Windows 10: Block Windows 11 update in Intune

Hello,I recently set up some Policies and an Update Ring in Intune regarding to Windows Updates. I set the Target to 21H2, blocked the update to Windows 11 option, and created a Feature update ring also to 21H2. Today 2 of our devices updated to Windows 11. What options we need to add or alter to prevent updating to Windows 11?Thank you in advance,Adam

:)

 

Intune managed laptop updated to windows 11

Hi,

we currently have 1000+ managed devices in intune with a lock on the update to windows 11 so we can manually decide when we're ready to upgrade our environment to windows 11. However,2 of our laptops automatically updated to windows 11. I have contacted the users of these devices and they said they had nothing to do with the update to windows 11. I currently have one of these laptops in my possession. Is there a way to troubleshoot the laptop to find out why it updated to windows 11? Or do you know a reason why it could have happened?

Thanks in advance!

 

INTUNE -

Hi All,

We are moving towards the modern management and deploying apps via INTUNE and i have a request to create an Applocker policy to disable %SYSTEM32%\Windows\PowerShell\* for all users and exclude administrators.

Question is if i block powershell, will the powershell Win32 apps and script deployed via INTUNE will also be blocked ?

 

Intune - Windows 11 Readiness - "System firmware"

I'm looking at the "Windows 11 Readiness" report in the Intune - Endpoint Analytics - Work from Anywhere section.

One of the reasons shown that a computer is not compatible with Windows 11 is "System firmware".

I understand what the "CPU family" and "TPM" reasons are referring to for why a computer isn't compatible with Windows 11, but what does the "System firmware" mean?

At first I thought maybe it meant a computer needed the BIOS to be updated to a newer version, but I've tested and proven that not to be the case. So then I thought maybe it was telling me a computer doesn't support 'Secure Boot', but that too is not the case, because when I run the "hardwarereadiness.ps1" script, it shows the Secure Boot is fine on a computer that Intune has flagged this "system firmware" as an issue.

As it stands, I can't figure out a reason why a computer Intune says isn't compatible due to "system firmware" truly can't run Windows 11, because the computers seem to run it fine in my testing. So what is Intune trying to tell me regarding the "system firmware" reason in the Window 11 readiness report?