Windows – How to remove configured Windows 10 update policies

administratorgroup-policywindowswindows 10windows update

I have run into a very frustrating issue where my computer updates and restarts without notice. I have tried to disable this setting, but have encountered the message "Some settings are managed by your organization", but I am not part of an organization, own my windows 10 licence, and am not enrolled in the insider program. Many google searches have suggested that I enter the group policy editor to disable these policies in the "Windows Update" settings but it appears that no policies are configured here so I do not think that this is the issue. I have also seen suggestions to look in the registry editor but the suggested settings to modify do not appear in my editor. I am truly at a loss here! I have attached a list of all the installed policies, any advice as to how I would go about removing all of these would be immensely appreciated!

1)Auto install and restart at an IT specified time with no notifications

2)Schedule Update Install Day

3)Schedule Update Install Time

4)Get Updates for Other microsoft products

5)Disable Pause updates by User

6)Quality Update Deferral Period

7)Feature update deferral period

8)Exclude Drivers from Windows Quality Updates

9)Enable Automatic Updates

10)Enable skipping battery checks for EDU devices

all of these have the source Administrator and type: Mobile Device Management

I am the sole administrator account so I do not understand why these are here.

Best Answer

What you're running into is relatively new for Windows and can be very confusing, so don't feel bad that you haven't found a solution.

There are two ways that system settings can be configured by system administrators on a Windows 10 PC:

Group Policy. This is the traditional way of configuring Windows, and is what all the documentation you're describing is telling you about.
Mobile Device Management . This is a relatively new approach that lets administrators configure all sorts of devices connecting to their networks -- computers, phones, tablets, etc. You can see the documentation for MDM on Microsoft's website, but be forewarned that it's pretty technically dense.

Since Windows Update is telling you that all of these restrictions are coming from Mobile Device Management, that means that someone is using that approach.

If your computer is configured through MDM, you should be able to find it in the Settings app.

In the Settings app, go to "Accounts", then "Access work or school".
There's a very good chance that you'll see the MDM source listed there, above or below the "Connect" button.
If you don't see anything there, click the "Add or remove a provisioning package" link in "Related settings" on the right side of the "Access work or school" page. This will list all the MDM provisioning packages on your machine.

Related Solutions

Windows – Configure Windows Update in Windows Server 2016

Unfortunately, the Get-GPO cmdlet can only get GPOs from a domain; there does not appear to be any managed equivalent of the COM method IGroupPolicyObject::OpenLocalMachineGPO. There are other ways to set this, though. Assuming the existing Group Policy doesn't already specify this policy setting, tweaking the Registry directly should work fine:

$hklm = [Microsoft.Win32.RegistryKey]::OpenBaseKey('LocalMachine', 'Default')
$wu = $hklm.CreateSubKey('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU')
$wu.SetValue('NoAutoUpdate', 0, 'DWord')
$wu.SetValue('AUOptions', 4, 'DWord')
$wu.SetValue('ScheduledInstallDay', 7, 'DWord')
$wu.SetValue('ScheduledInstallTime', 0, 'DWord')
$wu.Dispose()
$hklm.Dispose()

This will not affect what you see in the Local Group Policy Editor, but it will be seen by the Windows Update infrastructure. Since you didn't say what hour of the day the updates should be installed, I set it to midnight. You can change that by altering the ScheduledInstallTime value.

To determine what Registry settings correspond to a given policy, you can use the Element Inspector tool in my open-source application Policy Plus. Speaking of Policy Plus, you can also load it as an assembly from PowerShell to edit the local GPO. First, download it and use the Properties tab in Explorer to "unblock" it; this allows .NET to load it into another process. Then place it in the same directory as this script:

[System.Reflection.Assembly]::LoadFile((gi '.\Policy Plus.exe').FullName) | Out-Null
$loader = [PolicyPlus.PolicyLoader]::new('LocalGpo', '', $false)
$pol = $loader.OpenSource()
$pol.SetValue('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU', 'NoAutoUpdate', 0, 'DWord')
$pol.SetValue('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU', 'AUOptions', 4, 'DWord')
$pol.SetValue('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU', 'ScheduledInstallDay', 7, 'DWord')
$pol.SetValue('SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU', 'ScheduledInstallTime', 0, 'DWord')
$loader.Save()
$loader.Close()

This takes advantage of Policy Plus's PolicyLoader and PolFile classes. When the script completes, you should see this output (due to the last two calls):

saved to disk and invoked policy refresh
True

This way, the changes will be visible in the Local Group Policy Editor and the normal Group Policy infrastructure will apply them to the Registry.

Windows update – some settings are managed by your organization

Change the privacy configuration:

Settings -> Privacy -> Feedback & diagnostics -> Diagnostics and usage data, change it to Enhanced.

Best Answer

Related Solutions

Windows – Configure Windows Update in Windows Server 2016

Windows update – some settings are managed by your organization

Related Question