Forum Discussion

hpssa's avatar
hpssa
New Contributor
4 months ago

Disable 1Password Updates

Our organisation has the following best practice security implementations

  • Block running executables in folders writeable to the user (ie. %appdata%)
  • End-users are not local administrators to their device

We deploy 1Password for Windows using automation and the application is installed as a machine-level application installed at C:\Program Files\1Password

A recent change is that 1Password now prompts the user to complete updating the app, however the user is unable to perform the update as they require administrator privileges.

We update 1Password automatically already on a schedule and would like to disable 1Password updates altogether using a central method (ie. registry, scripted, 1Password pushed-policy, etc).

How can we disable updates?

Thanks.

best practices
windows

5 Replies

  • hpssa's avatar
    hpssa
    New Contributor
    3 months ago

    Thank you! We use winget to perform the updates, but can pass this to the installer. I'll get this implemented, thank you!

  • TSC-Dean's avatar
    TSC-Dean
    New Contributor
    3 months ago

    Also see the community discussion "Expected behaviour of the (newish) MANAGED_UPDATE=1 MSI deployment parameter".

    You mention that your deployments are scheduled and automated - are you using a patch management solution?

  • 1P_SimonH's avatar
    1P_SimonH
    Icon for Community Manager rankCommunity Manager
    4 months ago

    Hi hpssa,

    Good question! Are you using the MSI installer for deployment? If so, are you using the option described here to turn on managed updates? Let me know if you're already doing that, but still seeing the behavior you described.

    • hpssa's avatar
      hpssa
      New Contributor
      2 months ago

      How can I retroactively change these settings without needing to reinstall?

      • hpssa's avatar
        hpssa
        New Contributor
        2 months ago

        Replying to myself for future reference.

        When using the MANAGED_INSTALL and MANAGED_UPDATE options of the MSI, the following registry settings are applied to a machine-scoped install

        @ HKEY_LOCAL_MACHINE\SOFTWARE\Agilebits Inc.\{04B64D44-52BF-41A6-85BA-CDBA63AEB44D}
        MANAGED_INSTALL=1 (REG_SZ)
        MANAGED_UPDATE=1 (REG_SZ)

        @ HKEY_LOCAL_MACHINE\SOFTWARE\Agilebits Inc.\1Password
        ManagedInstall=1 (REG_SZ)
        ManagedUpdated=1 (REG_SZ)

        This may not be accurate in the future as AgileBits haven't disclosed this method of making this adjustment without requiring a reinstall. They should though in my opinion. Having to reinstall is a PITA.