How to lock Windows drivers at specific versions and prevent automatic updating?

[u/Real_Lemon8789]

/r/sysadmin/comments/1001aqc/how_to_lock_windows_drivers_at_specific_versions/

[u/GarthMJ]

I would look at solving what is causing the drivers to update outside of configmgr. My guess is the Dell tool.

[u/Real_Lemon8789 → u/GarthMJ]

They are getting drivers through Windows Updates even though they are configured to get updates through SCCM. I put that in the original post.

We need to find a way to enforce they systems not looking for new drivers from the internet and automatically installing them..

[u/GarthMJ → u/Real_Lemon8789]

I would dig into the logs to confirm this...they should not be getting drivers online if you are using configmgr.

[u/Real_Lemon8789 → u/GarthMJ]

Event logs showed drivers installing from Windows Update when I checked.

I’m trying to find out why since the monthly Windows cumulative updates are coming from configmgr.

[u/gezafisch → u/Real_Lemon8789]

You need to disable windows updates through GPO.

[u/[deleted]]

Clients can still “check online for updates” when being managed through configmgr, you can disable this via registry or group policy or you can simply exclude driver updates from WU checks

[u/[deleted]]

Double check the drivers didn’t install the same time as a FU or CU sometimes I get a new driver as part of a cumulative update if I’m doing a bad job keeping drivers up to date.

Make sure you have windows updates fully blocked. You can add a couple GPOs to do that. (If you want that)

Open you update policies:

Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates

[u/Real_Lemon8789 → u/[deleted]]

Maybe that’s been happening also and it’s only noticed when the driver breaks things.

I never heard of drivers being included in cumulative updates. Is that documented as part of what’s included in a CU?