SOLVED
Home

1607 and 1703 autoupdating, and bypassing sccm updates

%3CLINGO-SUB%20id%3D%22lingo-sub-107840%22%20slang%3D%22en-US%22%3E1607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-107840%22%20slang%3D%22en-US%22%3E%3CP%3ERecently%20all%20our%20windows%2010%20devices%20have%20been%20going%20online%20to%20get%20windows%20updates.%26nbsp%3B%20We%20are%20running%20SCCM%2C%20and%20up%20until%20recently%20this%20was%20working%20for%20pushing%20out%20updates.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20had%20our%20%22allow%20Telemetary%22%20set%20to%200%20but%20have%20since%20changed%20it%20to%201.%26nbsp%3B%20I%20have%26nbsp%3B%20confirmed%20SCCM%20has%20the%20local%20policy%20set%20for%20%22specify%20intranet%20microsoft%20update%20service%20location%22..%20%26nbsp%3B%20We%20have%20tried%20setting%20%22select%20when%20feature%20updates%20are%20received%22%20to%20disabled...%20and%20still%20no%20luck.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20only%20way%20I%20can%20stop%20onilne%20updates%20is%20by%20setting%20%22do%20not%20connect%20to%20any%20windows%20update%20internet%20locations%22...%26nbsp%3B%20but%20then%20windows%20store%20doesn't%20work.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHas%20anyone%20else%20ran%20into%20this%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-108991%22%20slang%3D%22en-US%22%3ERe%3A%201607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-108991%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20when%20you're%20building%20an%20image%2C%20like%20I%20did%2C%20and%20you%20don't%20want%20the%20current%20branch%20to%20automatically%20start%20downloading%2C%20you%20may%20consider%20checking%20the%20box%20that%20says%20%22defer%20Windows%20upgrades%22%20or%20something%20like%20that...%20when%20you%20do%20that%20your%20are%20enabling%20your%20computer%20to%20automatically%20download%20current%20branch%20for%20business%20which%20will%20automatically%20start%20downloading%20and%20installing%20on%20users'%20computers%20as%20soon%20as%20CB%20goes%20CBB%20even%20if%20you%20use%20WSUS%20or%20Configuration%20Manager.%20%26nbsp%3BWe%20learned%20the%20hard%20way%20and%20had%20to%20quickly%20change%20the%20Registry%20setting%20controlling%20this%20behavior.%20%26nbsp%3BIt's%20called%20dual%20scanning%20and%20it%20is%20not%20exactly%20communicated%20well%20that%20this%20behavior%20will%20exist%20regardless%20of%20whether%20you're%20using%20a%20management%20tool%20for%20patching%20like%20WSUS%20or%20Configuration%20Manager.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20will%20help%20others%20avoid%20our%20pitfalls.%20%26nbsp%3BWe%20did%20not%20test%201703%20in%20our%20environment%20when%20building%20images%20for%20our%20new%20school%20year%20because%20of%20the%20time%20window%20of%20our%20testing.%20%26nbsp%3BSo%20we%20built%20our%20images%20on%201607.%20%26nbsp%3BThen%20in%20July%20when%201703%20went%20CBB%2C%20all%20of%20our%20computers%20that%20had%201607%20started%20downloading%20the%20new%20build...%20then%20as%20soon%20as%20the%20user%20rebooted%2C%20it%20started%20installing.%20%26nbsp%3BAt%20first%20people%20thought%20it%20was%20just%20updates...%20then%20they%20started%20reporting%20it%20was%20taking%20a%20really%20long%20time%20to%20update...%20as%20we%20investigated%2C%20we%20found%20this%20undesired%20behavior.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20if%20you%20want%20(or%20need)%20to%20be%20a%20build%20behind%20CBB%2C%20you%20cannot%20use%20the%20%22defer%20upgrades%22%20configuration%20in%20Windows%2010.%20%26nbsp%3BJust%20keep%20the%20computer%20in%20your%20VM%20off%20the%20Internet.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ejcl%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-108985%22%20slang%3D%22en-US%22%3ERe%3A%201607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-108985%22%20slang%3D%22en-US%22%3E%3CP%3EExcellent.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EI%20am%20hoping%20we%20tracked%20down%20our%20issue%20as%20well.%26nbsp%3B%20We%20recently%20enabled%20the%20GPO%20setting%20-%20%22Do%20not%20include%20drivers%20with%20Windows%20Updates%22%20--%20that%20is%20mentioned%20in%20one%20of%20the%20technet%20links%20above%20as%20something%20that%20would%20cause%20this%20scenario.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHoping%20to%20get%20a%20definitive%20answer%20on%20that%20change%20tomorrow.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20update%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-108974%22%20slang%3D%22en-US%22%3ERe%3A%201607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-108974%22%20slang%3D%22en-US%22%3E%3CP%3EI%20found%20our%20mistake.%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDuring%20our%20image%20creation%20we%20had%20selected%20%22current%20branch%20for%20business%22%20as%20a%20branch%20readiness%20level.%26nbsp%3B%20I%20couldn't%20see%20this%20in%20rsop%2C%20or%20in%20any%20of%20our%20group%20policies.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETurns%20out%20the%20registry%20entry%20that%20caused%20us%20this%20grief%20was%20the%20following.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ehklm%5Csoftware%5Cmicrosoft%5Cwindowsupdate%5Cux%5Csettings%20%22branchreadinesslevel%22%20.%26nbsp%3B%20It%20was%20set%20to%2032%2C%20and%20after%20chaning%20it%20to%200%20our%20comptuers%20look%20only%20to%20sccm%2Fwsus.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-108353%22%20slang%3D%22en-US%22%3ERe%3A%201607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-108353%22%20slang%3D%22en-US%22%3E%3CP%3EI%20found%20an%20amazing%20article%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2F88771e56-8be0-4bc9-b674-648619eab2ac%2Fwindows-10-pro-1703-and-windows-update-with-wsus%3Fforum%3Dwinserverwsus%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fen-US%2F88771e56-8be0-4bc9-b674-648619eab2ac%2Fwindows-10-pro-1703-and-windows-update-with-wsus%3Fforum%3Dwinserverwsus%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20in%20the%20process%20of%20testing%20this%20to%20see%20if%20it%20solves%20my%20issue%20or%20not...%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-108291%22%20slang%3D%22en-US%22%3ERe%3A%201607%20and%201703%20autoupdating%2C%20and%20bypassing%20sccm%20updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-108291%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20seeing%20the%20same%20thing.%20%26nbsp%3BTough%20to%20say%20when%20it%20started%2C%20though...it%20killed%20our%20internet%20connection%20yesterday.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20don't%20use%20SCCM%2C%20only%20WSUS.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInterested%20in%20what%20others%20are%20seeing%2C%20%26nbsp%3BI%20am%20going%20to%20go%20search%20for%20te%20setting%20you%20spoke%20of%2C%20as%20we%20don't%20make%20use%20of%20the%20windows%20store.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3ESteve%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Wayne Wall
Occasional Contributor

