Moving from Configuration Manager and WSUS to Windows Update for Business should be straightforward. Move the workload. Deploy an Update Ring. Target a Feature Update policy. Sit back and watch Windows install updates from Windows Update instead of WSUS/Configuration Manager.
Except that’s not always what happens. Instead, you find devices that stubbornly refuse to follow Intune policies. Feature Updates never arrive. Windows Update appears healthy, yet something clearly isn’t right. In many of these cases, the culprit isn’t Intune, it’s old Windows Update policies that are still hanging around. We have all written scripts to run as remediation scripts to clear out these registry values to make sure Windows updates are installed from Windows Update.
Microsoft introduced IgnoreWindowsUpdateGroupPolicies specifically to address this problem. The setting is available through the Windows Update Policy CSP and Settings Catalog and allows Windows Update for Business policies delivered through MDM to ignore legacy Windows Update Group Policy settings.
What does this setting do? Well let’s start by looking at an Co-Managed Device where settings are applied using Group Policy and Configuration Manager. Which is as it should be.
Using the new IgnoreWindowsUpdateGroupPolicies settings
With the new settings we can simply ignore all Group Policy settings for Windows Update or to be more precise all registry values under HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate. We start with configuring the policy in Intune and deploy it to our devices.
After the policy is applied we now see that no Group Policy based policy is being used anymore by Windows Update even if the registry values are still inplace.
In the Registry all the policies are still inplace but totally ignored.
I so wish I had this a couple of years ago it would have saved me much time, troubleshooting and building scripts to clean up the registry values for Windows Update.
Why write a post on this now? Well I plan to deploy this everywhere that we still use Co-management and have moved the workload to Intune. Just to make sure that no group policy is created that interfere with Windows update or the Configuration Manager client start to write this values again that mess up Windows Updates.