It seems that if you have OEM machines with OEM Windows then, yes, you will have to stamp on Windows 10 installs. MS weren't upfront about which update GWX was in so making blacklisting the update in WSUS difficult at the beginning. Laptops could download GWX at home. There are determined fanboys who download the ISO. Etc.
Biting the hand that feeds IT
