Bad IT.
I remain thankful that Win11 is fussy about what it will install on. It needs at least:
- UEFI boot mode & GPT partitioning of the disk
- TPM 2
- Secure Boot capability
Nixing any one of these will prevent an automatic upgrade, regardless of what group policy etc is in place. On a bunch of new Win10 builds from a while ago, I set them up as CSM/MBR and turned off the TPM in BIOS. Absolutely no chance of surprises there, even if I accidentally mark a machine for upgrade.
My network is small though, < 50 clients. When the bullet must be bit, I have the time to add the client to the 'will upgrade' AD group & go over things with the user(s). Then run through converting MBR to GPT, switching to UEFI and enabling the TPM again.
After that it takes care of itself and pulls down a load of QoL fixes post-upgrade.
I don't think you're the first nor will you be the last to be smacked with a driveby install that fucks up your equipment, sadly :(
