Home / server / Questions / 766194
Accepted
Tedwin
Asked: 2016-03-26 18:24:17 +0800 CST

Windows domain - remove Win 10 Offer via GP

  • 772

I'm struggling to remove the "Upgrade to Windows 10" Notification Area Icon on a bunch of Win 7 Pro machines on a 2008 R2 domain. No WSUS server.

I've tried enabling "Turn off the upgrade to the latest version..." setting in my domain's Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update, then gpupdating on my own PC to test. Restart. Update gp again. Restart. The icon is still there.

I need to install WSUS - it's a rainy day project that I've been planning on for a while. But it's sunny right now and I have more important shit to triage.

Any ideas? Thanks!

Edit: this question is not a duplicate, because these hosts are all part of a domain. It's fundamentally a very different situation.

I'm looking for a GP-style fix; registry hacks one at a time on individuals' PCs are not something I have time to do.

windows

1 Answers

  1. Best Answer

    The Group Policy Setting inhibits the upgrade from actually happening. If you click the upgrade icon, you will get a message that the administrator has disabled upgrades. The setting does not kill the offer program (GWX.exe) if it is already running.

    The official supported method for opting out of the Windows 10 upgrade is documented here: https://support.microsoft.com/en-us/kb/3080351

    Here is what I did in my environment, based on the KB article.

    I set the following registry values:

    HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DisableOSUpgrade=0x1 (DWORD)
HKLM:\SOFTWARE\Policies\Microsoft\Windows\Gwx DisableGwx=0x1 (DWORD)
HKLM:\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade ReservationsAllowed=0x0 (DWORD)

    You can set the above with Group Policy Preferences. In my environment I have a set of PowerShell scripts that run periodically on our workstations, so I added it there. The exact method is up to you. Either way, I recommend that you use a recurring method to apply the registry setting (Group Policy, Startup Script, Scheduled Task, whatever) and not a one-shot command. It is possible that a future update may reset your registry settings and cause havoc.

    The first value I listed corresponds to the Group Policy setting you mentioned. The registry values used by Group Policy are documented here: https://www.microsoft.com/en-us/download/details.aspx?id=25250

    Note the third one is not documented by Microsoft anymore. I believe it was documented at one point (my script comments say it came from Microsoft), but I cannot find the source. Not sure if it is need anymore.

    Additionally, you have to problem of any PCs that already have the upgrade offer icon (GWX.exe is running). You need a Scheduled Task or similar to find and kill any instances of GWX.exe. Since I already have a periodic PowerShell script in place, I added this code to it:

    $processes = Get-Process | Where-Object {$_.Path -like "C:\Windows\System32\GWX\*.exe"}

if($processes)
{
    $processes | Stop-Process -Force
}

    As an alternative, you could use Group Policy to create a Scheduled Task that uses the TASKKILL command to achieve the same thing.

    One other comment: Some people have been advocating declining the security updates that include the upgrade offer. I do not recommend this. If you follow what I have listed above, you do not need to worry about what you approve in WSUS.

    • 4