Prevent Office from being updated to a specific version
Verified with Microsoft 365/Office 5568.1000 — updated on September 4, 2026
Supported on: At least Windows Server 2008 R2 or Windows 7
Path in the GPO console
Computer Configuration\Administrative Templates\Microsoft Office 2016 (Machine)\Updates Description
This policy setting allows you to prevent Office from being updated to a specific version, and instead have Office be updated to a different version that you specify. If you enable this policy setting, you need to specify both the version to block and the version to update Office to. You list the version to block first and separate the two versions with a colon. You can specify more than one version to block by separating the entries with a vertical bar. For example, if you want to block versions 16.0.10326.10000 and 16.0.10326.20000 and have Office updated to version 16.0.10328.10000 instead, you would enter 16.0.10326.10000:16.0.10328.10000|16.0.10326.20000:16.0.10328.10000. If the blocked version is already installed, Office will be updated to the other version you've specified. Note: if you make a mistake entering the versions, the update won't be blocked. Also, be sure that the installation files for the version that you want to update Office to are available on the update location. If you disable or don't configure this policy setting, Office will be updated to whichever more current version is available in the location where Office is configured to get updates from, unless youve specified a version to block by using the Office Deployment Tool. Note: This policy setting only applies to Office products that are installed by using Click-to-Run. It doesn't apply to Office products that use Windows Installer (MSI).
Registry
software\policies\microsoft\office\16.0\common\officeupdate Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Prevent Office from being updated to a specific version
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7
[HKEY_LOCAL_MACHINE\software\policies\microsoft\office\16.0\common\officeupdate]
"blockversion"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\software\policies\microsoft\office\16.0\common\officeupdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'blockversion' -Value '' -Type StringIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\office\16.0\common\officeupdate' -Name 'blockversion' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\software\policies\microsoft\office\16.0\common\officeupdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'blockversion' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\office\16.0\common\officeupdate' -Name 'blockversion' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent Office from being updated to a specific version
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\software\policies\microsoft\office\16.0\common\officeupdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'blockversion' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.