some settings are managed by your organisation - not!

[stuck]

In this thread that I started back in April:
http://www.eileenslounge.com/viewtopic.php?f=55&t=29656
I asked about the Group Policy Editor because as far as I could see NOTHING in the GPE was configured yet when I looked at Windows Update settings I saw 'some settings are managed by your organisation'.

I never did get to the bottom of what was going on and then that SSD died so it all became a bit academic for that particular system.

Anyway, the replacement SSD arrived a while ago now so I had a new PC again. One of the first things I did was to go to the Windows Update settings. There was NO sign of the 'some settings are managed by your organisation' mesage and in Advanced Options I was able to change the settings. I didn't want the complication of Win 10 1809 being installed while I was working through installing other stuff so I paused updates, chose 'semi-annual channel', deferred feature updates for 365 days and finally deferred quality updates for 30 days.

At some point I used O&O Shutup but it did NOT make the 'some settings are managed by your organisation' message appear, the settings / options in Windows Update remianed editable and behaved as I'd expect.

Today, it was time to unpause Updates and get up to date. That seemed to go OK.

BUT NOW, FOLLOWING THOSE UPDATES!

The 'some settings are managed by your organisation' has appeared and, as before, NOTHING was configured in the Group Policy Editor.

Also, when I ran O&O Shutp (in case the cumulative updates had undone anything) that told me that restore points were disabled but when I checked in the Control Panel, that's not true, system protection is enabled.

I can live with this confusion because I found a helpful post by Susan Bradley that gave me a Noddy Guide to the policy that needed enabling and using that has allowed me to alter the otherwise greyed out options in Windows Update.

Ken

[HansV]

Weird. But then, it *is* Microsoft Windows...

[stuck]

I couldn't possibly comment...

[JoeP]

I've seen this on several machines. Sometimes, it appears that if you have a work account defined even though the PC is personal this happens.

[stuck]

There is only one user account on my PC and it has Admin rights.

As indicated in the other thread, some people have found this issue is linked to them having reduced the telemetry that goes back to MS but if the GPE is used to temporarily raise it to 'Full' when it is reset to 'Basic' the message goes away. That fix did not help my previous installation, I've yet to try it on this system. However, I now have a (vague) grasp of which policies I need to use to get at the otherwise greyed out options I can live with this weirdness.

Ken

[stuck]

...That fix did not help my previous installation, I've yet to try it on this system...

...and having just tried it now, it didn't work.

Ken

[JoeP]

Sorry. Let me explain in more detail. I do not have an account defined. I use a work account to download and activate Office 365 Pro Plus. Windows 10 acts as though I am domain joined for some things. I've posted this in the Feedback Hub and continued to occasionally update it.

[Argus]

Weird. But then, it *is* Microsoft Windows...

Microsoft's Windows, it seems.

[Rick Corbett]

Late to the party - sorry - but the Some settings are managed by your organization messages are ALWAYS the result of registry entries within Policies subkeys, even if not apparently configured within the Group Policy Editor.

There's a lot of evidence that Win 10's mechanism to mirror Windows Update policy settings in the Group Policy Editor has been flawed since 1709, i.e. IMO it's a reproducible bug. (Note: I haven't yet tested 1809.) As a result, the only accurate method of determining the cause is a manual inspection of these keys and their sub-keys in the registry. Specifically, Win 10 appears to mis-read the DWORD value for AUOptions within HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU.

To get rid of this Some settings are managed by your organization message on the Windows Update page of Settings, do the following:

1) Copy/paste the following as something like wu_bug-remove.reg. (The name doesn't really matter.):

Code: Select all

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

2. Double-click on the .REG file and accept the User Account Control prompt to allow changes.

3. Click on the Yes button in the next dialog which asks if you want to continue then on the OK button of the next dialog to dismiss the confirmation.*

4. Close and re-open the Settings app.

5. In Settings, open the Update & Security section and select the Windows Update page. Note that you may still see the Some settings are managed by your organization message at this point (due to what appears to be a reproducible bug in reading the registry)**.

6. Click on the Check for updates button. The message should disappear within a second of starting the check.

* If the .REG file won't import or you see an error then, instead, open REGEDIT using Run as administrator then use Import... (from the File menu).
** You can also re-start the device so the HKLM (machine) registry hive is re-read in its entirely.

Hope this helps...

[stuck]

Thank you for the suggestion but if I understand your .reg file correctly then if I run it, it will remove:
1) the ...\AU key
2) the ...\WindowsUpdate key and all it's sub keys

My PC does not have a ...\AU key and I don't want to remove my (now) policy configured update settings and then check for updates because I'd expect that to give MS carte blanche to upgrade me from 1803 to 1809 and I don't want to do that until 1809 is deeemd ready for the semi-annual channel.

Or have I misunderstood what the .reg file will do?

Ken

[Rick Corbett]

Thank you for the suggestion but if I understand your .reg file correctly then if I run it, it will remove:
1) the ...\AU key
2) the ...\WindowsUpdate key and all it's sub keys

My PC does not have a ...\AU key and I don't want to remove my (now) policy configured update settings and then check for updates because I'd expect that to give MS carte blanche to upgrade me from 1803 to 1809 and I don't want to do that until 1809 is deeemd ready for the semi-annual channel.

Or have I misunderstood what the .reg file will do?

You're correct... the .REG file would remove any and all of Policies that have been set (including the one(s) responsible for the Some settings are managed by your organization message). In effect, the .REG file would reset all Policies for Windows Update back to Not Configured.

If you are comfortable using the Registry Editor manually, open it (using the right-click option of Run as administrator) and drill down to the following key in the left-hand navigation pane:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

If, in the right-hand pane, you have an entry for "AUOptions"=dword:00000003 then this is the entry that IMO is responsible for the message. (See https://www.tenforums.com/windows-updat ... ost1447599 for further TL;DR background info.)

The problem is that even if you delete the entry, Windows will not force a re-read of these Windows Update policy settings correctly just by restarting. Instead you have to force a re-read from within the Settings app by clicking on the Check for updates button... and, of course, you really don't want to do that because it triggers the 'feature upgrade to 1809' process. (Thank you MS for the Hobson's choice...)

You can of course click on the Check for updates button, wait for the Some settings are managed by your organization message to disappear a few seconds later then disconnect your device from the internet whilst you search for and remove the pre-upgrade folders/files (like C:\$WINDOWS.~BT and C:\$Windows.~WS)... but it's easier just to ignore the message.

Hope this helps...

[stuck]

...drill down to the following key in the left-hand navigation pane:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

If, in the right-hand pane, you have an entry for "AUOptions"=dword:00000003 then this is the entry that IMO is responsible for the message...

Except, as I just said, there is no ...\AU entry in my registry.

...but it's easier just to ignore the message.

Agreed, as I said further up this thread, I can live with this weirdness.

Ken