethernet connections as metered.

Reply | Quote

That would sure save a lot of “leg work” for a fresh install. Unusual file size though 6.3GB (normal size for untouched media is 3.09GB for x64 + approx. 1.4GB of updates same value if all 4 indices/vers. are updated)Sounds like it was SYSPREPed to either an install.wim or more likely and install.esd.If its clean, however, that’s a good few hours you’ll have saved should the need arise. 🙂

I see Win10 has give us another gift of kb3211320 (wonder what fun this is the usual stacks again?

http://www.ghacks.net/2017/01/25/windows-10-version-1607-update-kb3211320/

(In lieu of the usual M$ “up to date info” tech pages)

Reply | Quote

That would be real nice..hope they keep it that way in the final release. I don’t mind being up to date, I just like to defer it for a few days to see if everything is working and give them a little time to pull it if it isn’t:)

Reply | Quote

Precisely.

Reply | Quote

Martin at gHacks is right, tho there’s a bit more to the story. Coming up momentarily on InfoWorld.

https://www.askwoody.com/2017/undocumented-win10-patch-kb-3211320-likely-a-servicing-stack-update/

Reply | Quote

@ BobbyB ……. The huge 6.3GB size for the Win 7 “SP2” x64 iso is likely bc of this …

This media install includes the following edtions:

Home Basic
Home Premium
Professional
Ultimate

Reply | Quote

I can confirm that the “Defer Upgrade” policy does works as expected, and the upgrade is not offered if the policy/registry is set
verified on both ver 1511 and 1507

not sure why it’s not working for some, but i suspect that’s due the behaviour of new Windows Update UI
although WU group policies are correctly applied, but they do not become effective without another action
you either go to UI and click the “check” button
or, the definitive way to get them active through admin cmd:
net stop usosvc
net stop wuauserv
UsoClient.exe StartScan

this also needed if the policy/registry is removed

Reply | Quote

Ohh yeah I know that but the Orig. Install disk actually contains all versions and as to what you get is determined by the ei.cfg file and I am guessing that’s what they have done SYSPRPed an updated image. Probably when it was made back in to an .iso file they deleted the ei.cfg file and/or .clg files (optional) If you delete that and remake the .iso you’ll have the option to choose the version at install. As win7 ships with all those vers. already in there 4 for x64 media 5 for x86 media.
Conversly if you make an ei.cfg file (using notepad with OEM and VL values set and no version specified). Place it in the sources folder it will unlock any hidden vers. for win8.1 & win10 there’s lots of howto’s out there. Great little trick rather than keep a “ton” of .iso’s for each vers. and a space saver on your backup media (which I use for my tunes) 🙂

Reply | Quote

Good info. Two questions:

If the group policy says to defer for 8 months, is the 8 months measured from CB or from the date CBB is published on VLSC?

and

Any chance checking “Defer Upgrades” in the Win10 1511 UI somehow overrides the group policy? That might explain why some got hit.

There’s an ongoing discussion on patchmanagement.org . Those of you who have been bit should subscribe!

Reply | Quote

It is very likely the GUI or the alternative batch file that you provided. 🙂

Reply | Quote

I do not know, but i guess it’s from the date CBB is published
ver 1511 only have defer policy for CBB
ver 1607 have defer policy for both CB or CBB

seeting the policy grey out the option in UI

as matter of fact, i just did one more test and checking “Defer Upgrade” in UI prevent the upgrade now, without the need for policy

they reviewed the upgrade rules somehow

Reply | Quote

This could be the reason, WU is back to offer old 14393.0 media for upgrade

https://i.imgbox.com/WyMkTyV4.png

refreshed version could be temporary withdrawn to review the rules for defering

Reply | Quote

Its slipstreamed with all updates up to June 2016 doesn’t this include all the ones pushing win10 gwx?

Reply | Quote

If it is they should all be inactive by now (that’s the theory) probably has the following

windows6.1-kb3020369-x64 (stacks precursor) windows6.1-kb3125574-v4-x64 (cumm roll up)
windows6.1-kb3156417-x64 (May)
windows6.1-kb3172605-x64 (July)

still a great time saver though these take a long time to include offline or online and theres still about 55-60 updates left 🙂

Reply | Quote

@Steve
“I don’t mind being up to date, I just like to defer it for a few days to see if everything is working and give them a little time to pull it if it isn’t:)”

I think you summarised very well what is the main purpose of this site and not what some posters here, some of them frequent posters and with very good credentials and reputation beyond any doubt, recommend to avoid updates indefinitely.
You found the perfect approach! 🙂

Reply | Quote

@ Carl D
Please do not use Windows 10 and use exclusively Linux as this is very bad advice in relation to Windows 10.
There is no way for the regular user without in depth knowledge of Windows internals and even that is not enough sometimes to make any modern version of Windows to work correctly offline without slowing down due to time-outs.
It is certainly possible, but this is not be considered general advice.

