Over the weekend I heard howls from folks who are being pushed onto the latest version of Windows 10 — the Creators Update, version 1703 — when they had specifically told Win10 Anniversary Update — version 1607 — to “Defer feature updates.” If you thought the “Defer feature updates” setting would permanently protect you from pushed version changes, you’re mistaken. Here’s what happened, and what you can do about it.
Those of you experiencing forced updates even on machines attached to a WSUS server, read on...
As I explained back in April, folks with Windows 10 Anniversary Update Pro or Enterprise can click Settings > Update & security > Advanced options, then check the box marked “Defer feature updates” (see screenshot).
Woody Leonhard/IDG The 'Defer feature updates' window in Windows 10
Doing so puts you on the “Current Branch for Business.” Unfortunately, the “Current Branch for Business” terminology has gone through two — not one, but two — re-definitions since April. There is no Current Branch for Business anymore. And that’s at the crux of the problem.
On July 27, Microsoft declared that the Creators Update had passed its unpaid beta-testing phase and was now ready for deployment to business machines. Gregg Keizer covered that event in a July 27 Computerworld post. I had a somewhat more jaundiced view on the AskWoody website.
While it isn't explicit in the "Defer feature updates" setting, that christening started the massive override.
The terminology changed, first in May, and then last week. This event, which we would’ve called moving 1703 from “Current Branch” to “Current Branch for Business” just a few weeks ago, is now represented by a tiny “Microsoft recommends” bullet on the Windows 10 release information page (see screenshot).
Woody LeonhardNow that Microsoft, uh, recommends version 1703 build 15063.483, your “Defer feature updates” setting has expired, and you’re getting the business-ready version of Win10 Creators Update. (This, despite the fact that there’s a massive batch of bug fixes waiting in the wings for 1703.)
There is no "Current Branch for Business" anymore, but that "Microsoft recommends" bullet applies in its stead. If you were deferring updates, your deferral just ran out (see screenshot).
Woody LeonhardAt this point, if you have Creators Update (here it's called “Feature update to Windows 10, version 1703”) stuck in your “Updates are available” box, you can block it using the wushowhide tool. To run the 1990s-era tool, follow the steps in this article.
If version 1703 is already installed and awaiting a reboot to activate, go ahead and reboot (and wait, and wait, and wait). When your machine comes back up for air, log on to Windows with an administrator account, click Settings > Update & security > Recovery, and under the heading "Go back to an earlier build," click Get Started. With any luck that’ll put you back in the Anniversary Update, version 1607. You’ll need to check and make triply sure the round trip hasn’t destroyed any of your settings. (Hint: It will.) Once you’re back on 1607, you need to run wushowhide to keep 1703 at bay.
If version 1703 hasn’t yet darkened your door and you want to keep it away, try switching to a metered connection.
I have a special note for those of you who are trying to keep 1703 from deploying on a WSUS-controlled network. There’s a lengthy discussion on the patchmanagement.org mailing list, but one of the warnings I found surprising goes like this: If you have “Defer feature updates” checked on your machines, that setting triggers a dual-scan mode, where those machines will look for updates both through WSUS and directly through Windows Update — even if they are behind WSUS. Please join Susan Bradley's patchmanagement mailing list for further, important details.
Welcome to Windows as a Service.
Discussion continues on the AskWoody Lounge. No swearing, please.