Recommended ACTIVE Group Policies for non-business Windows 10 Pro

Topic

New Reply

I’ve disabled all Group Policies in my Windows 10 Pro PC (Installed 12/28/2021 – OS Build 19044.1503 – Windows Feature Experience Pack 120.2212.4170.0) except for these two
– Target release version for feature updates (set at 21H2)
– Target product version for feature updates (set at 21H2)

Does anyone have a current list of active group policies that you recommend, plus a brief reason why you recommend that specific policy? Thanks

 

 

Reply | Quote

Replies

Three things to start:

Firstly, the computers I manage are still on 21H1, so everything below is based on that, but there aren’t any big changes between 21H1 and 21H2 Group Policies, as far as I know. But apologies in advance if anything is inaccurate or missing.

Secondly, disabling a Group Policy will often actively set something to not happen (or to happen, in some cases), so you don’t want to do this for literally every policy, as you say you have done. For the vast majority of policies you will want to leave them as Not configured.

Thirdly, the “Target product version” that you have set, assuming you are referring to the option under ‘Select the target Feature Update version’, should be set to Windows 10, not 21H2. Windows 10 is the Windows product version, 21H2 is the target version for feature updates.

Here’s a list of Group Policies I recommend for Windows Update:

Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates
(Enabled and set to: 2 – Notify for download and auto install)
(This prevents the automatic installation of updates)

Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates
(Enabled)
(If you prefer to manually update drivers)

Computer Configuration > Administrative Templates > Windows Components > Windows Update -> Windows Update for Business > Manage preview builds
(Enabled and set to Disable preview builds)
(Self-explanatory)

Computer Configuration > Administrative Templates > Windows Components > Windows Update -> Windows Update for Business > Select the target Feature Update version
(Enabled and set to Windows 10 and 21H2)
(This keeps you on Windows 10 and 21H2 respectively)

4 users thanked author for this post.

MrToad28, oldfry, Coldheart9020, DKThompson

Reply | Quote

Brillant, thank you very much!

Reply | Quote

Thank you for the tips and clarification (windows 10 and 21H2) I made all recommended changes (enabled) and ensured all other are settings are set as “Not configured” I misspoke earlier in that none are disabled.

 

1 user thanked author for this post.

Coldheart9020

Reply | Quote

Excellent summary, good job 🙂

Reply | Quote

There is always our KB article.

https://www.askwoody.com/forums/topic/2000016-guide-for-windows-update-settings-for-windows-10/

cheers, Paul

1 user thanked author for this post.

DKThompson

Reply | Quote

Will disabling preview builds block all .NET updates; there seem to be no non-preview .net updates when I use this method to block previews: search Edit Group policy => Computer Configuration > Administrative Templates > Windows Components > Windows Update -> Windows Update for Business > Manage preview builds (Enabled and set to Disable preview builds)

Thanks

Reply | Quote

See #2427699. Includes CU and .NET Previews.

1 user thanked author for this post.

MrToad28

Reply | Quote

Based on my experience, I have suspicions that this setting blocks both preview and non-preview .NET updates with the exception of non-preview security .NET updates. Basically, it seems to treat the non-preview non-security .NET updates as previews. I can’t guarantee that this is accurate, as I’ve not read anything about it, it’s just been my observation.

Reply | Quote