Recently all our windows 10 devices have been going online to get windows updates.  We are running SCCM, and up until recently this was working for pushing out updates.  

 

We had our "allow Telemetary" set to 0 but have since changed it to 1.  I have  confirmed SCCM has the local policy set for "specify intranet microsoft update service location"..   We have tried setting "select when feature updates are received" to disabled... and still no luck.

 

The only way I can stop onilne updates is by setting "do not connect to any windows update internet locations"...  but then windows store doesn't work.  

 

Has anyone else ran into this? 

5 Replies
Highlighted

We are seeing the same thing.  Tough to say when it started, though...it killed our internet connection yesterday.

 

We don't use SCCM, only WSUS.

 

Interested in what others are seeing,  I am going to go search for te setting you spoke of, as we don't make use of the windows store.

 

Thanks

Steve

Highlighted

I found an amazing article

 

https://social.technet.microsoft.com/Forums/en-US/88771e56-8be0-4bc9-b674-648619eab2ac/windows-10-pr...

 

I am in the process of testing this to see if it solves my issue or not...  

 

 

Highlighted
Solution

I found our mistake.  

 

During our image creation we had selected "current branch for business" as a branch readiness level.  I couldn't see this in rsop, or in any of our group policies. 

 

Turns out the registry entry that caused us this grief was the following.

 

hklm\software\microsoft\windowsupdate\ux\settings "branchreadinesslevel" .  It was set to 32, and after chaning it to 0 our comptuers look only to sccm/wsus.

 

Highlighted

Excellent.  


I am hoping we tracked down our issue as well.  We recently enabled the GPO setting - "Do not include drivers with Windows Updates" -- that is mentioned in one of the technet links above as something that would cause this scenario.  

 

Hoping to get a definitive answer on that change tomorrow.

 

Thanks for the update

Steve

Highlighted

If when you're building an image, like I did, and you don't want the current branch to automatically start downloading, you may consider checking the box that says "defer Windows upgrades" or something like that... when you do that your are enabling your computer to automatically download current branch for business which will automatically start downloading and installing on users' computers as soon as CB goes CBB even if you use WSUS or Configuration Manager.  We learned the hard way and had to quickly change the Registry setting controlling this behavior.  It's called dual scanning and it is not exactly communicated well that this behavior will exist regardless of whether you're using a management tool for patching like WSUS or Configuration Manager.  

 

Hope this will help others avoid our pitfalls.  We did not test 1703 in our environment when building images for our new school year because of the time window of our testing.  So we built our images on 1607.  Then in July when 1703 went CBB, all of our computers that had 1607 started downloading the new build... then as soon as the user rebooted, it started installing.  At first people thought it was just updates... then they started reporting it was taking a really long time to update... as we investigated, we found this undesired behavior.

 

So if you want (or need) to be a build behind CBB, you cannot use the "defer upgrades" configuration in Windows 10.  Just keep the computer in your VM off the Internet.

 

jcl

Related Conversations
Autopilot and sccm issue
zolabus in Microsoft Intune on
1 Replies
We received 2 Canary updates in the same day!
HotCakeX in Discussions on
2 Replies
Why Edge Canary isn't updated Daily/Nightly?
HotCakeX in Discussions on
8 Replies
Windows 7 ESU AMA: early access
Heather Poulsen in Windows AMA on
0 Replies
Installing SCCM
Jason Denness in System Center on
2 Replies