How to skip OOBE Checks for Update? i already make an autounattended.xml also turn off first logon animation on settings toolbar. i dont know what's wrong, i dont disabled windows update on settings toolbar, i dont remove windows components on components toolbar. just make an autounattend and turn off first logon animation.
How to skip OOBE Checks for Update?
- Thread starter Ganggy444
- Start date
Add a single line in the HOSTS file to block sdx.microsoft.com
https://ntlite.com/community/thread...features-and-security-updates.5959/post-55733
https://ntlite.com/community/thread...features-and-security-updates.5959/post-55733
1. Blocking sdx.microsoft.com will allow other MS network traffic to proceed (if you want non-OOBE updates in the background), instead of disabling all traffic. This endpoint is only used by OOBE Autopilot to check for its next steps, including a forced update.
No other services will query sdx.microsoft.com, after OOBE is completed.
2. If you want to trick WU and OOBE that MS is offline, then disable NCSI active probing. On the tail end, re-enable probing.
https://ntlite.com/community/thread...ows-post-setup-using-oobe-cmd.1750/post-41875
The advantage of disabling NSCI probes is this only changes the behavior of MS services. Other apps or services don't bother to check the probe status and will continue to open network sessions. I believe WU is taught to check the probe status instead of endlessly retrying a network connection to MS when it's understood that the network is "unreachable".
This was my original hack to bypass OOBE updates. It allows you run winget or Chocolatey installs without killing the network.
No other services will query sdx.microsoft.com, after OOBE is completed.
2. If you want to trick WU and OOBE that MS is offline, then disable NCSI active probing. On the tail end, re-enable probing.
https://ntlite.com/community/thread...ows-post-setup-using-oobe-cmd.1750/post-41875
The advantage of disabling NSCI probes is this only changes the behavior of MS services. Other apps or services don't bother to check the probe status and will continue to open network sessions. I believe WU is taught to check the probe status instead of endlessly retrying a network connection to MS when it's understood that the network is "unreachable".
This was my original hack to bypass OOBE updates. It allows you run winget or Chocolatey installs without killing the network.
scaramonga
Active Member
- Messages
- 175
- Reaction score
- 46
Yeah, it's irritating, and takes longer than the actual install process.
MS imagines four different paths for a clean install to get the latest Windows Updates.
1. You're installing from the latest 25H2 MCT or MVS ISO (created every month), or from an user-updated ISO.
2. You installed Setup Dynamic Update, so in the beginning of each install it pulls the latest CU from the network and applies it to the image.
3. OOBE runs a mandatory update check. MS promised two years ago we could have a real config to block this, but apparently this only works for domain clients.
4. After the install, WU eventually runs and installs the current CU.
In the first three methods, the user isn't allowed to log on until you have a fully updated Windows. Enterprises with a formal security policy find this very beneficial. Not every IT admin will use Setup DU; you may prefer to refresh an ISO right before you want to install Windows so having Dynamic Update doesn't serve any function.
But with a mandatory OOBE update, MS fulfills a promise to enterprises that users can't touch an unpatched system. The real problem now is every CU includes over 1.25 GB of AI model sets. Which adds more forced delay for unhappy non-enterprise users.
1. You're installing from the latest 25H2 MCT or MVS ISO (created every month), or from an user-updated ISO.
2. You installed Setup Dynamic Update, so in the beginning of each install it pulls the latest CU from the network and applies it to the image.
3. OOBE runs a mandatory update check. MS promised two years ago we could have a real config to block this, but apparently this only works for domain clients.
4. After the install, WU eventually runs and installs the current CU.
In the first three methods, the user isn't allowed to log on until you have a fully updated Windows. Enterprises with a formal security policy find this very beneficial. Not every IT admin will use Setup DU; you may prefer to refresh an ISO right before you want to install Windows so having Dynamic Update doesn't serve any function.
But with a mandatory OOBE update, MS fulfills a promise to enterprises that users can't touch an unpatched system. The real problem now is every CU includes over 1.25 GB of AI model sets. Which adds more forced delay for unhappy non-enterprise users.
Problem Solved by turning on SkipMachineOOBE and SkipUserOOBE on unattended toolbar even tho my pc connected with Internet. Thanks.
- Messages
- 1,299
- Reaction score
- 274
That’s what I do, but I was wondering if there wasn’t an option (Unattended) just for that.
Last edited:
Ahh so I wont need to do this myself anymore then.
Currently I have two post setup commands that add a firewall block rule for TCP/UDP, then late in my post install script internet access is enabled again. But I guess the ntlite method will be able to do it earlier in the setup process.