Windows 11 First Boot 'Checking for Updates'

Question

Hi,

I am working on a customer project to deliver Windows 11 from Configuration Manager. Fairly routine engagement but one item that has me a little confused is once the ConfigMgr Task Sequence has completed and Windows 11 boots for the first time, it seems intent on checking for updates and subsequently updating itself.

Whilst this is great the ramifications for an Enterprise who want to have a controlled state means this could be a little 'wild west' in instances , therefore I am trying to ascertain if this is being forced upon or if there is a way to stand this configuration down and allow a controlled check for updates which should be happening anyway via ConfigMgr. Some of the previous answer file attributes no longer seem effective and there doesn't seem to be a huge amount online about this.

For clarification, this is Windows 11 Enterprise, vanilla image being delivered via Configuration Manager.

Thanks in advance

Answer 1

Hi,

In Windows 11, the behavior of checking for updates during the first boot can be influenced by Group Policy settings. To control this process in an enterprise environment, you can use Group Policy to configure Windows Update settings.

Here's how you can do it:

Press Win + R, type "gpedit.msc," and press Enter to open the Local Group Policy Editor.

Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Windows Update."

Look for the policy named "Do not connect to any Windows Update Internet locations" and set it to "Enabled." This will prevent Windows from connecting to Windows Update servers during the first boot.

Additionally, you can configure other policies like "Configure Automatic Updates" to control how updates are installed and scheduled.

By configuring these policies, you can ensure that Windows 11 Enterprise machines don't initiate uncontrolled updates during the first boot and instead rely on your Configuration Manager for updates.

Answer 2

Considering this requirement, I can propose two methods:

1. Using a Task Sequence load the registry hive of the full OS, make necessary modifications, and then unload it.
2. Customize the golden image with applying local policies and skipping OOBE.

Answer 3

Have you ever been able to solve this? I have the exact same issue and cannot find a solution online.

Thanks!