What a “Safeguard Hold” Is and How to See If You Have One

30 Jul 2026
What a “Safeguard Hold” Is and How to See If You Have One

You open Settings > Windows Update, select Check for updates, and expect to see the latest Windows 11 feature update.

Instead, Windows says the update is coming soon, is on its way or is not yet ready for your device.

Another computer in the office has already upgraded. Yours meets the hardware requirements, has enough storage and continues receiving normal monthly security updates—but the new Windows version is nowhere to be found.

Your PC may be protected by a safeguard hold.

A safeguard hold is not an update error. It is a compatibility block applied by Microsoft to prevent a particular Windows feature update from being offered to devices that may encounter a known problem.

The issue could involve:

  • A hardware model
  • A device driver
  • A particular application
  • Firmware
  • An audio, graphics or storage component
  • A Windows configuration
  • A combination of software and hardware

Microsoft uses safeguard holds to avoid delivering a feature update where the upgrade may fail or leave the device with poor performance, crashes or lost functionality. Once the underlying issue has been fixed and the solution verified, Microsoft removes the hold and Windows Update can offer the feature update normally. 

What Is a Windows Feature Update?

Safeguard holds primarily concern feature updates—upgrades that move Windows to another major release.

Examples include moving between versions such as:

Windows 11 24H2 → Windows 11 25H2

or:

Windows 11 25H2 → Windows 11 26H1

A feature update changes far more than a normal monthly update. It may replace or migrate:

  • Windows system components
  • Drivers
  • Applications
  • User profiles
  • Settings
  • Recovery tools
  • Boot files
  • Security features

Microsoft currently maintains separate known-issue and release-information pages for supported releases including Windows 11 versions 24H2, 25H2 and 26H1. 

A quality update, by contrast, is normally a monthly cumulative security and reliability update that keeps the computer on the same broad Windows release.

Seeing monthly security updates install successfully does not prove that the PC is ready for the next feature update.

Why Microsoft Applies Safeguard Holds

Before and during a Windows rollout, Microsoft receives compatibility and reliability information from devices, application developers and hardware manufacturers.

A safeguard hold may be created when a particular combination is associated with problems such as:

  • Blue-screen errors
  • Failed upgrades and rollbacks
  • Audio stopping
  • Displays becoming blank
  • Fingerprint readers failing
  • Applications becoming incompatible
  • Poor performance
  • Network or Bluetooth failures
  • Boot problems
  • Data or configuration risks

The hold targets affected configurations rather than stopping the feature update for every Windows computer.

Two identical-looking laptops may therefore receive the update at different times because they contain different:

  • Driver versions
  • Firmware revisions
  • Applications
  • Hardware components
  • Security products
  • Update policies

Microsoft publicly explains safeguard holds when an issue is broadly applied and can be disclosed. Details involving third-party software, drivers or devices may sometimes be limited because Microsoft is not always authorised to publish the underlying third-party information. 

A Safeguard Hold Is Usually a Good Thing

It can be frustrating to watch another computer receive a new Windows version while yours waits.

However, the hold may be preventing:

  • A failed installation
  • A rollback loop
  • Loss of an important device function
  • Repeated blue screens
  • Application compatibility problems
  • Extended business downtime

The feature update is not being withheld because your PC has been forgotten.

Windows Update has identified that the current combination of hardware, drivers or software may not have a reliable upgrade experience.

Microsoft recommends that users do not force a feature update while a safeguard hold remains active. 

How a Safeguard Hold Appears in Windows Update

Open:

Settings > Windows Update

Select:

Check for updates

On an unmanaged personal device, Windows may display wording similar to:

  • The update is on its way.
  • The update is coming soon.
  • Once it is ready for your device, it will appear here.
  • There is nothing that requires your attention at the moment.
  • The latest version of Windows is not yet ready for your device.

Instead of seeing Download and install, you see an informational message.

Microsoft states that this message means one or more safeguard holds may be protecting the computer. 

Select “Learn more”

When Windows provides a Learn more option, select it.

Microsoft’s safeguard information page may display a customised summary of known issues affecting that particular device and preventing the upgrade. 

The amount of detail varies.

