Uninstallation is not possible because a policy does not allow it. Error 25200

Hi David,

Can you let me know the case reference that you have logged with support and will personally look into this for you?

Bill.

I had this issue recently.

Off the top of my head....

Have you uninstalled the configuration for the old policy? Make sure there is NO configuration listed in Add/Remove

Rebooted

On console I created two policies - Machine settings and Device Protection

Modified both to include NO encryption and uninstall allowed

On console I created a new group - added in my two new policies

Created a new config package with the new policy group as base.

Exported the new package.

Copied package onto client

Installed new package

Rebooted.

Logged back in and was able to decrypt and uninstall.

If more info comes to me I'll post it but I "think" those were all the stages?

Images to help - excuse most of the content blanked out!!

BillKearney the case number is #7156888. Thanks for looking into it.

Hi Michael:

This is more or less what I did, but there are some small differences in our approaches. I'll try following your example by the letter and see how it goes.

Thanks,

David

Michael:

Nope, still no joy. Followed your example to the letter and I still get the same error message. I even turned on Airplane mode so the policy doesn't get overwritten before I have a chance to uninstall.

Thanks anyway.

How odd!!

Is it worth trying to create a group, applying the policy to the group, add  the computer to the group and re synchronising?

Unless you have another setting allowing the client to stay I still think it's not reading the new configuration?

On train home now but I'll try looking a little later to see it I've missed anything?

Checking the RSOP I can see that someone set the encryption/no uninstall policy to No Override. I've turned that off, added the decryption/uninstall policy to an OU, moved the machine to that OU, resynchronized everything, but it looks like the domain encryption/no uninstall policy is still a higher priority than the OU decryption/uninstall policy. How do I prioritize the OU policy over the domain policy?

Great, good progress well done!

Create a group outside of AD. Right click new group etc...

Then apply the remove policy you've created to this group. Make the computer a member of this group and you can disable inheritance so it doesn't look at other policies.

If you get stuck I'll boot up mine and have a look with some screenshots?

https://www.sophos.com/en-us/medialibrary/PDFs/documentation/sgn_7_ig_eng_installation.pdf?la=en

I know you're V8 but same guide applies - P72 onwards gives you the steps including selecting no override to enforce this particular policy...

Hold on if you'd like screenshots. Damn VPN client not installed on this laptop.....