Your system administrator has blocked upgrades on this PC

Topic

New Reply

I still don’t know how the Get Windows 10 icon got stuck on domain-joined computers, but it’s there. Admins I know are, rightfully, livid. Microsoft’s
[See the full post at: Your system administrator has blocked upgrades on this PC]

Reply | Quote

Replies

If by ‘system administrator’ you mean the master account on the specific pc, then no worries here.

Reply | Quote

So, It’s just blocking upgrades, & not updates?

Reply | Quote

In Microsoftspeak, an “upgrade” is a biggie, like moving from Win7 to Win10, or from RTM Win10 (build 10420) to the Fall Update, Win10 version 1511.

An “update” is a patch.

Since there are no Service Packs, there’s no ambiguity, I think.

Reply | Quote

In this case, “System administrator” refers to the person or people who are responsible for running a domain.

The terminology’s confusing. On a specific computer, there’s an “administrator” account, which is different.

Reply | Quote

Does anyone know yet which update causes this nagware to start showing up in the system tray on domain-joined machines? I’ve gotten only two reports so far, and it looks like they may have installed all updates manually including optional updates.

Reply | Quote

I haven’t seen the culprit identified as yet.

Reply | Quote

@woody I can confirm that in a managed environment with WSUS there is a section called ‘Upgrades’ which was introduced after patching WSUS running on Windows 2012 R2. There is an upgrading option even for the Enterprise version of Windows 7 which comes as a patch which needs to be approved by the WSUS administrator, however I didn’t test the effects. If not approved, then it does not appear to the end users. Otherwise, I think it is meant to do an in place upgrade based on the EULA agreement pre-approved by the WSUS admins, even if in theory the Enterprise version is not upgradeable in place.

Reply | Quote

Does no one at Microsoft stop to think before they do stuff like this? How could anyone possibly believe that this was a good idea?

Trying to force sysadmins to upgrade to Windows 10, then shaming them when they don’t. I have nothing but disdain left for this company.

Reply | Quote

You’re not alone.

Reply | Quote

The Technet link you posted links to the solution to this problem:

https://support.microsoft.com/en-us/kb/3080351

Two “blocks” are required, one blocking Windows Update from installing the upgrade, and the second blocking the little notification icon in the system tray.

If a system administrator implements the first block, but not the second, the upgrade is blocked but not the system tray icon. When the user clicks on the system tray icon, the user sees the message “Your system administrator has blocked upgrades on this PC.”

So the message means exactly what it says: the system admin is not allowing you to upgrade.

If the system admin implements the second block (which must be done by updating the registry), the notification icon will not appear in the system tray, the user will not be able to click on it, and no message appears.

Additional references:

http://www.infoworld.com/article/3020748/microsoft-windows/how-get-windows-10-sets-its-hooks-into-windows-7-and-81.html

http://www.zdnet.com/article/how-to-block-windows-10-upgrades-on-your-business-network-and-at-home-too/

Reply | Quote

That’s precisely correct. I’m happy to say that GWX Control Panel flips both of those switches.

Reply | Quote

Hey, Woody.

Remember me? Long time ago (late 90s), the anti-virus guy who then was living in Iceland and was doing macro virus research. 🙂

Anyone, on topic. The culprit might be KB3138612 which was pushed with the March patch and seems related to the Windows Update client. Needs to be investigated further. I’ll ask around.

Reply | Quote

HI! Hey, how are you? What’ve you been up to? (Shoot me mail, woody@askwoody.com)

I installed 3138612 and tried to trigger that banner ad. Didn’t see anything, but hope springs eternal.

Reply | Quote

It’s not a March patch because I have multiple machines that have yet to install March patches and the nagware icon appeared yesterday on all of them. I suspect the reissue of the dreaded KB3035583 released in late February and installed between Feb 26 to 29. Could it be timed to misdirect everyone to March patches? That’s even more evil. The machines are all part of a domain but not using WSUS. And GPO set to not allow upgrade. Very annoying and disturbing!

Reply | Quote

I wonder if there was a timer inside 3035583 that says, essentially, “After March 9, on Win7 and 8.1 machines attached to a domain, if DisableGWX isn’t flipped, start blaming the admins.”

Reply | Quote

In my WSUS config I have “Updates” disabled in the Classifications. I’m guessing if someone has that one ticked, it could have snuck in there. So far on our test rollout PCs (W7) nothing’s shown up, I plan on releasing the ones I’ve tested to the general population next week.

Just to be safe, though, I did also deny installation of 3138612, until we hear clarification over its content/purpose.

Although this worries me now if Microsoft offers an “Update Rollup” which incorporates all these nasty nagware patches in one.

Reply | Quote

The ad to upgrade has to be approved by the same sysadmins who are supposed to know what is all about, although Microsoft has recently tried to confuse even those who take care of their product.

Reply | Quote

I think Mark Berry provided the full solution which was presented before on this site and on InfoWorld. Probably GWX Control Panel did the work much easier for those who use that software. Why making things more complicated than they are? Or is there anything that I am missing?

Reply | Quote

I think Mark’s comment nails it quite precisely.

Reply | Quote

This whole Windows 10 period will probably become material for a case study at the Harvard Business School. It is great material, duly spanning issues of financial and marketing strategy and corporate ethical behavior. Some of the things currently being done by MS are so stupid that the decisions surely had to be made by a team. There seems to be a serious need for adult supervision.

Reply | Quote

Here, here.

Reply | Quote

Adult supervision? I think your average toddler has a better grasp than the PHB’s running MS. I agree this will probably become a series of case studies in (mis)management and destruction of a flagship brand.

Reply | Quote

The Win8 and win10 debacles have resulted in slowing sales for MS, thus lessening profits. When profits mysteriously lower, the bean counters are forced to take responsibility and thus get to have more “say” in how to fix “the problem”.

So now not only do you have misguided too young software design gurus (little experience in business computing for a generation or 2) trying to catch up with Apple, Chrome and Linux, now you also get young bean counters who are even more clueless in computer human interface psychology, making software decisions mostly about making profit.

I’m now retired after a career in the computer biz. Over that time I learned Unix and was dragged into Windows support and observed Windows source code move from proprietary to Unix like, even while MS was damning Unix publicly.

My wife taught school for 30+ years mostly using MS computers due to govt authorized monopoly (and privacy access?). Every time MS changed their OS, I had to console my wife’s tears and frustration, and figure out how to hack the school’s computers so she could do something as basic as print out her students’ homework and district reports, and show her how things had changed using the mouse to do basic stuff. She was luckier than other teachers. No employer computer training for her. Happy wife, happy life.

Problem is, the young “whippersnappers” at MS don’t appreciate the simple things because their success depends on latest computer technology expertise. The typical computer user just wants to do simple things quickly so they can think about THEIR REAL job, not computer s**t.

If I may suggest to MS, put all your new hires in a school classroom, in a school district that cannot provide computer training 4 times a year, or in a business that cannot provide computer training 4 times a year, for at least 6-12 months. Now set those new hires loose on developing the next version of Windows. I would also suggest MS employees actually go to a school district and figure out how to make hundreds or thousands of printers work with a new operating system that doesn’t support 10 year old printers or special educational applications.

I have 4 motor vehicles at home that are over 10 years old (family vehicles). The newest vehicle that is only 10 years old is a kawasaki motorcycle sidecar outfit from 2006. I guess the US is lucky in that we can still use 10+ year old motor vehicles, but 10 year old computers really suck due to lack of support by manufacturers. Also, my washer, dryer and refrigerator are over 10 years old and still do their jobs.

lenkf

Reply | Quote