Forum Discussion

Andrew_Allston's avatar
Andrew_Allston
Iron Contributor
Feb 15, 2023
This is SUPER useful information. I have been pulling my hair out for over a week with about 20 PCs that rolled back (or maybe never updated) from 2103 (?!?!) This just answered my question, seems that a super old GPO wrote a that build to the registry of these PCs. But there is no GPO doing that now so this was hard to figure out.

Quick follow up, do you know if there is a setting that sets the IgnoreGPO key? Or just push the key itself?
manoth_msft's avatar
manoth_msft
Icon for Microsoft rankMicrosoft
Feb 16, 2023
The IgnoreGPO key is set by the servicing profile based on if a device is in scope of profiles or not (see https://learn.microsoft.com/en-us/deployoffice/fieldnotes/adopt-servicing-profiles#how-a-servicing-profile-is-applied-to-a-device; the sentence "These devices will also receive commands that instruct the local Office Update Engine to ignore commands that are coming from other management solutions" is referring to IgnoreGPO being set.)

We do not recommend to set the IgnoreGPO manually. I would rather nuke the targetversion keys if those are left-overs from GPOs which are no longer applied.
  • manoth_msft's avatar
    manoth_msft
    Icon for Microsoft rankMicrosoft
    Sep 17, 2024

    brenzphi If you want to offboard just a subset of devices, then I would recommend excluding those using an Entra group: https://learn.microsoft.com/en-us/microsoft-365-apps/admin-center/cloud-update#exclude-groups.

    For fully disabling Cloud Update, check out https://learn.microsoft.com/en-us/microsoft-365-apps/admin-center/cloud-update#cloud-update-review-deactivation.

    After excluding devices or disabling the profile, device will automatically be offboarded (ignoreGPO=0) on next check-in. Please allow at least 24h for processing.

     

    Note: Using the Channel Change feature in Inventory will enable the cloud update profiles again, so if you go for disabling the whole profile, omit using this feature to prevent the profile from being re-enabled and onboarding devices again.

  • brenzphi's avatar
    brenzphi
    Copper Contributor
    Sep 16, 2024
    Thanks for insides.

    So how to disable Cloud Update and revert back to GPO Management aka. `IgnoreGPO = 0` ?
  • Andrew_Allston's avatar
    Andrew_Allston
    Iron Contributor
    Mar 01, 2023
    Martin, again this info is GREAT! But just to pick your brain a bit, I have a few PCs listed as managed in the config.office.com console but the ignoregpo key is set to 0. Any idea why this would be? We still have duplicate AD computers in our directory since we are in Hybrid, so i was thinking maybe config.office.com is adding the unused dupe computer account but the computers are actively communicating with Config.office.com. And it's only a subset of computers. I may try to update the key manually on a test machine, but I would love any insight you might have on this.

Resources