The Windows 11 ‘push,’ revisited

In November, I wrote about several people who reported they’d been pushed Windows 11. (At the time, I wasn’t sure why they found themselves with Windows 11 installed — and they weren’t sure why either. )

Since then, I’ve had other people reach out and credibly relate how they came back to find their computer either wanting a reboot or already running Windows 11. They said they had not accepted or requested the upgrade. At the same time, I can’t independently verify this behavior. In my testing, I use a Windows 10 machine with the built-in Microsoft Defender. I can’t prove that Microsoft is pushing Windows 11 to users, and I can’t prove it’s not. My suspicion now is that something third-party is triggering the install request. I’ve seen several reports in online forums, in posts, and on social media, but I have yet to replicate it on a computer under my control.

I’m reminded of when most users were running Windows 7 and Office was primarily sold and deployed with individual patches (rather than click-to-run background patching). You would reach the end of the Office install routine and get two questions: Do you want to patch it (switch Windows Update to Microsoft Update in the background — effectively agreeing to install patches for more than just Windows)? And do you want Microsoft to keep Office up to date?

If you said yes, not only would the computer install Office updates automatically, it would install all updates automatically. The next Patch Tuesday would arrive — and Windows Updates would be installed (to the dismay of users who specifically didn’t want that to happen). Users were convinced Microsoft had changed their settings without their consent, even though they had done so by saying yes to those two questions.

I’ve also seen antivirus vendors ask the question after their software is installed: “Do you want to keep your operating system up to date?” If you say yes, Windows updates install automatically. Because there’s no log file I’m aware of showing who or what is saying, “Yes,” to the Windows 11 approval process, I can’t definitely say who or what is approving it. But history leads me to believe something is.

For those with Windows 11-eligible devices managed by Intune or registered with Windows Software Update Services – any of the ways Microsoft deems are “managed” devices – you will not be offered the new OS. You need to take affirmative action to install Windows 11. But if you get your updates from Microsoft Update, you’re subject to Windows 11 being offered.

Remember, if you want to block the install, you can do so with a registry key for Windows 10 Home or with local group policy for Windows 10 Professional. Even if you defer Windows 11 in the graphical interface, you’ll be offered it again. The deferral is not permanent unless you use a group policy or registry key.

Bottom line: My recommendation is to decide if you do — or do not — want Windows 11 on your hardware. Microsoft is now in broad release of the operating system, which means it should be offered up to any machine that can run it. So, if you don’t want Windows 11, use the registry keys or local group policy methods to ensure you stay on Windows 10. Note this will only block Windows 11; it does not stop Windows 10 from receiving updates or future feature releases. Since I can’t guarantee you won’t get Windows 11 otherwise, it truly is the safest way to avoid the update. And it will ensure that you are in control of the decision.

And finally, remember, there are ways to roll back from Windows 11 to 10 if you act in a timely way.