Competing device configuration policies on the same device - which one wins?

%3CLINGO-SUB%20id%3D%22lingo-sub-1829833%22%20slang%3D%22en-US%22%3ECompeting%20device%20configuration%20policies%20on%20the%20same%20device%20-%20which%20one%20wins%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1829833%22%20slang%3D%22en-US%22%3E%3CP%3EQuestion%20is%20about%20Windows%20Update%20policies.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPolicy%201%3A%20Offer%20feature%20update%20after%205%20days%3CBR%20%2F%3EScope%3A%20All%20devices%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPolicy%202%3A%20Offer%20feature%20update%20after%20180%20days%3CBR%20%2F%3EScope%3A%20Test%20group%20(with%20devices%20only)%20'Intune-Dev-W10-SlowUpd'%20-%20listed%20under%20'excluded%20groups'%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%222020-10-28%2022_08_45.png%22%20style%3D%22width%3A%20393px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F229934iB6EDC72093DF53AC%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%222020-10-28%2022_08_45.png%22%20alt%3D%222020-10-28%2022_08_45.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EResult%3A%20Both%20policies%20are%20assigned%20to%20the%20device.%20Policy%201%20to%20the%20'system%20user'.%20Policy%202%20to%20the%20owner%20of%20the%20device.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%222020-10-28%2021_51_31.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F229933iC8E34219A09E3AC2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%222020-10-28%2021_51_31.png%22%20alt%3D%222020-10-28%2021_51_31.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhich%20policy%20'wins'%20here%3F%20Say%3A%20Which%20policy%20is%20used%3F%3C%2FP%3E%3CP%3EAnd%20how%20can%20I%20control%20that%20on%20the%20device%3F%20(Logs%2C%20registry%20keys%20or%20similar)%3F%3C%2FP%3E%3CP%3EAnd%20do%20I%20RELIABLY%20prevent%20with%20these%20policies%20that%20under%20no%20circumstances%20a%20feature%20update%20younger%20than%20180%20days%20is%20offered%20on%20the%20device%3F%3C%2FP%3E%3CP%3EHow%20do%20get%20rid%20of%20'system%20account'%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1829833%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1834413%22%20slang%3D%22en-US%22%3ERe%3A%20Competing%20device%20configuration%20policies%20on%20the%20same%20device%20-%20which%20one%20wins%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1834413%22%20slang%3D%22en-US%22%3EIntune%20is%20really%20bad%20at%20handling%20conflicts.%20There%20is%20no%20real%20way%20to%20know%20which%20setting%20will%20win%20now%2C%20you%20could%20check%20it%20in%20the%20registry.%3CBR%20%2F%3E%3CBR%20%2F%3EIt's%20advised%20to%20exclude%20the%20devices%20in%20the%20previous%20policy%20and%20not%20let%20the%20same%20policy%20land%20twice%20on%20the%20same%20device.%3C%2FLINGO-BODY%3E
Contributor

Question is about Windows Update policies.

 

Policy 1: Offer feature update after 5 days
Scope: All devices

 

Policy 2: Offer feature update after 180 days
Scope: Test group (with devices only) 'Intune-Dev-W10-SlowUpd' - listed under 'excluded groups'

 

2020-10-28 22_08_45.png

 

Result: Both policies are assigned to the device. Policy 1 to the 'system user'. Policy 2 to the owner of the device.

 

2020-10-28 21_51_31.png

 

Which policy 'wins' here? Say: Which policy is used?

And how can I control that on the device? (Logs, registry keys or similar)?

And do I RELIABLY prevent with these policies that under no circumstances a feature update younger than 180 days is offered on the device?

How do get rid of 'system account'?

 

1 Reply
Intune is really bad at handling conflicts. There is no real way to know which setting will win now, you could check it in the registry.

It's advised to exclude the devices in the previous policy and not let the same policy land twice on the same device.