Windows 10 1809 - Feature on Demand but prevent users from using WindowsUpdate

Jochen Schmitt

Windows environment: 1803 Enterprise

After a lot of pain, I am happy I found this post.

So in our occassion where we really need to have the clients blocked from WU, I had to allow them to download FODs from WU since hosting them is a -no go- from Microsoft for the future builds.

1. Specify settings for optional component installation and component repair

Computer Configuration\Policies\Administrative Templates\System\Specify settings for optional component installation and component repair.

Once we set this up, with a Blank alternate source and only checked that clients should contact WU instead of WSUS, we got the following error on Add-WindowsCapability -Online

0x8024002e

This meant that something else was blocking access to WU so we changed the following:

2. Do not connect to any Windows Update Internet locations

Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations

We set this to Disabled since we need clients to be able to contact WU, Store and DO. 

Microsoft documentation:

"When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working."

In reality this has been the case for a year now and our clients never misbehaved (I have set the proper policy setting for Dual Scan so clients will not get tricked into pulling Feature Updates from WU).

But then it still failed for us with another error code! So what is blocking this functionality?

3. Turn off access to all Windows Update features 

Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication Settings\Turn off access to all Windows Update feature. Registry Value: DisableWindowsUpdateAccess

We had to set this to Disabled.

But this time we were faced with the critical issue of the GUI allowing the users to "Check for Updates from Microsoft Update".

Microsoft documentation:

By enabling the Group Policy setting administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured.

So, finally we had to block access to Check for Updates altogether!

4. Remove access to use all Windows update features

Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features

We had to set this to Enabled

So as it is now, we are able to properly do FoDs over WU and our clients will not use WU for anything else other than that.

Hope this helps someone 🙂

-

Alex