GPO to disable automatic updates Office365 is in registry but Office 365 still updates (local domain)

Question

In our local domain we have Windows 10 21H2 with office 365. We want to prevent that all our 1000+ machines update automatically (VDI environment) so we implemented an GPO to disable the updates. The settings are in the registry but looks like office ignores the settings and is still updating automatically

Answer 1

This could be due to several reasons, such as the GPO not applying correctly, conflicts with other settings, or Office 365 ignoring the registry setting due to its configuration.

Here’s a step-by-step approach to troubleshoot and potentially resolve this issue:

Step 1: Verify the GPO Settings

• Confirm the Registry Key: Make sure that the registry key you've set through the GPO is correct. For Office 365 (now Microsoft 365 Apps for enterprise), the registry path to disable updates is typically:

    Copy code
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate
    
  

  And the key should be updatebranch with a value that corresponds to a specific update channel or DisableUpdates set to 1 to completely disable updates. Force Update Group Policy: On a client machine, run gpupdate /force in the Command Prompt to make sure all GPOs are updated. Then, check if the registry has been updated accordingly by using regedit.

Step 2: Check Application of GPO

Resultant Set of Policy (RSoP): Run the Resultant Set of Policy via rsop.msc on a client machine to see if the GPO is being applied correctly. This tool shows which policies are applied to the machine and from which GPO.

Group Policy Results Wizard: Use the Group Policy Results Wizard in the Group Policy Management Console (GPMC) on your server to check the actual policies applied to specific machines or users.

Step 3: Review Office 365 Configuration

Office Deployment Tool (ODT): If Office 365 was installed with the Office Deployment Tool, the configuration file used for installation might have specified settings for updates. You may need to modify this configuration to disable updates.

Office 365 Admin Center: Check if there are any settings in the Office 365 Admin Center that might be overriding local GPO settings. Sometimes, update settings configured from the cloud can override local settings.

Step 4: Additional Troubleshooting

Check for Conflicts: Ensure that there are no conflicting policies set through other GPOs. Sometimes, multiple GPOs might attempt to set different settings for the same feature.

Logging and Diagnostics: Enable logging for Group Policy processing to check for errors or warnings that might indicate why the policy isn't applying. You can do this via Event Viewer under Applications and Services Logs -> Microsoft -> Windows -> GroupPolicy -> Operational.

Consult Documentation: Review the latest Microsoft documentation on managing updates for Microsoft 365 Apps, as paths and best practices might change with updates.

If you continue to experience issues after following these steps, you might consider a more controlled update management approach using tools like Windows Server Update Services (WSUS) or Configuration Manager, which allow more granular control over software updates in a domain environment. This could be due to several reasons, such as the GPO not applying correctly, conflicts with other settings, or Office 365 ignoring the registry setting due to its configuration.

Here’s a step-by-step approach to troubleshoot and potentially resolve this issue:

Step 1: Verify the GPO Settings

Confirm the Registry Key: Make sure that the registry key you've set through the GPO is correct. For Office 365 (now Microsoft 365 Apps for enterprise), the registry path to disable updates is typically:

Copy code
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate

And the key should be updatebranch with a value that corresponds to a specific update channel or DisableUpdates set to 1 to completely disable updates.

Force Update Group Policy: On a client machine, run gpupdate /force in the Command Prompt to make sure all GPOs are updated. Then, check if the registry has been updated accordingly by using regedit.

Step 2: Check Application of GPO

Resultant Set of Policy (RSoP): Run the Resultant Set of Policy via rsop.msc on a client machine to see if the GPO is being applied correctly. This tool shows which policies are applied to the machine and from which GPO.

Group Policy Results Wizard: Use the Group Policy Results Wizard in the Group Policy Management Console (GPMC) on your server to check the actual policies applied to specific machines or users.

Step 3: Review Office 365 Configuration

Office Deployment Tool (ODT): If Office 365 was installed with the Office Deployment Tool, the configuration file used for installation might have specified settings for updates. You may need to modify this configuration to disable updates.

Office 365 Admin Center: Check if there are any settings in the Office 365 Admin Center that might be overriding local GPO settings. Sometimes, update settings configured from the cloud can override local settings.

Step 4: Additional Troubleshooting

Check for Conflicts: Ensure that there are no conflicting policies set through other GPOs. Sometimes, multiple GPOs might attempt to set different settings for the same feature.

Logging and Diagnostics: Enable logging for Group Policy processing to check for errors or warnings that might indicate why the policy isn't applying. You can do this via Event Viewer under Applications and Services Logs -> Microsoft -> Windows -> GroupPolicy -> Operational.

Consult Documentation: Review the latest Microsoft documentation on managing updates for Microsoft 365 Apps, as paths and best practices might change with updates.