New Policies in July's Windows Update Client to Stop Windows 10 Upgrades by Normal Users

With the release deadline for Windows 10 looming (July 29), Microsoft is still making changes to the Windows Update client for applicable Windows versions. A new update has released almost monthly, providing new retooling in an effort to allow businesses to stop Windows 10 upgrades by normal users.

The latest update, made available on July 7, is for Windows 7 and Windows Server 2008 R2 Systems and supersedes a previously released update. KB3065987 replaces KB3050265.

A computer that is licensed through an Enterprise SKU will not receive Windows 10 upgrade notifications, nor will the user be able to initiate an upgrade manually. However, even when a Windows 10 Pro system (non-Enterprise SKU) is domain-joined, the end-user could still manually start a Windows 10 upgrade if the proper upgrade updates are installed.

KB3065987 includes a new Windows Update policy file (ADMX) that is designed to stop this from happening. It effectively blocks regular Windows 10 Pro users from being able to upgrade their system.

One big note, though, is that if the user has admin rights, all bets are off. With admin rights, the user can still perform their own upgrade by downloading provided Windows 10 media doing their own installation. But, hopefully you already knew that giving regular users local admin rights creates the biggest management headaches and security holes in any organization.

Once you have this update and have the ADMX imported, look for the Turn off the upgrade to the latest version of Windows through Windows Update policy.

An update is also available for Windows 8.1 and Windows Server 2012 R2 systems.