The scripts in this library come from a variety of sources, including partners and other third parties. While N-able performs initial testing on these scripts, we do not regularly or permanently monitor these scripts, and therefore, we cannot make any guarantees about third-party content. By downloading or using any of these scripts, you agree that they are provided AS IS without warranty of any kind and we expressly disclaim all implied warranties including warranties of merchantability or of fitness for a particular purpose. In no event shall N-able or any other party be liable for any damages arising out of the use of or inability to use these scripts.

N-able suggests as a best practice that scripts should be tested on non-production environments.

Opt out of Safeguard Holds in Windows Update

Last Modified Date

2/17/2021 1:57 PM

Description

Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows 10 feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see this article from Microsoft: https://docs.microsoft.com/en-us/windows/deployment/update/safeguard-opt-out


In a recent cumulative update from Microsoft they added a new capability to disable the Safeguard Holds that Microsoft puts in place on an endpoint. These two amps can be use dot disable or enable the Safeguard Holds. Created this since it comes up often in conversations around Patch Management why some endpoints don’t show they qualify for a Feature Update while other endpoints do. 

"Enable this setting when Feature Updates should be deployed to devices without blocking on any safeguard holds. Safeguard holds are known compatibility issues that block the upgrade from being deployed to affected devices until the issue is resolved. Enabling this policy can allow an organization to deploy the Feature Update to devices for testing, or to deploy the Feature Update without blocking on safeguard holds."

"Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out,"
 

Type

Automation Policy

Category

Windows Configuration

Target OS

Windows 8/8.1;Windows 10;Windows Server 2012 / 2012R2;Windows Server 2016;Windows Server 2019

Compatible with N-central

Yes

N-central minimum version

12.3

Compatible with RMM

Yes

Syntax

This policy has been created by Lewis Pope from the Sales Engineering team at N-able. 


If run, it will enable the registry flag to opt out safeguard holds.
Note that another article exists in the automation cookbook to opt back in to safeguard holds.

Output

the script does not produce any usable output

Keywords

Sales Engineering, Lewis Pope, safeguard holds, windows update, registry, windows 10, feature update

Related Content