Bug: Windows 10 Pro Education: This policy is blocked - its value will be ignored

[Gunnar Haslinger]

This Bug affects only the "Windows 10 Pro Education" edition.

All Policies which are documented as "This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management." do not work on "Pro Education" Edition of Windows 10. All other Policies still work as expected, but Policies like HomepageLocation, DefaultSearchProvider, RestoreOnStartUpURLs etc... which need an MDM-Enrolled or AD-Joined Device don't work. 

They are ignored and edge://policy shows: 
"Error: This policy is blocked - its value will be ignored." 

How to reproduce this behavior:

• Fresh Installation of "Windows 10 Pro Education" 20H2 ISO Image in Hyper-V VM
• Applying all Patches (Windows Update)
• Install Edge (Stable, Beta, Dev, Canary).
• Enroll to MDM
• Set the Policies

Win10 Edition / Version / Build:

• Window Edition: Microsoft Windows 10 Pro Education
• Version: 10.0.19042 (= 20H2, Patches from November 2020 Patch-Tuesday applied)

Tested with:

• Edge v86.0.622.68 (Stable) => ERROR, Ignored
• Edge v87.0.664.30 (Beta) => ERROR, Ignored
• Edge v88.0.692.0 (Dev) => ERROR, Ignored
• Edge v88.0.698.0 (Can) => ERROR, Ignored

Microsoft Documentation says: Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. ... are able to configure the product to have similar feature settings to Windows 10 Pro Education using policies.

=> So I guess "Windows 10 Pro Education" should support the same Policies as "Pro"

Upgrade to "Windows 10 Pro" => Policies Work!

Just activate a "Windows 10 Pro" Key like the GLVK listed here in the documentation => Edge Policies instantly start to work! Not even a reboot is needed, just restart Edge and it works after applying the new GVLK.

So I tested through the various Editions:

• Windows 10 Home => Not supported, does not work because Home cannot be MDM-Managed, this is documented - so that's OK
• Windows 10 Pro Education => ERROR, Ignored - doesn't work, see description in this Issue above
• Windows 10 Pro => Works
• Windows 10 Education => Works
• Windows 10 Enterprise => Works

Some month ago I reported a similar Bug to this one here, thanks to @Deleted and @josh_bodner it was fixed - so I hope you guys can have a look at this bug too and report this to the right team.

[#2]

@Gunnar Haslinger Thanks for reaching out. I'm tagging in @Kelly_Y, who should be able to loop in our Enterprise and EDU teams.

Fawkes (they/them)
Program Manager & Community Manager - Microsoft Edge

[#3]

Thanks, @Deleted !

@Gunnar Haslinger Hello!  Yes, I've reached out to some folks on the team and we will follow up with updates.  Thanks!

-Kelly

[#4 · Accepted solution]

@Kelly_Y  

@Gunnar Haslinger  thank you for the report! Kelly got in touch and I was able to setup and reproduce the problem. You are correct in that we were incorrectly categorizing the Professional Education edition which resulted the "sensitive" policies always getting filtered out.

I have a fix ready that we will get in as soon as we can.

[#5]

Edge Can Version 88.0.704.0 already seems to include the Bugfix and respects the policies on Win10 Pro Education as expected.

Hope Dev/Beta/Stable get this update too soon.

[#6]

@Gunnar Haslinger this will also be available in  87.0.664.53.

[#7]

Hi @mkruger and @Kelly_Y,

I like to re-open this issue, because the same problem occurs with "Windows 10 Pro for Workstations".

I just re-tested following three browser Versions:

• Edge v91.0.864.41 (Stable)
• Edge v92.0.902.9 (Beta)
• Edge v93.0.910.5 (Dev)

On todays most actual Win10-OS Version: Win10 v21H1 Build 19043.1052

I tested following Windows 10 Editions (SKUs / KMS Keys see https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys)

Windows 10 Enterprise: OK

Windows 10 Pro: OK

Windows 10 Pro for Workstations: ERROR!

Windows 10 Pro Education: OK

Windows 10 Education: OK

"OK" means my Policy shows no Errors, all "Status" Fields are OK.

"Error" means following result: "Error, Ignored - This policy is blocked - its value will be ignored."

All Policies which are documented as "This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain or Windows 10 Pro or Enterprise instances enrolled for device management." do not work on "Windows 10 Pro for Workstations" Edition of Windows 10. All other Policies still work as expected, but Policies like HomepageLocation, DefaultSearchProvider, RestoreOnStartUpURLs etc... which need an MDM-Enrolled or AD-Joined Device don't work in my MDM-registerd Policy-Setup. 

[#8]

Ping @Kelly_Y : seems @mkruger is currently not active in the techcommunity. May I please ask you to forward my previous post in this thread to somebody who can fix this?

[#9]

@Gunnar Haslinger Sure!  Let me check with the team or @mkruger directly.  Thanks! 

-Kelly

[#10]

@Kelly_Y & @Gunnar Haslinger 

I am not as active as I'd like to be, but try to drop in from time to time!

I will work to get Windows 10 Pro for Workstation properly identified in Edge.

[#11]

@Gunnar Haslinger & @Kelly_Y :

Windows 10 Pro for Workstations should be properly identified starting in version 93.0.930.0.

Give it a try when that version makes it to Canary/Dev/Beta and let us know if there are further problems.

[#12]

Thanks @mkruger for fixing this issue.
I just tested with Edge Canary Version 93.0.932.0 on Windows 10 Pro for Workstations (20H1) and I can confirm it works now as expected with the "Pro for Workstations" SKU.

I guess @pieterdezwart gives you a "like" too :)

Thanks @Kelly_Y for notifying the team.

[#13]

I have this problemen with Azure Virtual Desktop.
Azure Virtual Desktop is running "Windows 10 Enterprise multi-session" SKU
Tested with Edge 96.0.1054.43 stable and edge 97.0.1072.21 beta both don't work .

[#14]

@Rene_880  We recently made a change for the Azure Virtual Desktop SKUs to correct this in Edge version 98.0.1085 and later. At this time, the change is available in the Dev releases if you'd like to test it.

[#15]

Just tested the dev release i can confirm it works.
Thanks @mkruger for fixing this.

[#16]

@mkruger I got messages that "Windows 10 IoT Enterprise LTSC 2021 21H2" seems to be not recognized as valid SKU. I haven't tested myself as I have no access to this Release - but maybe you can check this?

[#17]

@Gunnar Haslinger  we got word of IoT Enterprise LTSC not working and made a fix in February 2022. This SKU should be identified as an enterprise SKU and sensitive policies working in version 100 (100.0.1185 specifically). This is currently in beta but soon to be stable. 

IoT Enterprise is a bit of a tricky SKU to get and test. It is a virtual SKU, where you need a specific product key that is applied to the professional SKU to migrate the SKU to IoT Enterprise. I was never able to track down a VHD or ISO for it.

[#18]

@mkruger I got messages that "Windows 10 Pro N in Windows 10 Pro x64 21H2 February 2022 install.wim" seems to be not recognized as valid SKU. I haven't tested myself yet - but maybe you can check this?

[#19]

Looks like Pro N may be miss categorized here.