News

IT Pros Can Now View Which Windows 10 Feature Updates Get Blocked

• By Kurt Mackie
• 10/26/2020

Microsoft recently a described a mechanism that lets IT pros view Windows 10 "safeguard holds," which is Microsoft's term for OS feature updates that have been blocked from downloading.

According to the company, IT pros can run a couple of queries using an Update Compliance application in the Azure Portal to see these safeguard holds in chart form, although there's a requirement to be using the Windows Update service to get Windows 10 feature updates. Here's how that latter notion was expressed by the announcement:

Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services (WSUS) to remain aware of known issues that might also be present in their environments.

In other words, users of Microsoft's free WSUS solution, or possibly other update management solutions, are going to need to check something like Microsoft's Message Center Portal to find "known issues" associated with a Windows 10 feature update, which is a way of deducing that a feature update may have gotten blocked. There's also a public Message Center page, but it lacks an RSS feed to get timely notifications.

Tied to Azure Log Analytics
Update Compliance is a downloadable app from the Azure Marketplace, but organizations will need an Azure subscription that includes Log Analytics to use it.

"Update Compliance is offered as an Azure Marketplace application which is linked to a new or existing Azure Log Analytics workspace within your Azure subscription," Microsoft explained in this "Update Compliance" document.

The pricing to use Azure Log Analytics can be found at this Azure Monitor pricing page.

Microsoft's Feature Update Blocking Approach
Microsoft may impose a safeguard hold on a Windows 10 feature update when there are known issues associated with a device. Those issues could include problems with drivers built by other software companies or hardware incompatibilities. In the latter two cases, the names of those "third-party" companies don't usually get disclosed, according to the announcement:

When a safeguard is the result of third-party software or hardware incompatibilities, Microsoft is subject to confidentiality requirements. Only in certain circumstances are we authorized to disclose original equipment manufacturer-driven holds.

To check if Windows 10 PCs are feature-update-ready, so-called "telemetry" data gets gathered from PCs. A machine learning process is then used to determine the OS upgrade readiness state. If a Windows 10 PC isn't ready for a feature update, then Microsoft blocks the update from initiating with a safeguard hold.

A feature update is actually a new Windows 10 operating system. It replaces the old OS bits via an "in-place upgrade" method, which can happen in an automated way using the Windows Update service. While an in-place upgrade is an easier way to change out the OS bits than the old "wipe-and-replace" manual installation method, things still can go wrong.

Microsoft expects IT pros to test new feature updates first with a small group of users before deploying more broadly.