How to tell if MDM or group policy app is on my computer preventing me from resetting my location settings.

Question

How to tell if MDM or group policy app is on my computer preventing me from resetting my location settings.

Answer 1

Hello

Did you see an error message somewhere that says the settings is managed by organization settings? If so, try this:

First, can you please go to Settings > Accounts > Access Work or School, and make sure there's no work/school email address listed there, or no mentioning of Azure AD. If there is, please click on it and then click on disconnect. Then restart the computer and see if it is resolved.

If not, or if nothing is listed there, please type cmd in the search on the taskbar and make sure you select "Run As Administrator" to launch Command Prompt.

Then run the following command and hit enter:

gpupdate /force /boot

Restart the computer and see if it helps. If not, launch Command Prompt in Admin mode again and run the following commands, one at a time. Not all of them will go through completely or value can be found, and that's ok. Once finished, restart the computer again and see if it works.

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKLM\Software\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKCU\Software\Policies" /f
reg delete "HKLM\Software\Microsoft\Policies" /f

Answer 2

On Windows 11, location settings can be locked by either:

• MDM/Intune or other device management policies
• Local/Domain Group Policy
• Third‑party privacy tools

To check for management or policy control, use these steps.

1. Check if the device is managed (MDM/organization)

• Open Settings > Accounts > Access work or school.
• If an organizational account is connected and shows something like “This device is managed by your organization” or similar, MDM or Azure AD/Intune may be enforcing privacy/location policies.
• Also in Settings > Privacy & security > Location, look for messages like “Some settings are managed by your organization”; this indicates policy control.

2. Check Group Policy for location restrictions If running Windows 11 Pro or higher:
3. Press Win + R, type gpedit.msc, press Enter.
4. Check Remote Desktop location redirection policy (can indirectly affect location behavior in remote sessions):
   • Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.
   • Open Do not allow location redirection.
   • To avoid blocking redirection, this should be Disabled or Not configured.
5. Check app privacy policies for location:
   • Go to Computer Configuration > Administrative Templates > Windows Components > App Privacy.
   • Look for Let Windows apps access location and any related per‑app entries.
   • If set to enforce “Force deny,” apps and some UI options for location can appear locked.
6. Check registry keys used by Group Policy / MDM Only if comfortable with Registry Editor:
7. Press Win + R, type regedit, press Enter.
8. Navigate to:
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location
     • Value name: Value
     • If this is set to Deny or similar, location is blocked at the device level.
   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy
     • This key is where the Let Windows apps access location policy maps. Presence of values here indicates Group Policy/MDM is controlling app access to location.
9. If these values revert after a reboot, that strongly indicates an active policy (Group Policy or MDM) is pushing them.
10. Check for MDM privacy policies (Intune / Policy CSP) On managed devices, MDM can enforce the Privacy CSP policies:

• LetAppsAccessLocation (default for all apps) with values:
  • 0 = User in control
  • 1 = Force allow
  • 2 = Force deny (most restrictive)
• LetAppsAccessLocation_ForceAllowTheseApps, LetAppsAccessLocation_ForceDenyTheseApps, LetAppsAccessLocation_UserInControlOfTheseApps for per‑app control. If the device is enrolled in MDM and location is greyed out or always reverts, these policies may be set to force deny.

5. Check for third‑party privacy tools If Group Policy and MDM are not present but location is still greyed out and changes revert, a privacy tool may be enforcing settings. For example, tools like SpyBot AntiBeacon can disable sensors/location and revert changes after reboot. In such tools, disabling or unchecking sensor/location blocking options and rebooting can restore control of location settings.

If the device is part of an organization (work/school), contact the IT admin; only they can change MDM/Group Policy that locks location.

---

References:

• Policy CSP - Privacy
• Configure location redirection over the Remote Desktop Protocol (azure-virtual-desktop)
• Configure location redirection over the Remote Desktop Protocol (windows-365)
• Configure location redirection over the Remote Desktop Protocol (dev-box)
• Location Services greyed out - Microsoft Q&A