Windows Update for Business (WUfB) target product version configuration policy failing to halt Windows 11 upgrades

Hi Emilia Weber,

The unexpected upgrades to Windows 11 happened for one of two reasons: either a registry configuration omission or a policy conflict in Intune.

First, for the upgrade block to work, the local registry keys at HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate must specify both the target version as 22H2 and the product version explicitly as Windows 10. If the product version field was left blank in your Intune policy, the local update agent naturally looked for the highest available matching release, which allowed Windows 11 version 22H2 to install.

Second, this behavior can be triggered by policy precedence. Explicit deployments created within the Feature Updates for Windows 10 and Later node override standard settings catalogs or device restriction profiles. If a Windows 11 feature update was accidentally deployed to a broad group like "All Devices," it would override your Windows 10 cap. To fix this, audit your Intune Feature Update deployments for overlapping group assignments and ensure your primary restriction policy explicitly defines Windows 10 alongside the 22H2 release info.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN