Turn off all access to windows update features.
This dual scan feature in Win10 just updated some of our machines to 2004. Not liking that. I found a GPO setting that disables Dual Scan as well as access to all things WindowsUpdate. If this policy is turned on company wide, will this prevent KACE from pulling down updates as well?
If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website.
Rather than disabling the functionality, which is a bit like taking a hammer to the system, can you not run the script to point all your systems to a dummy WSUS service? There is a wizard script to do this in your SMA. Then when your devices look to update they address the dummy server, not go out to the internet Windows update server, and you can just use your SMA to provide the updates.