How to bypass Windows 10 Upgrade Blocks (Safeguard holds)

Windows 10 administrators may enable policies on devices to bypass upgrade blocks that prevent the device from being offered feature updates.

Upgrade blocks, or Safeguard holds as Microsoft calls them, are designed to prevent devices from being upgraded to a new version of Windows 10 because of known compatibility issues in that new version.

While it is usually a good idea to keep a device on a previous version until the issues it is affected by are resolved, issues may be minor sometimes for getting work done on the machine. Microsoft recommends disabling the blocks only for testing and validation purposes, as “opting out of a safeguard hold can put devices at risk from known performance issues”.

Administrators may also use the Release Preview channel to test and validate upcoming versions of Windows 10.

In any event, disabling Safeguard holds does not guarantee that an update will go through. Issues may prevent successful installations of new feature updates, and removing the blocks will do nothing to resolve these.

How to disable the Safeguard Hold on a Windows 10 machine

The requirements are a system with at least Windows 10 version 1809 and the October 2020 security update installed on the system.

1. Use the keyboard shortcut Windows-R to open the Run box.
2. Type gpedit.msc and select OK. If you are not signed-in with an administrator account, hold down Ctrl and Shift before you click on OK, and type the administrator password when prompted to do so.
3. Go to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business.
4. Locate “Disable safeguards for Feature Updates” and double-click on the entry.
5. Set it to Enabled.
6. Click OK.
7. Close the Group Policy Editor.

Here is the description of the policy

Enable this setting when Feature Updates should be deployed to devices without blocking on any safeguard holds. Safeguard holds are known compatibility issues that block the upgrade from being deployed to affected devices until the issue is resolved. Enabling this policy can allow an organization to deploy the Feature Update to devices for testing, or to deploy the Feature Update without blocking on safeguard holds.

It is furthermore possible to bypass the update block by adding a Dword to the Registry instead.

1. Open the Run box with the shortcut Windows-R.
2. Type regedit.exe and select ok.
3. Confirm the UAC prompt.
4. Go to HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate.
   1. If one of the keys does not exist, right-click on the previous one and select New >Key, and name it accordingly.
5. Right-click on WindowsUpdate and select New > Dword (32-bit) Value.
6. Name it DisableWUfBSafeguards.
7. Set its value to 1.
8. Restart the PC.

Note that the successful installation of a feature update will reset the value automatically, and that it needs to be set again.

(via Born)