3

Windows 10 introduced a new computer group policy, "Remove access to use all Windows Update features", which blocks access to the Windows Update control panel. You can turn this on in group policy and then make the client see the change by scanning for updates.

When you turn the group policy off, however, you have a bit of a chicken and egg problem, because scanning for updates from the control panel is still blocked. With the control panel blocked, you can't start a scan, and without a scan, the control panel will remain blocked.

In v1607, after turning the setting off in group policy you could make the client see the change by running "usoclient StartScan" at the command line.

In v1809 this no longer works.

Is there another solution? I tried "usoclient RefreshSettings" but this didn't work either. The change will kick in eventually (by default, automatic scans occur every 16-20 hours) but if I'm trying to, e.g., install updates during a scheduled outage then eventually isn't really good enough. Doing a scan through the API doesn't work either.

NB: I am talking about the computer group policy setting, not the user group policy setting of the same name, which very unfortunately is no longer supported in Windows 10.

Addendum: the problem is not that the group policy hasn't been processed yet; running gpupdate or gpupdate /force does not help. All that does is make sure the registry key has been correctly modified, it has no way of forcing the Windows Update client to actually look at the registry key.

Improve this question
1
  • Not a full answer, but have you tried playing with wuauclt? It might be the bump you need.
    – Tim Brigham
    Feb 13, 2019 at 20:48

3 Answers 3

Reset to default
2

Have you tried wuauclt / usoclient to force reporting?

Improve this answer
0

You can trigger a GPO Refresh by using the following command:

gpupdate

Then, you may have to restart the computer. If it's not working, you can use gpupdate /force.

Improve this answer
1
  • No, this doesn't work. The problem isn't that the group policy hasn't been processed yet, the problem is that the Windows Update client only looks at the policy when it does a scan. I'll update the question to make this clearer.
    – Harry Johnston
    Feb 13, 2019 at 20:36
0

To expand on Tim's answer, after changing the group policy run

wuauclt /ReportNow

and wait about 30-60 seconds. It is not necessary to reboot, or even to close and reopen the Windows Update control panel.

Improve this answer
1
  • ... this doesn't always work. Back to square one, I guess.
    – Harry Johnston
    Feb 15, 2019 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.