3

I would just like any user, including non-admin users, to be able to download and install Windows Updates.

When I enter the Settings --> Windows Update menu from any Windows Server 2016 computer or Windows 10 Pro computer on my domain, I see a message on the top of my screen in red that states: Some settings are managed by your organization . At the bottom of the screen it says: This option is managed by your organization

My group policy is as follows:

Computer Configuration

Allow non-administrators to receive update notifications **Enabled** 

Configure Automatic Updates **Disabled** 

Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box **Enabled**  

Remove access to use all Windows Update features **Disabled** 

Turn on recommended updates via Automatic Updates **Enabled** 

Turn on Software Notifications **Enabled**

User Configuration

Do not adjust default option to 'Install Updates and Shut Down' in Shut Down 
Windows dialog box **Enabled** 

Do not display 'Install Updates and Shut Down' option in Shut Down Windows 
dialog box **Enabled**  

Remove access to use all Windows Update features **Disabled**

I have also read that toggling on/off Allow Telemetry setting in the local security policy or from within Group Policy should help as well, but it has no effect in my environment.

I've followed the steps in this article as it seems relevant but still get the same result: Windows Update: can't apply updates even as domain admin on Server 2008 R2

How can I remove this lock on all my computer's Windows Update settings? I would just like any user, including non-admin users, to be able to download and install Windows Updates.

Brian Fleishman
  • 143
  • 2
  • 7

1 Answers1

3

This is your problem:

Remove access to use all Windows Update features **Disabled**

Contrary to all common sense, this setting disables access to Windows Update if it is configured, regardless of whether it is set to Enabled or to Disabled.

Set it to Not Configured and your problem should go away.

On Windows Server 2016, you can make the change effective by running gpupdate on the command line, followed by usoclient StartScan to initiate an update scan. Once the scan is complete the control panel should be active.

On Windows 10, this doesn't work. I haven't found a reliable way of making Windows Update notice the policy change quickly. But it should kick in no later than the next scheduled scan, which by default will be within 24 hours.

Harry Johnston
  • 6,005
  • 4
  • 35
  • 52
  • Is that change effective immediately? Cause I set it to not configured and issued a gpupdate /force on my test server and nothing changed. – Brian Fleishman Nov 22 '19 at 21:48
  • @Brian, see my latest edit. On Windows Server 2016 you can force the change to take place immediately using `usoclient StartScan`, on Windows 10 you just have to wait. I don't know about Windows Server 2019. – Harry Johnston Nov 22 '19 at 22:11
  • That helped me. Thank you. – Brian Fleishman Nov 25 '19 at 13:31
  • I had read a couple of articles and changed a few things - I kept bypassing this one because like you say it contrary to common sense understanding. Having reset all the things I had changed, I made this one change above and its resolved it for me. Thanks P – Philipousis Fandangio Feb 15 '21 at 10:47