News

Microsoft Explains How IT Pros Can View Windows 10 'Safeguard Holds'

• By Kurt Mackie
• 10/26/2020

Microsoft last week explained that IT pros can use an Update Compliance application addition to the Azure Portal to tell when Windows 10 feature updates get blocked.

It turns out that Microsoft has a name for these OS blocks, namely "safeguard holds." It's possible for IT pros to run a couple of queries using an Update Compliance application in the Azure Portal to see these safeguard holds in chart form, although there's a requirement to be using the Windows Update service to get Windows 10 feature updates.

Here's how that latter notion was expressed by the announcement:

Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services (WSUS) to remain aware of known issues that might also be present in their environments.

In other words, users of Microsoft's free WSUS solution, or possibly other update management solutions, are going to need to check something like Microsoft's Message Center Portal to find "known issues" associated with a Windows 10 feature update, which is a way of deducing that a feature update may have gotten blocked. There's also a public Message Center page, but it lacks an RSS feed to get timely notifications.

Tied to Azure Log Analytics
Update Compliance is a downloadable app from the Azure Marketplace, but organizations will need an Azure subscription that includes Log Analytics to use it.

"Update Compliance is offered as an Azure Marketplace application which is linked to a new or existing Azure Log Analytics workspace within your Azure subscription," Microsoft explained in this "Update Compliance" document.

The pricing to use Azure Log Analytics can be found at this Azure Monitor pricing page.

Microsoft's Feature Update Blocking Approach
Microsoft may impose a safeguard hold on a Windows 10 feature update when there are known issues associated with a device. Those issues could include problems with drivers built by other software companies or hardware incompatibilities. In the latter two cases, the names of those "third-party" companies don't usually get disclosed, according to the announcement:

When a safeguard is the result of third-party software or hardware incompatibilities, Microsoft is subject to confidentiality requirements. Only in certain circumstances are we authorized to disclose original equipment manufacturer-driven holds.

To check if Windows 10 PCs are feature-update-ready, so-called "telemetry" data gets gathered from PCs. A machine learning process is then used to determine the OS upgrade readiness state. If a Windows 10 PC isn't ready for a feature update, then Microsoft blocks the update from initiating with a safeguard hold.

A feature update is actually a new Windows 10 operating system. It replaces the old OS bits via an "in-place upgrade" method, which can happen in an automated way using the Windows Update service. While an in-place upgrade is an easier way to change out the OS bits than the old "wipe-and-replace" manual installation method, things still can go wrong.

Microsoft expects IT pros to test new feature updates first with a small group of users before deploying more broadly.