You might see:

  • The affected Windows release
  • A description of the compatibility issue
  • The application, driver or device involved
  • A workaround
  • Whether Microsoft is investigating
  • Whether a resolution is available
  • A safeguard identifier

In other cases, Windows may confirm that a hold exists without revealing the exact third-party component.

Check Windows Release Health

Microsoft’s Windows release-health service lists current and resolved issues for supported Windows versions.

Before assuming that Windows Update is malfunctioning:

  1. Run winver.
  2. Record your current Windows version.
  3. Identify the version you are trying to install.
  4. Check that target version’s Known issues page.
  5. Look for issues involving your computer, driver or application.

Microsoft’s release-health dashboard provides official information about known issues, safeguards, servicing milestones and resolved problems. 

A documented issue may include instructions such as:

  • Update a particular driver.
  • Update or remove an affected application.
  • Install new firmware.
  • Wait for a corrected Windows update.
  • Avoid manually upgrading for the moment.

Do not follow a workaround written for a different Windows release simply because the symptoms appear similar.

How to Confirm a Safeguard Hold Using PowerShell

Windows records local compatibility-assessment information in the Registry.

This is an advanced, read-only diagnostic method. You should inspect the values—not edit or delete them.

Open PowerShell as administrator and run:

Get-ItemProperty `

  'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\GWX' `

  -Name GStatus

Microsoft documents the following values:

GStatus = 0   Safeguard hold is in effect

GStatus = 2   No safeguard hold is in effect

Find the Safeguard Hold ID

The target-release compatibility information is stored under:

HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\

TargetVersionUpgradeExperienceIndicators

The final subkey varies according to the Windows release being assessed. Microsoft’s example for Windows 11 version 24H2 uses:

GE24H2

and contains values such as:

GStatus

GatedBlockId

GatedBlockReason

The GatedBlockId is the safeguard identifier. 

You can inspect the available target-version keys using:

Get-ChildItem `

  'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TargetVersionUpgradeExperienceIndicators'

To display relevant values from each available key:

$path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TargetVersionUpgradeExperienceIndicators'


 

Get-ChildItem $path | ForEach-Object {

    $data = Get-ItemProperty $_.PSPath


 

    [pscustomobject]@{

        TargetKey        = $_.PSChildName

        GStatus          = $data.GStatus

        GatedBlockId     = $data.GatedBlockId

        GatedBlockReason = $data.GatedBlockReason

    }

}

When a hold ID is available, search for that number on Microsoft’s Windows release-health page for the target version.

Do not alter these Registry values to try to remove the block. Changing the local indicator does not repair the incompatible software or hardware.

What If the Registry Says a Hold Exists but the Issue Was Resolved?

Occasionally, a device may retain outdated compatibility information.

Microsoft notes that this can happen when the PC cannot refresh its compatibility database properly. One possible cause in managed networks is SSL inspection or filtering that interferes with Microsoft endpoints used to update Windows compatibility information. 

Before changing Windows components:

  • Install all normal Windows updates.
  • Restart the computer.
  • Select Check for updates again.
  • Confirm that Microsoft update endpoints are accessible.
  • Review firewall, proxy and SSL-inspection settings.
  • Check that the computer’s date and time are correct.
  • Allow the device time to refresh its compatibility assessment.

Business networks should review this centrally rather than changing each PC individually.

How IT Administrators Can Check Safeguard Holds in Intune

For one personal PC, the Windows Update page may be sufficient.

For dozens or hundreds of managed devices, Microsoft Intune and Windows Update reporting provide better visibility.

Feature Update Deployment Report

In Microsoft Intune, administrators can review feature-update deployment status.

A device blocked by a known safeguard issue may show:

SafeguardHold

Microsoft’s Intune reporting documentation states that the Deployment Error Code column can display the safeguard hold ID. Administrators can then compare that ID with the Windows release-health dashboard. 

Device Readiness Report

In the Intune admin centre, go to:

Reports > Device management > Windows updates > Reports

Select:

Windows Feature Update Device Readiness Report

Choose the target Windows version and generate the report.

The report can identify:

  • Hardware-requirement issues
  • Application compatibility risks
  • Driver compatibility risks
  • Devices already upgraded
  • Devices with high or low upgrade risk

Safeguard holds and configuration-related risks can appear under the Other category in the device details. 

