We had a user who somehow got upgraded to Windows 11 over the weekend. She swears she didn't click on the update to 11 icon in the taskbar. 

In Pulseway, our patch policy she is assigned is set to install all updates including Optional. When I look on my Win10 laptop under Windows Updates > Optional, Win 11 is in the list. 

Does this mean users will get upgraded? If so, everyone needs to be aware. Pulseway, anything in the works to block this? I'm not afraid of 11, I just want to roll it out in a more managed way esp since we have to upgrade SSLVPN client after upgrade to 11. 

Windows 11 is tagged with 21H2.  I added a Global Policy to Hide and Not Install any updates with 21H2 in the Name or Description.  It seem to be random its this rule works or not.  I have some computers with the Patch policy and it will install anyway.  

I see you found the thread where this is discussed.  This still will not stop users from clicking upgrade.  I've not had a single machine from any of my clients update to Win 11 yet, and I took the same steps I outlined in the below thread. 

 

 

You can create GPO (Google it) to not allow Windows Update to run over a certain version. 
 

between Pulseway and my GPO, our systems are not updating. 

Thanks for the hint.

That explains, why some users get Windows 11 installed.