Windows 10/11 - Select the Target Feature Update Version

Intro:

In Windows 10 and Windows 11, you can select a Target Feature Update Version to control which specific version of the operating system your device installs. This is especially useful in enterprise environments or for individual users who want to delay upgrading to a newer version for stability, compatibility, or testing purposes.

How to Select the Target Feature Update Version:

Using Group Policy:

1. Open the Group Policy Editor:

   • Press Win + R, type gpedit.msc, and press Enter.

2. Navigate to:

   • Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Updates.

3. Locate and configure the policy:

   • Find Select the target Feature Update version.
   • Double-click to open the policy settings.
   • Set it to Enabled.
   • Reference this link for the next bit of information: aka.ms/WindowsTargetVersioninfo
   • Enter "Windows 10" or "Windows 11" in the first box.
   • Enter the Target Version (e.g., 21H2 for Windows 10, or 22H2 for Windows 11).

4. Apply and save:

• Click OK to save the changes.

Using Registry Editor:

1. Open the Registry Editor:

   • Press Win + R, type regedit, and press Enter.

2. Navigate to:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate.

3. Create or modify the keys:

   • Right-click in the right pane and select New > DWORD (32-bit) Value.
   • Name the value: TargetReleaseVersion.
   • Set its data to 1.

4. Specify the target version:

   • Right-click again and create a new String Value.
   • Name it: TargetReleaseVersionInfo.
   • Set the data to your desired version (e.g., 21H2 or 22H2).

5. Close the editor and restart your system.

Using PowerShell:

For a more automated approach, use PowerShell to set the target version:

1. Open PowerShell as Administrator.
2. Run the following commands:

   powershell
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersion" -Value 1
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersionInfo" -Value "22H2"
   

Notes:

• TargetReleaseVersionInfo must match the official version names (e.g., 22H2 for the second half of 2022).
• This setting will prevent the device from installing a newer feature update than the specified version.
• Security updates and cumulative updates for the specified version will still be installed.

👽

SentinelOne - Exclude Files from Scans

 

Excluding Files From S1 Scanning:

If you wish to exclude a file from being scanned by the SentinelOne agent you can exclude it by adding the file's SHA1 hash in the console.

Make sure the computer is in the correct site and or group before adding the exclusion. Exclusions propagate down from sites to groups.

How to Add a File to the Exclusion List:

For the file to be added to the exclusion list you need to either A. have the file trigger a warning in the console and then add it to the exclusion list or B. you can generate the SHA1 hash for the file and add that to the exclusion list.

Let's go with generating the SHA1 hash for the file in question:

1. Open PowerShell on the machine where the file exists and run the following command:

    a. Get-FileHash .\xcopy.exe -Algorithm SHA1

2. Here's the SHA1 hash of "xcopy.exe"

    a. C5BD7815ED18F7E3D1CE93CC47AECF58D908DCA8

3. Log in to the S1 console, expand the chevron in the upper left, find the site or group you want to apply the exclusion to and click on it.

4. Click on "Exclusions" in the top menu and make sure it's underlined in purple.

5. Click on "New Exclusion" in purple...

6. Click "Create Exclusion"...

7. It should default the selection to "Hash" at the top.

    Fill out the following form with the OS and the SHA1 hash from earlier. Give it a description so you know what it is. Click "Save" when done.

8. Using "xcopy.exe" as an example...

9. Once saved you can search for it by clicking once on the bar where I drew the 3 red dashes. It should be more obvious that this is where they hide the search options. I literally made a post on Reddit because I couldn't find it. This goes to show that UI developers aren't actual users of the software. Anyway, you'll find your newly created entry by the description if you entered one.

10. Changes should propagate down to the agent in a matter of seconds.

👽

Windows 10/11 - Change Network Profile From Public to Private Using Powershell

 

Problem:

Cannot change the network connection profile from public to private from the GUI because the option does not exist in certain scenarios.

Solution:

1. Open PowerShell as Admin

2. Get-NetConnectionProfile to show all available network profiles (only shows enabled adapters).

3. Identify the Name of the network profile you wish to change.

4. Set-NetConnectionProfile -Name "nameofnetworkprofile" -NetworkCategory Private

5. or

6. Set-NetConnectionProfile -Name "nameofnetworkprofile" -NetworkCategory Public

7. Done

👽