Forum Discussion
Automatic update settigns misconfigured alerts on autopatch mgmt status
I logged a case with Intune support and got below response after hours of troubleshooting; I am unsure where is the stale GPO policy is coming from.
During troubleshooting, we reviewed an affected device and observed that under Settings > Windows Update > Advanced options > Configured update policies, the following setting was present:
Configure automatic updates
Value: 1 (Disable automatic updates)
Type: Group Policy
At the same time, we also verified that the device is receiving the expected Intune/MDM Windows Update for Business policies, including:
Configure automatic updates = Value 2 (Auto install updates at maintenance window)
Multiple Windows Update for Business settings showing Type: Mobile Device Management (MDM)
This indicates that the device is receiving the intended Intune update configuration, while Windows is simultaneously detecting a separate Group Policy-based configuration that disables automatic updates. This conflicting configuration is what Windows Autopatch identifies and reports as "Automatic update settings misconfigured."
From our investigation, this does not appear to be an Intune configuration issue because:
The affected devices are Microsoft Entra joined and are successfully receiving Windows Update for Business policies from Intune.
The Intune update ring settings are being applied correctly and are visible under the MDM-managed policies.
A previously affected device was remediated and now reports correctly, confirming that Windows Autopatch and Intune update ring configurations are functioning as expected.
The issue is related to a conflicting Group Policy-style update configuration that Windows continues to detect on the device, rather than a failure of Intune policy deployment.
Additionally, we observed that affected devices had previously been domain joined and were also managed through an RMM solution. This suggests that legacy Windows Update policy configurations may still be present on some devices and are being interpreted by Windows as Group Policy settings, leading to the Autopatch alert.
Since one device has already been successfully remediated, the recommended next step is to compare the remediated device against the remaining affected devices to identify the common configuration causing Windows to report:
Configure automatic updates = 1 (Disable automatic updates)
Once the source of this legacy configuration is identified, it can be remediated across the remaining affected devices, after which Windows Autopatch should reevaluate the devices and clear the alerts.
Based on the evidence collected so far, the issue is not caused by Intune update ring deployment or Windows Autopatch functionality itself, but by a conflicting Windows Update policy detected locally on the affected devices.
1 Reply
The Intune policy is arriving, but Autopatch is correctly detecting a second policy source that sets automatic updates to disabled. On an affected device, run gpresult /h gp.html and rsop.msc, then inspect Computer Configuration, Windows Components, Windows Update. Compare that output with the remediated device. Also check HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU: NoAutoUpdate=1 is one of the conflict values Autopatch monitors. Trace and remove the source first—old Local Group Policy from the image, an RMM agent, or Configuration Manager software-update client settings—otherwise the value will return. After confirming the source, target only affected Autopatch devices with an Intune remediation that removes the conflicting value, then run policy sync, reboot, and allow reporting to refresh. Verify the MDM policy separately under HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update or export the MDM diagnostic report. If NoAutoUpdate reappears, capture its return time and inspect the responsible management agent rather than repeatedly deleting the registry value.