Reply | Quote

We have a major Bank here which use to advertise and might still do it as “Which Bank?” 🙂

Reply | Quote

Why don’t you just disable the Automatic Updates in Group Policy and Disable to button as well to avoid the temptation? Disabling the button might be a functionality available only in 1607 though.

Reply | Quote

Or you may take the hammer approach which I don’t recommend unless you are getting desperate and set
Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication Settings
Turn off access to all Windows Update features to Enabled?
This is an old well-known policy, but please be aware that it may create side-effects.

Reply | Quote

So the updated version of the ISO just published has been withdrawn, or this only applies to the WU download?

Reply | Quote

The GUI setting should be over-riden by the Group Policy and not influence each other, as they configure different registry areas with their rules of precedence. If this works correctly, it is difficult to say.

Reply | Quote

No, only WU
WSUS & MSDN still updated

Reply | Quote

If I recall the limit to patches should be June 1st to avoid unnecessary or w10 pushing.

So if installing this copy one should unistall those few and apply only security updates after that date.

Whether this is significantly easier than from scratch is not that clear.

Reply | Quote

@ fp ……. Quoting from the link … “Windows 7 is installed with all updates available to June 2016, including Internet Explorer 11 and except those that Microsoft uses to collect information from our use of Windows and those to try to download and upgrade to Windows 10 or show the Update Notification to Windows 10 constantly.”

Reply | Quote

Ah ok thanx.

Reply | Quote

@fp, messager7777777 it looks good to me and sure would save some time. As always check the image for Virus’s & Malware etc, its a long slow download 🙁 (gave up here when it said 2hrs) It includes usb3.0 drivers which are a must on usb3 machines even if only 1 port (stops the install, halting at looking for Dvr’s) you might want to check if the USB3 drivers are on the boot.wim as well as the main install.wim. (cant see why they wouldn’t but hey you never know) Almost certain it has been “imaged” as the .net install.exe’s are on the desktop, which you simply don’t get with a bare image. Couldn’t look further but its likely all 4 vers. are unlocked so you get to pick you fav. vers. of win7x64 🙂

Reply | Quote

@BobbyB: replace KB3020369 with KB3177467 (cuz KB3177467 supersedes KB3020369)

also KB3156417 is old, superseded & replaced by KB3172605, KB3185330, KB3192391 and newer monthly security rollups for Win7. Therefore KB3156417 is UNnecessary to install nowadays.

Reply | Quote

@EP thx for that 🙂 yeah I just have (package) folders for throwing stuff in I haven’t looked at the “offline” updates folder since errm Oct? Didn’t know that kb3172605 had superceded kb3020369. I knew kb3156417 is probably redundant and I missed June’s entirely as apparently kb317605 (july) takes care of it. I went off this web page
https://blogs.technet.microsoft.com/astoica/2017/01/03/windows-7-refreshed-media-creation/
They say that’s the correct way but its needlessly complicated but offline its slow as is WUSA.exe (batch file) or single or even off the desktop) The thing is sometimes I wonder as Win7 is so “Mega” reliable is it worth spending so much time for “what if’s” Recovery etc Then again I think back to XP days and think yeah better have an up to date recovery system/media in place 😉

Reply | Quote

Unfortunately, it is not a bug…

Apparently, in Microsoft math, 8 = 6, and 6 = 8. Now we know why Windows’ code has so many issues, right?

And so, all group policies / registry entries / what have you, all set to “delay full OS upgrades from being installed for 8 months from date of release”, in Microsoft’s mind, have officially done their job and thus, are now simply ignored as if it actually were 8 months since the release of 1607. Oh, what fun.

This behavior might change, it might not change. It could change twice, for all anyone outside the WU team at MS knows. Point being, forced updates cause more harm than good.

Reply | Quote

refreshed CBB media is pushed back to Windows Update

i personally verified that Group Policy “Defer Upgrades” is respected now, enabling the policy
will prevent the upgrade ffom being offered

Reply | Quote