This tutorial will show you how to enable or disable safeguard holds for feature updates in Windows 10 and Windows 11.
Feature updates are new versions of Windows that are released via Windows Update twice a year usually around spring and fall.
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When Microsoft finds such an issue, Microsoft might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. Microsoft also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
Safeguard holds prevent a device with a known issue from being offered a new operating system version. Microsoft renews the offering once a fix is found and verified. Microsoft use holds to ensure customers have a successful experience as their device moves to a new version of Windows client.
On devices that use Windows Update (but not Windows Update for Business), the Windows Update page in the Settings app displays a message stating that a feature update is on its way, but not ready for the device. Instead of the option to download and install the feature update, users will see a "Learn more" message. If you see this message, it means one or more holds affect your device.
The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. Microsoft monitors quality and compatibility data to confirm that a fix is complete before releasing the hold. Once Microsoft releases the hold, Windows Update will resume offering new operating system versions to devices.
References:
Windows Update for Business reports overview - Windows Update for Business reports
Safeguard holds for Windows
Opt out of safeguard holds
If wanted, you can enable the Disable safeguards for Feature Updates Group Policy to allow Feature Updates without blocking on any safeguard holds.
Opting out of a safeguard hold can put devices at risk from known performance issues.
Microsoft recommends opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business.
Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues.
You must be signed in as an administrator to enable or disable safeguards for feature updates.
After a device installs a new Windows version, the Disable safeguards for Feature Updates Group Policy will automatically revert to “not configured” (aka: safeguards enabled) even if it was previously enabled (aka: safeguards disabled). Microsoft does this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
- Option One: Enable or Disable Safeguards for Feature Updates in Local Group Policy Editor
- Option Two: Enable or Disable Safeguards for Feature Updates using REG File
The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.
All editions can use Option Two.
1 Open the Local Group Policy Editor (gpedit.msc).
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)
3 In the right pane of Manage updates offered from Windows Updates in the Local Group Policy Editor, double click/tap on the Disable safeguards for Feature Updates policy to edit it. (see screenshot above)
4 Do step 5 (enable) or step 6 (disable) below for what you would like to do.
This is the default setting.
7 You can now close the Local Group Policy Editor if you like.
1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.
This is the default setting.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableWUfBSafeguards"=-(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableWUfBSafeguards"=dword:000000014 Save the .reg file to your desktop.
5 Double click/tap on the downloaded .reg file to merge it.
6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
7 Restart the computer to apply.
8 You could now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
