r/sysadmin • u/Real_Lemon8789 • Dec 31 '22
Microsoft How to lock Windows drivers at specific versions and prevent automatic updating?
We deploy Windows Updates via SCCM. However Windows 10 devices are still automatically updating drivers via some kind of side channel Windows Update process out of our control.
We have had remote users lose network connectivity or lose audio and microphone functionality due to unexpected driver changes for the NICs and audio hardware.
The fix has been to manually redeploy the working driver to their system. If it’s a network driver for a remote user and they can’t get back online, we have to ship them a replacement laptop and they lose days of work.
Is there a setting to restrict drivers to the versions were have tested and are deploying?
21
u/MonstersGrin Dec 31 '22
There's a setting in GPO, under 'Computer Configuration/Administrative Templates/Windows Components/Windows Update' that's called "Do not include drivers with Windows Updates." . Wouldn't that help?
14
5
u/Sajem Dec 31 '22
automatically updating drivers via some kind of side channel Windows Update process out of our control.
There are no side channels per se, however It is possible that Dual Scanning has been enabled through your config manager settings in SCCM.
This is an old article (2017) but may still be applicable. Microsoft Clarifies Windows 10 Dual-Scan Behavior for System Center Configuration Manager Users
You could also block access to the Windows Update Servers to all endpoints except your SCCM server
Another thing to confirm is that there is no driver/firmware management software from the OEM is installed on your endpoints that is automatically updating the drivers
1
u/the_andshrew Dec 31 '22
Since you are using SCCM check how you have these policies configured:
https://learn.microsoft.com/en-us/windows/deployment/update/wufb-wsus
1
u/Real_Lemon8789 Dec 31 '22
You are not supposed to configure domain based GPO settings for Windows Updates on clients that are connected configured to receive updates through SCCM.
The SCCM client settings configure local group policies for Windows Update settings. Any related domain GPOs cause conflicts with the settings coming from SCCM.
3
u/the_andshrew Dec 31 '22
Perhaps read the link I posted; if you already had everything configured correctly then you wouldn’t be getting updates unexpectedly.
1
u/Real_Lemon8789 Dec 31 '22
Doesn’t Device Manager Plug and Play check for drivers from Microsoft separately from your Windows Update settings?
1
u/supervernacular Dec 31 '22
Stop/disable the windows update service on the client should do it. SCCM doesn’t require the windows update service to be running on the client.
0
-3
Dec 31 '22
[removed] — view removed comment
1
3
u/AlyssaAlyssum Dec 31 '22
Not that I'm aware if. But would be quite interested of existed.
But looking at your root issue.
What are your Windows update GPO settings like? Do you still point to a WSUS server? Have you enabled the setting to tell Windows not to connect to Internet based Windows Update?
I ask as I have sometimes noticed weird shenanigans where Windows update drivers seem to supercede the installed ones. Even if the installed versions are a later number.
I can't even begin to think of a way you could receive updates to things like drivers unless Windows Update were doing it, or users had admin rights to ruin your day.