none
Prevent local administrators from opting out of Microsoft Updates / accessing Windows Update "Change settings" page

    Question

  • Hello,

    Is there a a group policy setting / dll file / registry setting that I can restrict access to that would either:

    A) prevent local administrators from unchecking the "Give me updates for other Microsoft products when I update Windows" box?

    or

    B) prevent access to the "Change settings" option on the left side of Windows Update?

    Thanks!


    • Edited by Casey_T Wednesday, April 8, 2015 7:31 PM
    Wednesday, April 8, 2015 7:30 PM

Answers

All replies

  • > A) prevent local administrators from unchecking the "Give me updates for
    > other Microsoft products when I update Windows" box?
     
    Besides from the fact that you cannot restrict a local administrator
    from anything (that's why he is an administrator...):
     
    Do it the same way like you would for standard users: Remove access to
    all windows update functions.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    • Proposed as answer by Frank Shen5Moderator Thursday, April 16, 2015 9:06 AM
    • Marked as answer by Casey_T Thursday, April 16, 2015 12:06 PM
    Thursday, April 9, 2015 9:52 AM
  • Thanks Martin.

    When you say to remove access to all Windows Update functions, are you referring to the "Remove access to use all Windows Update features" group policy setting under User Configuration\Administrative Templates\Windows Components\Windows Update? It is my understanding that enabling this group policy setting would disable Windows Update and prevent the operating system from being updated (source: https://technet.microsoft.com/en-us/library/bb490846.aspx). This is not my intention. I'd still like to keep Windows Update enabled.

    If I prevent access to Windows Update through the "Hide specified Control Panel items" group policy setting under User Configuration\Administrative Templates\Control Panel, will Windows Update still be enabled?

    Thursday, April 9, 2015 1:36 PM
  • > referring to the "Remove access to use all Windows Update features"
     
    Yes.
     
    > enabling this group policy setting would disable Windows Update and
     
    No. It removes access to windows update, not windows update itself. If
    you enable it, you have to make sure that windows update is properly
     
     
    This article is - hum - somewhat outdated :)
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Thursday, April 9, 2015 1:51 PM
  • There is another TechNet article (https://technet.microsoft.com/en-us/library/dd939933%28v=ws.10%29.aspx) that states that the "Remove access to use all Windows Update features" group policy setting prevents the operating system from being updated through Windows Update, and disables Automatic Updates. But if you say that it only removes access to Windows Update and not Windows Update itself, then I'll take your word for it. :-)

    Ideally, I'd like to still allow users to navigate to Control Panel -> Windows Update, however not allow them access to the "Change settings" option on the left side or the ability to uncheck the "Give me updates for other Microsoft products when I update Windows" box. Can you please confirm for me that there is no way to do this, by way of group policy setting / dll file restriction / registry setting? Thanks.

    Thursday, April 9, 2015 2:22 PM
  • > option on the left side or the ability to uncheck the "Give me updates
    > for other Microsoft products when I update Windows" box. Can you please
    > confirm for me that there is no way to do this, by way of group policy
    > setting / dll file restriction / registry setting? Thanks.
     
    If you configure it through http://gpsearch.azurewebsites.net/#2791,
    they will not be able to change THESE settings. For this checkbox, I'm
    unaware of a solution to disable it.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Thursday, April 9, 2015 2:39 PM