Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I open the Windows Update control panel, and it says "some settings are managed by your system administrator." Problem is, I'm logged in as a domain admin.

Tried so far:

  • Searched the output of gpresult /z (see this previous SF question) for references to Windows Update, but everything there looked OK.
  • Searched the registry, and found a few more settings that looked relevant, but everything seemed to be set correctly.
  • Checked with gpedit to try to find anything suspicious
  • Checked with RSoP, confirmed that "Configure Automatic Updates" and "Allow Automatic Updates immediate installation" are enabled.

Everything looks fine. I logged out, logged back in (as domain admin), and I still can't manually check for updates or apply them. I just get that "some settings are managed by your system administrator" message.

Where else could this be disabled?

EDIT: Just found this in the event viewer -- could it be related?

Log Name:      Application
Source:        Microsoft-Windows-CAPI2
Event ID:      4107
Failed extract of third-party root list from auto update cab at:
with error: A required certificate is not within its validity period when 
verifying against the current system clock or the timestamp in the signed file.
share|improve this question
It's gotta be a policy...either a local one or a GPO through AD. Do a gpresult /H /Z and really look through it paying attention to the Windows Update sections especially. – TheCleaner Aug 8 '12 at 12:55
@TheCleaner: there's no longer anything in the gpresult /z output related to WindowsUpdate that looks at all suspicious. Is there anything else I should be looking for? – Jesse Aug 8 '12 at 18:44

David's comments were helpful. Further to David's Answer, found a similar key


NoWindowsUpdate (REG_DWORD) - changed value from 1 to 0 - fixed it.

share|improve this answer

Start, Run, gpedit.msc, Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Windows Update Configure Automatic Updates, Enable, Choose option 5

share|improve this answer
Tried this; no luck. Tried to explicitly make my domain admin account a local admin, and hit another snag:… – Jesse Aug 8 '12 at 15:08

Double check to see if there is a DWORD entry called DisableWindowsUpdate located under the following registry key:


If this key exists and has a value of 1, change it to 0.

share|improve this answer
This key did exist (with value 0). I deleted it, but the Windows Update control panel was not affected. – Jesse Aug 8 '12 at 14:42
This fixed it for me except there is a typo in the path above: "\windowsupdage" should be "\windowsupdate". – Jordan Rieger Sep 11 '13 at 21:37

I've seen this when trying to update the SUS server itself. It wants to run it's updates through SUS directly.

share|improve this answer
How can I tell if this is an SUS server? – Jesse Aug 8 '12 at 14:43
You would know. SUS, or WSUS, is Windows Server Update Services. It's the mechanism you use to cache windows updates locally, so that you don't have to download the same updates once for each computer every month. – Joel Coel Aug 8 '12 at 15:26

for me it was in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\DisableWindowsUpdateAccess

I set it to 0

share|improve this answer
Thanks. This fixed the issue for me as well. – Makotosan Mar 13 '15 at 15:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.