Compatibility Risks Report

Administrators can also generate:

Windows Feature Update Compatibility Risks Report

This provides an organisation-wide view of affected:

  • Applications
  • Drivers
  • Device configurations
  • Other compatibility risks

It helps establish whether one obscure PC is affected or whether a particular application or driver is blocking an entire device group. 

Known-Issue Holds and “Likely-Issue” Holds

Traditional safeguard holds protect devices where Microsoft has identified a known compatibility problem.

Managed Windows Autopatch environments can also use likely-issue safeguard holds.

With intelligent rollout features enabled, Windows Autopatch can analyse signals from the wider device ecosystem and pause an update for a device that appears likely to encounter a problem—even before that exact configuration has produced a widely documented known issue. 

This means a managed device can be temporarily held because:

  • Its hardware and driver combination resembles affected devices.
  • Early rollout results show increased failures.
  • Microsoft’s deployment service identifies a productivity risk.
  • The device is in a population where further validation is advisable.

A likely-issue hold may therefore not map neatly to a public known-issue article.

A Safeguard Hold Is Not the Only Reason an Update Is Missing

Do not assume every unavailable feature update is being blocked by a safeguard hold.

Other possible explanations include:

Staged rollout

Microsoft may be offering the update gradually rather than to every eligible PC at once.

In managed Intune environments, devices can also be assigned to different rollout groups with different availability dates. 

Administrative pause

Your organisation may have paused the feature-update deployment.

Target-version policy

IT may have configured the device to remain on its current Windows version.

Update deferral

A policy may delay feature updates for a specified period.

Conflicting update policies

Group Policy, Intune, Windows Server Update Services or another management platform may be supplying conflicting instructions.

Hardware requirements

The computer may not meet the target release’s hardware requirements.

Windows needs repair

A damaged servicing installation may prevent the update being offered or installed.

The update was offered and failed

A safeguard hold usually prevents the offer. An installation error occurs after the update has already been downloaded or started.

Intune reporting distinguishes safeguard holds from conditions such as admin pauses, policy conflicts, validation problems, installation errors and rollback states. 

What Should You Do When You Have a Safeguard Hold?

1. Do not force the update

Avoid immediately using:

  • Windows Installation Assistant
  • An ISO image
  • Media Creation Tool
  • Registry bypasses
  • Scripts that disable safeguards
  • Unsupported third-party upgrade utilities

Microsoft specifically recommends waiting until the issue has been resolved and the hold released. 

2. Identify the hold

Check:

  • Windows Update’s message
  • The Learn more page
  • Windows release health
  • The local safeguard ID
  • Intune reports, where applicable

3. Follow the documented mitigation

The resolution may involve:

  • Updating a driver
  • Updating an application
  • Removing obsolete software
  • Installing firmware
  • Applying a Windows update
  • Waiting for Microsoft or the vendor to finish a fix

Use only guidance for the exact safeguard issue.

4. Update normal components

Install available:

  • Monthly Windows updates
  • Manufacturer-approved drivers
  • BIOS or UEFI updates
  • Firmware
  • Supported application updates

Restart the computer after significant changes.

5. Recheck later

Once the cause has been addressed, return to:

Settings > Windows Update

Select:

Check for updates

The feature update may not appear immediately because Windows must refresh the device’s compatibility assessment.

Should You Disable Safeguard Holds?

Windows provides an administrative policy that can make Windows Update ignore safeguard holds.

In Group Policy, the setting is named:

Disable safeguards for Feature Updates

For managed devices, the corresponding policy is:

Update/DisableWUfBSafeguards

However, Microsoft warns that opting out can expose devices to known performance and compatibility problems. It recommends doing so only within a controlled IT environment for testing and validation. Disabling the safeguards does not guarantee that the upgrade will succeed. 

When an opt-out might be reasonable

An experienced IT team might temporarily bypass safeguards when:

  • A representative test device is available.
  • A full verified backup exists.
  • The hold’s impact is understood.
  • The required application or driver has been independently validated.
  • The computer is not production-critical.
  • A rollback and recovery process is ready.
  • The organisation accepts the risk.

When you should not bypass it

Do not override a safeguard hold simply because:

  • You want a new Windows feature immediately.
  • Another computer already has the update.
  • A website says changing one Registry value will make it appear.
  • You assume Microsoft is being overly cautious.
  • The current Windows version still works properly.
  • The computer is business-critical.

