System: Windows 7 Ultimate. System was setup and worked without issues - and was set to "Check for updates but let me choose to install ..." - Worked as expected. Machine was then joined to a Windows 2003 Domain - and received settings to automatically install updates, from a WSUS server. - Again as expected. Then: Computer was removed from the domain - No error messages etc, same as I have done to XP machines many times before. BUT: - The ability to change the settings back to "Notify me ..." is still locked - as per settings from DC. I am able to make the required changes directly in the registry (Found settings in a number of other posts), but would like to know a. How to completely 'Free Up' or remove the control that is locking out the ability to use the "control panel" to make required changes. b. What else may be locked still (that I havn't yet found). Yes: I am logged with Admin Rights (Local Administrator), and have not found any other items that I'm locked out of. Also I am administrator of the Domain in question and also have Admin rights. The Local User name is not the same as the domain administrator. I have also logged into the machine with the Domain Admin Logon - and also don't have permissions to change. This is NOT as I expected. (PC not attached to the domain, and again has been removed from the domain as well). Thoughts, Pointers please Thanks.Zenotech - Australia

Was the client's Windows Update settings configured using Group Policy ? Configure Clients Using Group PolicyMowGreen Windows Expert IT Pro - Consumer Security *-343-* FDNY NEVER FORGOTTEN

Process as follows: 1. When Laptop was first setup and used - NOT on the domain. 2 Some time later - Laptop was joined to the domain. 3. Group Policy settings in the AD 2003 system set so all devices on the network receive automatic updates from the local WSUS server. Also there are some other settings so that users can not change file share, proxy settings etc. (A school environment so we lock down a bit). 4 Laptop was then disconnected from the domain ( When removing from te domain, laptop was NOT connected to the domain - I just signed in with Domain Admin rights and removed ). Note: A now have full access to change IE Home Page, Proxy Settings and all other 'locked down' settings that were applied - it is just I am not able to go into the Control Panel, Windows Update tab - and make any changes. It is still locked to the settings that were pushed out with Group Policy. Please clarify my understanding here : IF I remove a machine from the domain, doesn't that also release any Group Policy settings that were pushed out? It appears to at least partially work as I am able to now make changes to all other previously 'locked out' settings that were applied - Or am I in need to going and reading much deeper into Group Policy in Windows AD? Thanks Zenotech - Australia

GPO is definitely not my forte, Zenotech. I believe that this thread describes why LGPO may be in play in this situation - http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/020b7e99-aeea-4227-a7dd-882dbf5bead1 Were client side extensions used when GPO was pushed out ? Troubleshooting Group Policy Client-Side Extension BehaviorMowGreen Windows Expert IT Pro - Consumer Security *-343-* FDNY NEVER FORGOTTEN

Hi, I am just writing to check the status of this thread. Was the information that MowGreen provided in previous reply helpful to you? Do you have any further questions or concerns? Please feel free to let us know. Alex Zhao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Wrote a reply - but it seems to have gone missing. I followed through with the comments above in relation to Local Group Policies, and also read lots about Client Side extensions - though I still am aware of huge gaps in my knowledge of these things. 1. Best of my knowledge - Local Group Policies not involved. 2. Also - As far as I can work out Client Side also not involved. Resolution I have come up with (I have just returned from a 2 day training course and asked some much more knowledgable people there - who also couldn't explain why, but has a work around). My Solution: Edit the Registry HKLM/Software/Policies/Microsoft/Windows/WindowsUpdate Under here I removed the /AU key that was in there. On removing the /AU section - all the Windows Update settings are able to be changed without any issues and I can alter any settings from the control panel as expected. Zenotech - Australia

The Default setting for Windows 7 Ultimate HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows includes no Name nor Value for WindowsUpdate. Something had to set that subkey to prevent the User from changing WU's setting.MowGreen Windows Expert IT Pro - Consumer Security *-343-* FDNY NEVER FORGOTTEN

****SOLVED**** I had a 32 bit vista laptop that I erroneously installed "steady state" on. It caused alot of problems. Zenotech's fix worked and fixed auto updates.