Steps to block the ‘Upgrade to Windows 11’ notification in Windows 10 systems.

Since the release of Windows 11, Microsoft has aggressively pushed upgrade notifications to eligible Windows 10 systems. While this makes sense from Microsoft’s perspective, it often clashes with enterprise reality.

In the real world, many organisations:

• Run line-of-business applications not certified for Windows 11
• Depend on legacy drivers or hardware
• Require stable OS baselines for compliance or audit reasons
• Operate in regulated industries where OS upgrades must be formally tested

As an IT professional, you may want Windows 11 eventually—but on your terms, not when Microsoft decides it’s time.

This article walks through supported, repeatable, enterprise-safe methods to block the Windows 11 upgrade notification on Windows 10 systems, with context on:

• Why these settings work
• When they stop working
• How Microsoft enforces feature upgrades
• What to plan for as Windows 10 approaches end of support

Understanding Microsoft’s Upgrade Mechanism

Before touching the registry, it’s important to understand how Windows Update decides what to offer.

Windows uses:

• ProductVersion (Windows 10 vs Windows 11)
• TargetReleaseVersion
• TargetReleaseVersionInfo

These settings are officially recognised by Microsoft and documented for enterprise servicing control. They are not hacks—they are the same controls used by Group Policy and MDM solutions.

When configured correctly:

• Windows Update will not offer Windows 11
• Feature upgrades will remain pinned to a specific Windows 10 release
• Security and quality updates continue normally

Method 1: Block the Windows 11 Upgrade Using the Registry (Manual or Scripted)

This method is ideal for:

• Small environments
• Lab testing
• Golden image preparation
• Script-based deployments (PowerShell, SCCM, Intune remediation)

Registry Path

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

If the WindowsUpdate key does not exist, you must create it.

Required Registry Values

1. TargetReleaseVersion (DWORD)

• Value Name: TargetReleaseVersion
• Type: REG_DWORD
• Value: 1

This tells Windows Update to respect the specified target version.

2. ProductVersion (String)

• Value Name: ProductVersion
• Type: REG_SZ
• Value: Windows 10

This explicitly locks the OS family.

3. TargetReleaseVersionInfo (String)

• Value Name: TargetReleaseVersionInfo
• Type: REG_SZ
• Value: 21H2 or 22H2

This defines the maximum Windows 10 feature version allowed.

Real-world recommendation:
For most enterprises today, 22H2 is the correct choice unless you have application compatibility constraints.

Why This Works

Microsoft’s update engine checks these values before presenting feature upgrades. If Windows 11 is outside the defined product/version boundary, the upgrade offer is suppressed entirely—including notifications.

Method 2: Blocking Windows 11 via Endpoint Management (Desktop Central / RMM / MDM)

In managed environments, manual registry edits don’t scale. This is where endpoint configuration platforms shine.

The example below uses Desktop Central, but the same logic applies to:

• Intune
• SCCM
• Group Policy Preferences
• RMM tools

Registry Configuration Details

Configuration 1

• Header Key: HKEY_LOCAL_MACHINE
• Sub-Key: Software\Policies\Microsoft\Windows\WindowsUpdate
• Data Type: REG_DWORD
• Value Name: TargetReleaseVersion
• Value Data: 1

Configuration 2

• Header Key: HKEY_LOCAL_MACHINE
• Sub-Key: Software\Policies\Microsoft\Windows\WindowsUpdate
• Data Type: REG_SZ
• Value Name: TargetReleaseVersionInfo
• Value Data: 21H2 or 22H2

Configuration 3

• Header Key: HKEY_LOCAL_MACHINE
• Sub-Key: Software\Policies\Microsoft\Windows\WindowsUpdate
• Data Type: REG_SZ
• Value Name: ProductVersion
• Value Data: Windows 10

Deploy the configuration to target machines and enforce compliance.

Enterprise Insight

In real deployments, I strongly recommend:

• Enforcing these settings (not just applying once)
• Pairing with a detection rule
• Logging drift for audit visibility

Microsoft has been known to reset Windows Update–related keys during major servicing events.

What This Does Not Block

It’s important to set expectations with stakeholders.

This configuration:

• ✅ Blocks Windows 11 upgrade prompts
• ✅ Prevents accidental OS upgrades
• ✅ Allows security updates to continue

It does not:

• Block Windows 10 feature upgrades forever
• Prevent Microsoft from enforcing upgrades when a version reaches end of support
• Replace lifecycle planning

Windows 10 Lifecycle Reality Check

Microsoft will force a feature upgrade once your pinned Windows 10 version reaches end of servicing.

For example:

• Windows 10 21H2 → End of servicing
• Windows Update will override TargetReleaseVersionInfo
• Devices will move to a supported Windows 10 version automatically

Best practice:
Review and update TargetReleaseVersionInfo annually as part of your OS servicing cycle.

Security and Compliance Considerations

From a security perspective, blocking Windows 11 is not inherently risky—as long as:

• The Windows 10 version is still supported
• Monthly security patches are applied
• Endpoint protection remains compliant

Auditors care about supportability, not whether you’re on the latest UI refresh.

Recommended Enterprise Strategy

Based on real-world experience, the most stable approach is:

1. Pin Windows 10 to 22H2
2. Suppress Windows 11 notifications
3. Pilot Windows 11 separately
4. Validate applications and drivers
5. Plan a controlled migration—not a reactive one

This avoids disruption while keeping leadership comfortable with a clear roadmap.

Final Thoughts: Blocking Windows 11 Is About Control, Not Resistance

Blocking the Windows 11 upgrade isn’t about avoiding progress—it’s about maintaining operational stability.

Microsoft optimises for consumers.
Enterprise IT optimises for:

• Predictability
• Compatibility
• Risk reduction

Used correctly, TargetReleaseVersion settings give you back control of your Windows servicing strategy—without breaking support boundaries or resorting to unsupported hacks.

In my experience, environments that take this proactive approach experience fewer outages, fewer emergency rollbacks, and far less user frustration.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.