Those upgrade prompts are shifty as fuck. The path to decline it is obscure and not intuitive, it violates basically every principle of good UI design. It's basically like a scammer popup, most people who actually upgrade are probably doing so accidentally.
MS has been pretty shit for a long time, but they've been getting actively worse over the last few years.
We've had some of our organizational-managed domain machines get it too. It's slipping around controls.
I used an iso and a permanent license scheme for 11 pro, then turned off everything possible with gpedit and through the registry. There's a lot of stuff baked in that I have zero idea how to access.
Go into your BIOS and disable TPM. It won't ask you because it thinks you're ineligible. Of course not an option on a domain of hundreds or thousands of computers.
(post is archived)