How to block all patches or update installing on specific computer

Question

How to block all patches or update installing on specific computer

Evol12-5109 105

For some computers have deployed a software/system, any patches or quality updates will cause the software not working.

Is there any possible solution or configuration in intune can disable the installation of the patches/updates? And also keep the computer stay in Win10

Rahul Jindal 11,511 Reputation points

2023-06-28T06:21:45.0133333+00:00

It will depend on how you are managing the policies for installation of updates in the first place. If you using update rings, then you can pause them. Should you do it? I don’t think so. Not having your devices patched will leave them vulnerable and you are basically opening a security loophole in your environment. Either fix the underlying issue or take the devices off the internet and manage them separately.

Answer accepted by question author

0 additional answers

Your answer

Rahul Jindal 11,511 Reputation points

2023-06-28T06:21:45.0133333+00:00

It will depend on how you are managing the policies for installation of updates in the first place. If you using update rings, then you can pause them. Should you do it? I don’t think so. Not having your devices patched will leave them vulnerable and you are basically opening a security loophole in your environment. Either fix the underlying issue or take the devices off the internet and manage them separately.

Answer 1

Crystal-MSFT 54,201 Microsoft External Staff

@Evol12-5109, Thanks for posting in Q&A. To block installing windows update, you can follow the following steps:

Create feature update policy to remain at one windows feature version: For example remain at windows 10 22H2 or others. https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-feature-updates
Create windows update ring policy to set “Option to check for Windows Updates” as disabled to disable the option that users can look for Windows Updates themselfs. That way they can not manually update.

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Evol12-5109 105 Reputation points

2023-06-28T06:09:28.98+00:00

Hi,

Thanks, so please check my configuration below, will it take effect?
Crystal-MSFT 54,201 Reputation points Microsoft External Staff

2023-06-28T07:07:39.9133333+00:00

@Evol12-5109,, Thanks for the reply. If you don't configure feature update policy, you can set the Feature update deferral period (days) as 365 days. If feature update policy is set, you can set it as 0.

https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-settings#update-settings

For quality update, when we set Quality update deferral period (days) as 0, that means, the device will receive the quality update immediately. And the value range is from 0 to 30 for which Quality Updates are deferred. For "Automatic update behavior" when it set as Auto install at maintenance time - Updates download automatically and then install during Automatic Maintenance when the device isn't in use or running on battery power.

For windows update ring policy, it does not have the option to disable automatic update. I notice you don't want to install quality update either. The only way I think is to try if they can be disabled via registry key:

Disable auto update via registry key.

https://www.windowscentral.com/how-stop-updates-installing-automatically-windows-10

Note: Non-microosft link, just for the reference.

Disable check for update:

https://www.tenforums.com/tutorials/65013-enable-disable-check-windows-updates-windows-10-a.html

Note: Non-microosft link, just for the reference.

As a reminder, quality updates is the Microsoft approach to ensure that devices stay secure. If the update is stopped, it may cause security issue in your environment. And it is not suggested to do this.

Hope the above information can help.

Share via

How to block all patches or update installing on specific computer

0 additional answers

Your answer