Windows Feature Updates delivered through the Unified Update Platform (UUP) are detected, staged, and deployed by the KACE agent using the Windows Update Agent (WUA). Before the agent can stage or deploy a Feature Update, WUA must first detect that the update is applicable to the device.
When detection fails, the device will not be offered the Feature Update and the update cannot proceed. This article describes the most common causes of UUP Feature Update detection failures and how to resolve them, starting with the most likely causes.
As a first step, check whether the target Feature Update is visible on the device under Settings | Windows Update. Note that this alone does not confirm the update can be detected by the KACE agent. The Windows Update Settings page and the Windows Update Agent (WUA) COM interface that the KACE agent uses do not always behave identically — in particular, a safeguard hold can cause the agent's detection to fail even when the update appears to be available in Settings | Windows Update. Use the visibility of the update in Settings | Windows Update as a general indicator, but follow the troubleshooting steps below if the KACE agent is reporting a detection failure regardless of what the Settings page shows.
A device must be current on cumulative and servicing-stack updates before it can be offered a Feature Update. An out-of-date device may fail detection because Windows cannot evaluate the Feature Update until prerequisite updates are installed.
Do the following:
- Open Windows Settings > Windows Update and click "Check for updates".
- Install all available quality updates, including any Servicing Stack Updates (SSU) and the latest Cumulative Update (LCU).
- Reboot the device if prompted, and then check for updates again to confirm no further updates are pending.
- Once the device reports it is up to date, confirm the target Feature Update is now visible under Settings > Windows Update, then re-run the Feature Update detection.
UUP Feature Update detection and content delivery depend on the device being able to reach the Microsoft Windows Update endpoints. If the device cannot reach these services, detection will fail.
The following are known Windows Update endpoints. Refer to Microsoft documentation for a complete and current list:
*.windowsupdate.com
*.update.microsoft.com
*.delivery.mp.microsoft.com
*.do.dsp.mp.microsoft.com
*.dl.delivery.mp.microsoft.com
*.prod.do.dsp.mp.microsoft.com
*.api.cdp.microsoft.com
adl.windows.com
tsfe.trafficshaping.dsp.mp.microsoft.com
Do the following:
- Confirm the device has general internet access.
- Confirm that the endpoints above are reachable and are not blocked by a firewall, proxy, or content filter.
- If the device is behind an authenticated or filtering proxy, confirm that Windows Update traffic and Delivery Optimization traffic are permitted.
- Confirm that any Windows Update for Business, WSUS, or Group Policy settings on the device are not redirecting or blocking access to the Microsoft Update service.
After confirming connectivity, verify the target Feature Update is visible under Settings > Windows Update, then re-run detection.
In rare cases, Microsoft applies a "safeguard hold" to a device. A safeguard hold is a compatibility block that Microsoft places on devices with a known issue affecting a specific Feature Update. While the hold is in effect, Windows Update will not offer the Feature Update, and the KACE agent's detection will fail as a result.
When detection fails for this reason, the following message is displayed on the Windows Feature Update Schedule Summary page for the affected device:
A safeguard hold has been discovered which may prevent a Windows feature update from being installed.
You can confirm the safeguard hold and identify the specific registry sub-keys involved by reviewing the agent log.
- Open KAgent.log, located in: %ProgramData%\Quest\KACE\user
- Search the log for the following text: SafeguardHoldChecker::Check:
- Each matching line reports a sub-key and its values. A sub-key that is contributing to the hold will end with: Active=YES and will show UpgEx or UpgExU set to 'Red', for example:
SafeguardHoldChecker::Check: [GE25H2] UpgEx='Red' UpgExU='Red'
RedReason='...' GatedBlockId='...' Active=YES
Note the name of each sub-key reported with Active=YES and the corresponding RedReason value. These are the sub-keys you will assess below.
The safeguard hold information is stored under the following registry key, with one sub-key per evaluated target version:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TargetVersionUpgradeExperienceIndicators
Each sub-key represents a version that the Windows compatibility appraiser has evaluated. A sub-key with UpgEx or UpgExU set to "Red" means the appraiser has determined that this device has a compatibility issue with that version.
If the sub-key that contains "Red" values corresponds to the Feature Update version you are trying to install, the device is likely not capable of upgrading to that version in its current state. The RedReason value in that sub-key identifies why. Common examples include a driver incompatibility, insufficient disk space, or a hardware limitation. The underlying issue described by RedReason must be resolved before the upgrade can succeed. Once resolved, the Windows compatibility appraiser will re-evaluate the device on its next scheduled run and may automatically clear the hold.
Sub-keys with Active=YES that do NOT correspond to the target upgrade version are stale entries left over from previous compatibility evaluations. These can be safely removed.
WARNING: The following steps modify the Windows registry. Incorrect changes to the registry can cause serious system problems. BEFORE MAKING ANY CHANGES, back up the registry key and its sub-keys and values. In Registry Editor, right-click the TargetVersionUpgradeExperienceIndicators key, select Export, and save the .reg file to a safe location. This allows you to restore the original values if needed.
1. Open Registry Editor (regedit.exe) as an administrator.
2. Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\ TargetVersionUpgradeExperienceIndicators
3. For each sub-key reported with Active=YES in KAgent.log, check whether it corresponds to the Feature Update version you are trying to install.
4. Delete only the stale sub-keys identified in step 3.
5. Close Registry Editor.
6. Re-run the Feature Update detection. Also verify the target Feature Update is now visible under Settings > Windows Update.
Note: The compatibility appraiser may re-create sub-keys over time as it re-evaluates the device. If the underlying compatibility issue has not been resolved, the "Red" values will return.
When troubleshooting a UUP Windows Feature Update detection failure, work through the causes in this order:
In all cases, confirm that the target Feature Update is visible under Settings > Windows Update as a useful indicator that WUA can detect it.
