TPM 2.0 and Secure Boot are enabled on the Windows 11 virtual machines, but Windows Health Check reports the exposed Xeon Gold CPU as incompatible. That appears to prevent feature upgrades from arriving through Windows Update, even though the VMs are virtualized and the CPU model is inherited from the host. Registry bypasses used during ISO installation have already been applied to the template without solving the update problem. The environment no longer uses SCCM; instead, one VDI template is updated and then used to respawn the pool. What is the best way to make feature upgrades download through Windows Update, install them manually from the Microsoft Update Catalog with PowerShell or DISM, or otherwise update the template efficiently?
3 Answers
The registry bypasses can help the initial installation, but Windows Update performs its own hardware eligibility checks later, so those settings may not be enough for feature upgrades. For a template-based VDI deployment, downloading the cumulative or feature-update package and servicing the template offline with DISM is usually more predictable than updating every running VM. Also check the cluster’s EVC setting or virtual CPU compatibility configuration so the guest sees a consistent, supported CPU feature set.
A per-user compatibility override may allow the upgrade to proceed: `reg add "HKCUSOFTWAREMicrosoftPCHC" /v UpgradeEligibility /t reg_dword /d 1 /f`. This has to be applied in the context of the user running the update, not just system-wide in the template. If the guest is still reporting an unexpected processor generation, correcting the cluster EVC mode is worth investigating before relying on bypasses.
DISM can report success for an MSU package without delivering the feature-version upgrade you actually need. In this case, manually running the matching Windows edition ISO upgrade worked, although the in-place upgrade was slow even from a locally mounted image. Since the template is only refreshed about twice a year, using the ISO process may be a reasonable fallback when Windows Update continues rejecting the virtual CPU.
The MSU completed successfully through DISM, but the guest did not actually move to the newer release. The edition ISO upgrade was ultimately the method that worked, despite taking much longer than expected.