Automatic timezone off and greyed out, related to Location policy?

[ak47uk]

I have an issue where onboarded Windows 11 devices have automatic timezone off and greyed out. It is likely linked with the Location privacy setting.

The OIB policies both look really permissive, I wonder whether another app need to be added to "Let Apps Access Location Force Allow These Apps"? Otherwise, maybe the issue is the "Change Time Zone (Windows Insiders only)" setting.

Just wanted to see if others have the auto timezone setting off and grey?

[SkipToTheEndpoint]

Hey!

So I was actually doing some testing on this earlier this week for a different reason because I noticed that despite the policies in place, the "Let apps access your location" in Privacy & Security > Location is greyed out, and as such all the other settings are too, even though the policy allows user control.
I'm not actually sure the "Change Time Zone" setting is required, because a standard user can already change the time zone themselves, at least on Win11.

Annoyingly, I think the only actual fix for this is the deployment of a PS script to change the following reg keys:

HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\Value - Value "Allow"
HKLM:\SYSTEM\CurrentControlSet\Services\tzautoupdate\start - Value "3"
HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}\SensorPermissionState - Value "1"

So I wouldn't call this a bug with the policies, more that there's a disconnect to how they work, and no control to enable the tzautoupdate reg key. I'll continue to feed this back to MS.

[SkipToTheEndpoint]

So the behaviour I'm seeing on this currently (apart from it being missing entirely still being an official issue) is that without the User Rights policy at all (i.e. Default behaviour), I can change the Time Zone fine via Control Panel. This is on both newly built devices (so they never got the policy), but also devices that previously had the policy set to S-1-5-544, patched to the December '24 CU.

If someone else can test this to see if there's consistency of behaviour?

[GittyKitty89]

So the behaviour I'm seeing on this currently (apart from it being missing entirely still being an official issue) is that without the User Rights policy at all (i.e. Default behaviour), I can change the Time Zone fine via Control Panel. This is on both newly built devices (so they never got the policy), but also devices that previously had the policy set to S-1-5-544, patched to the December '24 CU.

If someone else can test this to see if there's consistency of behaviour?

My findings:

• For Win 11 24H2 without any OIB policy you can change time zone from control panel, but not from time settings UI
• If Change Time Zone is applied as is in OIB to 24H2, change time zone in local security policies becomes blank or has local service only, and you cannot change from control panel
• If you remove the OIB policy for change time zone - issue persists, no adjustment are made to local security policy on policy removal, it stays blank / local service only
• If you manually add users or groups to change time zone in local security policy, even after the OIB change time zone policy has been removed, it will revert to blank / local service only after some time. Config refresh seems to have no effect on fixing the tattooing of the CSP
• If you apply a new policy from Intune for change time zone, set it to: Administrators, Local Service, Users it will allow changing from the control panel. You can then remove this policy from Intune, and the membership of local security policy sticks

[incedIT]

So the behaviour I'm seeing on this currently (apart from it being missing entirely still being an official issue) is that without the User Rights policy at all (i.e. Default behaviour), I can change the Time Zone fine via Control Panel. This is on both newly built devices (so they never got the policy), but also devices that previously had the policy set to S-1-5-544, patched to the December '24 CU.

If someone else can test this to see if there's consistency of behaviour?

Winver 24H2, December update (KB5048667) installed and latest OIB applied. When a standard user tries to change the timezone in control panel, error message:
"Unable to continue" "You do not have permission to perform this task. Please contact your computer administrator for help."
Like before the Dec update, only LOCAL SERVICE is listed with perms to change time zone.

[SkipToTheEndpoint]

Thanks for your input!
Some behaviour definitely changed which has ended up breaking this.
I was going to remove the User Rights as part of v3.4, but instead I'm going to change the rights to basically enforce the default and configure:
*S-1-5-19 - LOCAL SERVICE
*S-1-5-32-544 - Administrators
*S-1-5-32-545 - Users

I've tested this works on 24H2 with both Dec and Jan CU's, and it should resolve any residual issues with devices that had S-1-5-4 as part of the v3.1 policy.

[SkipToTheEndpoint]

Just following up again, but the 24H2 Preview update (KB5050094 has the following fix documented:

[Settings] New! You can change time zones in Settings > Time & Language > Date & Time. You don’t have to be an admin to make this change.

So the UI issue should (hopefully) be resolved from the Feb CU!