Turn off access to all Windows Update features also disables Settings>Apps>Optional Features

Question

Hi Everyone,

I had a requirement to disable the button “Check online for updates from Microsoft Update” in Windows 10 since we use WSUS in order to approve all our updates.

In another thread I had opened here previously the answer given was to configure the following group policy setting.

Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings

"Turn off access to all Windows Update features" = Enabled

Now, this setting achieves the objective and it allows for Windows Store Apps to continue to work. However, this policy also blocks the Settings > Apps > Optional features > Add a Feature functionality, which we'd like to enable and let it grab them from Microsoft.

This new GPO that I came across looked to to be the answer to my question:

Computer Configuration/Policies/Administrative Templates/System

"Specify settings for optional component installation and component repair"

Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS) = Enabled

However, it seems the top Policy blocks this from working, but it does seem to allow the legacy Control Panel method of adding old Features to work, but things like the RSAT Tools aren't in there nor in the FoD in WSUS itself - https://4sysops.com/archives/install-rsat-1809-and-other-optional-features-in-wsus-environments/

Anyone figured out how to keep updates coming from WSUS, hide the "Check online for updates from Microsoft Update" button but also allow Optional Features to be installed from MS Update and also keep the Windows Store working at the same time?

Kind Regs,
Bruno

Answer 1

You'll want to review : https://www.ajtek.ca/wsus/how-to-install-net-3-5-rsat-tools-and-other-optional-components-with-wsus/

Answer 2

@Bruno Ramos de Matos
Hi,

I checked the GPO settings you used, you are correct.
There are issues if you have "Turn off access to all Windows Update features" enabled.
If you disable this GPO, the FOD works.

Since their implementation is conflicting, you may have to make a trade-off.

Hope above information can help you.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

I also have a similar problem... Wondering if anyone has any guidance

We have the registry key set HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer to 1

Yet when this setting is enabled the optional features can't install. I have specified the GPO "Specify settings for optional component installation and component repair" to "download repair content and optional features directly from windows..."

The second I switch UseWUServer to 0 the computer can go out to the internet and get updates, we currently use SCCM for updates.

Answer 4

No, it works for all optional features. Did you read the section
If your client systems are not connected to the Internet: Use Group Policy
?
It spells out how to get the local repository working from Microsoft Business Center (Windows 10 Features on Demand / Windows Server Features on Demand)