none
Unable to change Windows Update settings - Windows 7 Ultimate, AFTER removing the machine from a domain.

    Question

  • System: Windows 7 Ultimate.

    System was setup and worked without issues - and was set to "Check for updates but let me choose to install ..." - Worked as expected.

    Machine was then joined to a Windows 2003 Domain - and received settings to automatically install updates, from a WSUS server. - Again as expected.

    Then: Computer was removed from the domain - No error messages etc, same as I have done to XP machines many times before.

    BUT: - The ability to change the settings back to "Notify me ..." is still locked - as per settings from DC.

    I am able to make the required changes directly in the registry (Found settings in a number of other posts), but would like to know

    a. How to completely 'Free Up' or remove the control that is locking out the ability to use the "control panel" to make required changes.

    b. What else may be locked still (that I havn't yet found).

    Yes: I am logged with Admin Rights (Local Administrator), and have not found any other items that I'm locked out of. Also I am administrator of the Domain in question and also have Admin rights. The Local User name is not the same as the domain administrator.

     I have also logged into the machine with the Domain Admin Logon  - and also don't have permissions to change. This is NOT as I expected. (PC not attached to the domain, and again has been removed from the domain as well).

    Thoughts, Pointers please

    Thanks.


    Zenotech - Australia
    Wednesday, February 09, 2011 1:04 PM

Answers

  • Wrote a reply - but it seems to have gone missing.

    I followed through with the comments above in relation to Local Group Policies, and also read lots about Client Side extensions - though I still am aware of huge gaps in my knowledge of these things.

    1. Best of my knowledge - Local Group Policies not involved.

    2. Also - As far as I can work out Client Side also not involved.

    Resolution I have come up with (I have just returned from a 2 day training course and asked some much more knowledgable people there - who also couldn't explain why, but has a work around).

    My Solution:  Edit the Registry   HKLM/Software/Policies/Microsoft/Windows/WindowsUpdate

    Under here I removed the /AU key that was in there.

    On removing the /AU section - all the Windows Update settings are able to be changed without any issues and I can alter any settings from the control panel as expected.

     

     


    Zenotech - Australia
    Saturday, February 19, 2011 2:16 AM

All replies

  • Was the client's Windows Update settings configured using Group Policy ?

    MowGreen
    Windows Expert IT Pro - Consumer Security

    *-343-* FDNY
    NEVER FORGOTTEN

     

    Wednesday, February 09, 2011 8:19 PM
    Answerer
  • Process as follows:

    1. When Laptop was first setup and used - NOT on the domain.

    2 Some time later - Laptop was joined to the domain.

    3. Group Policy settings in the AD 2003 system set so all devices on the network receive automatic updates from the local WSUS server.  Also there are some other settings so that users can not change file share, proxy settings etc. (A school environment so we lock down a bit).

    4 Laptop was then disconnected from the domain ( When removing from te domain, laptop was NOT connected to the domain - I just signed in with Domain Admin rights and removed ).

    Note: A now have full access to change IE Home Page, Proxy Settings and all other 'locked down' settings that were applied - it is just I am not able to go into the Control Panel, Windows Update tab - and make any changes. It is still locked to the settings that were pushed out with Group Policy.

    Please clarify my understanding here : IF I remove a machine from the domain, doesn't that also release any Group Policy settings that were pushed out?    It appears to at least partially work as I am able to now make changes to all other previously 'locked out' settings that were applied - Or am I in need to going and reading much deeper into Group Policy in Windows AD?

    Thanks

     


    Zenotech - Australia
    Thursday, February 10, 2011 3:00 AM
  • GPO is definitely not my forte, Zenotech. I believe that this thread describes why LGPO may be in play in this situation -
    http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/020b7e99-aeea-4227-a7dd-882dbf5bead1

    Were client side extensions used when GPO was pushed out ?
    Troubleshooting Group Policy Client-Side Extension Behavior


    MowGreen
    Windows Expert IT Pro - Consumer Security

    *-343-* FDNY
    NEVER FORGOTTEN

     

    Thursday, February 10, 2011 10:14 PM
    Answerer
  • Hi,

     

    I am just writing to check the status of this thread. Was the information that MowGreen provided in previous reply helpful to you? Do you have any further questions or concerns? Please feel free to let us know.

     

    Alex Zhao

    TechNet Subscriber Support in forum.

    If you have any feedback on our support, please contact tngfb@microsoft.com


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, February 14, 2011 5:04 AM
    Moderator
  • Wrote a reply - but it seems to have gone missing.

    I followed through with the comments above in relation to Local Group Policies, and also read lots about Client Side extensions - though I still am aware of huge gaps in my knowledge of these things.

    1. Best of my knowledge - Local Group Policies not involved.

    2. Also - As far as I can work out Client Side also not involved.

    Resolution I have come up with (I have just returned from a 2 day training course and asked some much more knowledgable people there - who also couldn't explain why, but has a work around).

    My Solution:  Edit the Registry   HKLM/Software/Policies/Microsoft/Windows/WindowsUpdate

    Under here I removed the /AU key that was in there.

    On removing the /AU section - all the Windows Update settings are able to be changed without any issues and I can alter any settings from the control panel as expected.

     

     


    Zenotech - Australia
    Saturday, February 19, 2011 2:16 AM
  • The Default setting for Windows 7 Ultimate HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows includes no Name nor Value for WindowsUpdate.

    Something had to set that subkey to prevent the User from changing WU's setting.


    MowGreen
    Windows Expert IT Pro - Consumer Security

    *-343-* FDNY
    NEVER FORGOTTEN

     

    Saturday, February 19, 2011 11:09 PM
    Answerer
  • ****SOLVED****

    I had a 32 bit vista laptop that I erroneously installed "steady state" on. It caused alot of problems. Zenotech's fix worked and fixed auto updates.


    Sunday, March 20, 2011 10:18 PM