Intune managed laptop updated to windows 11

Question

Hi,

we currently have 1000+ managed devices in intune with a lock on the update to windows 11 so we can manually decide when we're ready to upgrade our environment to windows 11. However,2 of our laptops automatically updated to windows 11. I have contacted the users of these devices and they said they had nothing to do with the update to windows 11. I currently have one of these laptops in my possession. Is there a way to troubleshoot the laptop to find out why it updated to windows 11? Or do you know a reason why it could have happened?

Thanks in advance!

Answer 1

Did they by any chance enroll in the insider program?

Answer 2

I will ask. Is that possible for them to do on their own or is there also a possibility to block that?

Answer 3

Hello there,

What is you feature update policy?

A intune device won't install an update when it has a safeguard hold for that Windows version. When a device evaluates applicability of an update version, Windows creates the temporary safeguard hold if an unresolved known issue exists. Once the issue is resolved, the hold is removed and the device can then update.

You can read about the Update behavior when multiple policies target a device: https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-feature-updates#update-behavior-when-multiple-policies-target-a-device

------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 4

@Veelaert Matthias , Thanks for the reply. In General, after the feature update policy is applied to the device, Intune pass the device list to DSS (Downstream service). Then the device enroll to DSS to block or allow the updates. The DSS process request from Intune to pin device to a certain OS version with feature update policy.

In your situation, there are some possible cause that the device has enrollment issue to DSS. Or the devices may be accidently upgraded to unwanted OS version before these device are actually enrolled into DSS.

As a workaround, we can use TargetReleaseVersion CSP to control the version:
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion

But if you want to troubleshoot this, you can open case to get more help. Here is a link with the steps to open case for your reference:
https://learn.microsoft.com/en-us/mem/get-support

Hope it can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.