Microsoft states that bypassing the protection may result in a failed upgrade or a poor experience after installation. 

Common Mistakes to Avoid

Repeatedly selecting “Check for updates”

A compatibility hold will not disappear because the button is pressed more frequently.

Resetting Windows Update immediately

Renaming SoftwareDistribution or resetting update services does not repair an incompatible driver or application.

Installing every optional driver

Only install drivers that are appropriate for the exact model and relevant to the compatibility issue.

Using a generic driver-updater tool

It may replace a manufacturer-customised driver with an unsuitable generic package.

Editing safeguard Registry entries

The Registry values describe the compatibility state. They are not the underlying cause.

Forcing the update with an ISO

This may bypass the protection while leaving the known compatibility problem intact.

Assuming the PC is unsupported

A safeguard hold is normally temporary. It is different from permanently failing Windows hardware requirements.

Removing business-management policies

A missing update on a managed PC may be deliberate. Contact IT before changing Group Policy, Intune or update settings.

A Practical Safeguard-Hold Checklist

When a Windows feature update is not being offered:

  1. Open Settings > Windows Update.
  2. Select Check for updates.
  3. Read the complete message.
  4. Select Learn more, where available.
  5. Run winver.
  6. Record the current Windows version and build.
  7. Identify the target feature-update version.
  8. Check Microsoft Windows release health.
  9. Look for relevant app, driver or hardware issues.
  10. Install normal Windows updates.
  11. Update manufacturer-approved drivers and firmware.
  12. Restart the computer.
  13. Check the GStatus value when advanced confirmation is required.
  14. Record the GatedBlockId, where available.
  15. Search the official release-health information for the hold ID.
  16. Use Intune feature-update reports for managed devices.
  17. Distinguish a safeguard hold from a pause, deferral or rollout delay.
  18. Do not force the feature update on a production PC.
  19. Apply only the documented mitigation.
  20. Recheck Windows Update after the hold is resolved.

How Hamilton Group Can Help

A safeguard hold can be protecting one laptop—or quietly delaying an upgrade across dozens of business devices.

Hamilton Group’s experienced IT team can identify why the update is not being offered and determine whether waiting, remediation or controlled testing is appropriate.

Safeguard-Hold Identification

We can review:

  • Windows Update messages
  • Compatibility-assessment Registry data
  • Safeguard hold IDs
  • Windows release-health information
  • Driver and application risks
  • Device-specific upgrade readiness

Microsoft Intune Reporting

For managed businesses, we can configure and review:

  • Feature Update Device Readiness reports
  • Compatibility Risks reports
  • Feature-update deployment reports
  • SafeguardHold error codes
  • Affected device groups

Driver and Application Remediation

Where the hold involves a known component, Hamilton Group can:

  • Update or replace the affected driver
  • Update incompatible applications
  • Remove obsolete software
  • Apply firmware updates
  • Test the business workload
  • Confirm that the safeguard has cleared

Controlled Windows Deployment

We can plan staged feature-update rollouts that include:

  • Pilot devices
  • Compatibility checks
  • Application testing
  • Driver validation
  • BitLocker recovery readiness
  • Backup verification
  • Rollback procedures
  • User communication

Update Policy Review

We can distinguish a genuine safeguard hold from:

  • Intune policy conflicts
  • Update deferrals
  • Target-version policies
  • Paused deployments
  • WSUS configuration
  • Windows servicing damage

Hamilton Group aims to make first contact on IT support requests within 15 minutes, helping businesses investigate Windows update blocks before unsupported versions or delayed upgrades become a larger operational issue.

Let the Safeguard Do Its Job

A safeguard hold does not normally mean that Windows Update is broken.

It means Microsoft has identified a reason why the next feature update may not yet be safe for that particular configuration.

The correct approach is:

Identify the hold, understand the compatibility risk, apply the approved fix and allow Windows Update to release the upgrade naturally.

Bypassing the protection may get the update installed sooner—but it can also create the exact failure the safeguard was designed to prevent.

Call 0330 043 0069, book a meeting with one of our experts or visit hgmssp.com for experienced help with safeguard holds, Windows feature updates and managed business deployments.


 

Previous Next