Summary
- Windows 11 OOBE will install quality updates by default for managed Entra/Entra hybrid PCs starting Sept 2025.
- Only Windows 11 22H2+ Pro/Enterprise/Education/SE devices enrolled via Intune and Autopilot ESP qualify.
- Updates during OOBE give devices the latest security fixes before first sign-in, reducing post-setup patches.
Windows 11 setup has undergone significant changes over the last few years, though not all those tweaks have gone in favor of the consumers. For example, Microsoft's internet requirement during setup irked a lot of users. While you can bypass this by using some hacks, Microsoft still hasn't changed its stance on this. Instead, the software giant has been focusing on another key aspect of the Windows 11 setup: OOBE (Out-of-box Experience).
The OOBE experience on Windows 11 will change significantly from next month, and as a result, users will have to wait longer (an average of 20 minutes) for the OOBE to finish. While it might be annoying to wait several extra minutes to reach the desktop in Windows 11, the benefit is a secure and stable PC, or at least that's what Microsoft intends to do here.
Windows 11 setup is about to get longer on some devices
4
By
3 hours ago
Follow
Like
Thread
Link copied to clipboard
A computer screen displaying a Windows 11 desktop and Start menu with many of the built-in apps removed
Summary
Windows 11 OOBE will install quality updates by default for managed Entra/Entra hybrid PCs starting Sept 2025.
Only Windows 11 22H2+ Pro/Enterprise/Education/SE devices enrolled via Intune and Autopilot ESP qualify.
Updates during OOBE give devices the latest security fixes before first sign-in, reducing post-setup patches.
Windows 11 setup has undergone significant changes over the last few years, though not all those tweaks have gone in favor of the consumers. For example, Microsoft's internet requirement during setup irked a lot of users. While you can bypass this by using some hacks, Microsoft still hasn't changed its stance on this. Instead, the software giant has been focusing on another key aspect of the Windows 11 setup: OOBE (Out-of-box Experience).
The OOBE experience on Windows 11 will change significantly from next month, and as a result, users will have to wait longer (an average of 20 minutes) for the OOBE to finish. While it might be annoying to wait several extra minutes to reach the desktop in Windows 11, the benefit is a secure and stable PC, or at least that's what Microsoft intends to do here.
Microsoft is bringing quality updates to Windows 11's OOBE by default
In its official Tech Community blog post, Microsoft has announced that it'll introduce quality updates to the last page of the Windows 11 OOBE by default come September this year. However, this change will be available only for managed PCs enrolled in Entra or Entra hybrid and running Windows 11 22H2 or later. So, this won't affect personal consumer PCs.
Desktop PC in dark room With Windows 11 Pro Not Active
Source: Mockup Photos
Microsoft first announced this feature back in February this year, promising its arrival in mid-2025. But that didn't happen, as the company is now planning to roll out the September 2025 Windows Security update automatically. However, users will be able to 'maintain seamless control over quality update behavior' if they use Microsoft Intune and Windows Autopilot for managing their PCs.
On top of these, you'll have to meet a few more criteria in order to be able to control whether updates are installed during OOBE. As per Microsoft, devices are eligible only under the following conditions:
Your devices are on Windows 11, version 22H2 or later and on any of the following SKUs: Pro, Enterprise, Education, or SE.
You use Microsoft Intune to manage Windows quality updates.
You’ve assigned a Windows Autopilot Enrollment Status Page (ESP) profile to devices using either Windows Autopilot preregistered device group or using the “All devices” assignment.
In addition to these, devices that get the August 2025 OOBE zero-day patch (ZDP) update will have this capability. It's also worth noting that if the device is imaged with the June 2025 Windows non-security update or later includes the new control setting.
To access the new setting, all you'll have to do is go to the Microsoft Intune admin center and navigate to Devices > Enrollment > Enrollment Status Page. Next, select the ESP profile and go to the Settings tab and set Install Windows quality updates (might restart the device) to "Yes." However, it's worth remembering that the preexisting ESP profiles will have this set to No, while in new ones, "Yes" will be set as the default.
When you allow the updates to install during OOBE, you get all the latest approved security updates before you even first sign in to Windows 11. That's a big relief for large organizations, as it not only delivers enhanced security from day one but also eliminates the need to deal with a potentially large
number of updates after the setup.
0 Comments