09-19-2017 08:22 AM
09-19-2017 08:22 AM
Recently all our windows 10 devices have been going online to get windows updates. We are running SCCM, and up until recently this was working for pushing out updates.
We had our "allow Telemetary" set to 0 but have since changed it to 1. I have confirmed SCCM has the local policy set for "specify intranet microsoft update service location".. We have tried setting "select when feature updates are received" to disabled... and still no luck.
The only way I can stop onilne updates is by setting "do not connect to any windows update internet locations"... but then windows store doesn't work.
Has anyone else ran into this?
09-20-2017 06:10 AM
We are seeing the same thing. Tough to say when it started, though...it killed our internet connection yesterday.
We don't use SCCM, only WSUS.
Interested in what others are seeing, I am going to go search for te setting you spoke of, as we don't make use of the windows store.
09-20-2017 08:16 AM
I found an amazing article
I am in the process of testing this to see if it solves my issue or not...
09-21-2017 12:31 PMSolution
I found our mistake.
During our image creation we had selected "current branch for business" as a branch readiness level. I couldn't see this in rsop, or in any of our group policies.
Turns out the registry entry that caused us this grief was the following.
hklm\software\microsoft\windowsupdate\ux\settings "branchreadinesslevel" . It was set to 32, and after chaning it to 0 our comptuers look only to sccm/wsus.
09-21-2017 01:06 PM
I am hoping we tracked down our issue as well. We recently enabled the GPO setting - "Do not include drivers with Windows Updates" -- that is mentioned in one of the technet links above as something that would cause this scenario.
Hoping to get a definitive answer on that change tomorrow.
Thanks for the update
09-21-2017 01:16 PM
If when you're building an image, like I did, and you don't want the current branch to automatically start downloading, you may consider checking the box that says "defer Windows upgrades" or something like that... when you do that your are enabling your computer to automatically download current branch for business which will automatically start downloading and installing on users' computers as soon as CB goes CBB even if you use WSUS or Configuration Manager. We learned the hard way and had to quickly change the Registry setting controlling this behavior. It's called dual scanning and it is not exactly communicated well that this behavior will exist regardless of whether you're using a management tool for patching like WSUS or Configuration Manager.
Hope this will help others avoid our pitfalls. We did not test 1703 in our environment when building images for our new school year because of the time window of our testing. So we built our images on 1607. Then in July when 1703 went CBB, all of our computers that had 1607 started downloading the new build... then as soon as the user rebooted, it started installing. At first people thought it was just updates... then they started reporting it was taking a really long time to update... as we investigated, we found this undesired behavior.
So if you want (or need) to be a build behind CBB, you cannot use the "defer upgrades" configuration in Windows 10. Just keep the computer in your VM off the Internet.