Starting in mid-2025, Microsoft will empower organizations with the ability to manage how fresh installations of Windows 11 handle cumulative updates right from the outset. This strategic shift is a direct response to feedback from system administrators who expressed concerns over an earlier approach that stripped them of control.
The new policy will be accessible later this year for devices running Windows 11 version 22H2 or newer, enhancing administrators’ authority over the update process during the Out-of-the-Box Experience (OOBE), a term Microsoft uses to describe the initial setup phase.
Initially, Microsoft had intended to mandate the installation of the latest updates upon the first boot. However, this approach raised valid concerns, as certain fixes might fail to function post-update, or critical features could become inoperative. The necessity to validate new versions for specific applications further complicated matters. The myriad issues that often accompany updates—both within and outside of Windows—have led to a well-founded caution among users. Acknowledging this widespread criticism, Microsoft has taken steps to address these concerns.
Also read: Microsoft reassures users: bug in Windows 10 patch is not a problem
Implementation via Windows Autopilot
The new configuration can be seamlessly enabled through Windows Autopilot. Existing settings related to quality updates, including deferral and pause policies, will be synchronized with the device, ensuring that only the most recent approved security updates are presented.
It’s important to note that this change pertains exclusively to cumulative or quality updates, rather than the optional updates that Microsoft releases monthly. With the majority of devices ideally operating on the latest version of Windows 11, this adjustment aims to minimize unnecessary complications during the installation process.
Options for organizations without Autopilot
For organizations that do not utilize Autopilot through Microsoft Intune, there remains the option to disable quality updates during the OOBE phase via Group Policy. This capability will be available as both a mobile device management (MDM) policy and a Group Policy setting. Typically, the update process takes around 20 minutes, although this can vary based on the size of the update, network conditions, and the hardware specifications of the device.
