Ryfujk

I open the Windows Update control panel, and it says "some settings are managed by your system administrator." Problem is, I'm logged in as a domain admin.

Tried so far:

• Searched the output of gpresult /z (see this previous SF question) for references to Windows Update, but everything there looked OK.


• Searched the registry, and found a few more settings that looked relevant, but everything seemed to be set correctly.


• Checked with gpedit to try to find anything suspicious


• Checked with RSoP, confirmed that "Configure Automatic Updates" and "Allow Automatic Updates immediate installation" are enabled.

Everything looks fine. I logged out, logged back in (as domain admin), and I still can't manually check for updates or apply them. I just get that "some settings are managed by your system administrator" message.

Where else could this be disabled?

EDIT: Just found this in the event viewer -- could it be related?

Log Name:      Application

Source:        Microsoft-Windows-CAPI2

Event ID:      4107

Description:

Failed extract of third-party root list from auto update cab at:

<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> 

with error: A required certificate is not within its validity period when 

verifying against the current system clock or the timestamp in the signed file.

David's comments were helpful. Further to David's Answer, found a similar key

ComputerHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

NoWindowsUpdate (REG_DWORD) - changed value from 1 to 0 - fixed it.

Start, Run, gpedit.msc,
Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Windows Update
Configure Automatic Updates, Enable, Choose option 5

Double check to see if there is a DWORD entry called DisableWindowsUpdate located under the following registry key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesWindowsUpdate 

If this key exists and has a value of 1, change it to 0.

I've seen this when trying to update the SUS server itself. It wants to run it's updates through SUS directly.

for me it was in HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesWindowsUpdateDisableWindowsUpdateAccess

I set it to 0

I had to search for the key "DisableWindowsUpdateAccess" from HKLM. On our server it was located under HKLMSOFTWAREWOW6432NODEPOLICIESMICROSOFTWINDOWSWINDOWSUPDATE To note: Our server had been managed by NCentral (Solarwinds) and the agent managed the updates. I'm sure this was changed or modified by their agent. Windows Update didn't automatically start working after the agent was removed. We had to modify this key and now it works. (And had to reboot after editing the key).

I had to do both

Start, Run, gpedit.msc, Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Windows Update Configure Automatic Updates, Enable, Choose option 5

and

HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesWindowsUpdateDisableWindowsUpdateAccess and set it to 0