Unexpected installation of 2023-12 Cumulative Update (KB5033375)

I have 5 computers, all with Group Policy "Computer Configuration > Windows Components > Windows Update > Manage End user experience > Configure automatic updates" set to "2 - Notify for download and auto install". In the past - for many years - this has let me pick when I install maintenance. But for the past few months some maintenance gets automatically installed anyway.

The latest occurrence was just today. My "production" PC is pending restart for installation of 2023-12 Cumulative Update (KB5033375). On one of the other computers that maintenance is waiting for me to click "Download & install" (as is expected); on a 3rd computer it does not show up at all, and I don't have access to the other 2 computers to check right now. All computers are running Windows 11 Pro 22H2 build 22621.2715.

Is there something that can override that Group Policy? Or is there a bug in the implementation of that policy? This has happened 2 or 3 times on 2 of the computers in the past 6 months. I don't think it has ever happened on 2 computers for the same maintenance.

I got that KB on some of my Win11 machines yesterday [Patch Tuesday] and the Build is now at 22631.2861. Due to the wide-spread number of computers not everyone will get the same updates at the same time.

Berton said:

I got that KB on some of my Win11 machines yesterday [Patch Tuesday] and the Build is now at 22631.2861. Due to the wide-spread number of computers not everyone will get the same updates at the same time.

Click to expand...

I'm not concerned about the availability. I want to know why it automatically installed when the group policy should have prevented that until I manually selected "Download and install".

It was mentioned some time ago by Microsoft that some of Windows updates will be applied regardless of/disregarding the settings in Windows Updates just as there will be some that can't be uninstalled.

Berton said:

It was mentioned some time ago by Microsoft that some of Windows updates will be applied regardless of/disregarding the settings in Windows Updates just as there will be some that can't be uninstalled.

Click to expand...

But this has happened on only one of the two computers that have the update available. Admittedly, the PC where it got installed is on much of the time and the other is usually powered off.

The update is now available on the 3rd computer. It is powered on but asleep most of the time. I'll see what happens on it.

This is not good news to me because this update installed automatically on two of my Win11 Pro machines -- and hosed up BOTH of them.

On one, since I make weekly image backups, I was able to restore prior to the update and it is working OK again.

On the other, I have other issues to resolve -- since there was worse corruption -- and I am trying to work those before resorting to restoring from a week ago.

I was going to ask about a way to disable Updates -- but it seems from this thread, that this update is going to be forced on folks -- regardless.