{"version":"2.1.302","anchor":"managed-windows-registry-settings-held-until-trusted","canonical_anchor":"managed-windows-registry-settings-held-until-trusted","heading":"Managed settings from the Windows registry are held back until they can be trusted","tier":"notice","area":"Managed Settings","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.302\/e\/managed-windows-registry-settings-held-until-trusted","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.302","markdown":"### Managed settings from the Windows registry are held back until they can be trusted\n\nClaude Code now checks who owns and can edit Windows registry managed settings before applying them, and holds them back if the check fails\n\n**Unclear.** When this check runs, and on exactly which systems, is not settled.\n\n**What**\n\nManaged settings are settings an organization's administrator sets for everyone. On Windows they can come from the registry, under HKLM or HKCU. Changes:\n\n- Before trusting these registry settings, Claude Code checks the owners and access permissions of the location they come from. If the check fails, the settings are held back instead of applied. Before, they were always read directly.\n\n- The loader now reports where it looked (`whereAsked`) and which documents it held (`heldDocuments`, kept as `mdmHeldDocuments`). The \"MDM settings found\" log now reports from that record.\n\n- If a flag needed for the check cannot be read, a `withheldFlagRecord` is added to the settings errors when only held documents are involved, before some errors are turned into warnings.\n\n- The test for whether an administrator policy still applies changed and gained a second lookup used when `heldOnly` is not true.\n\n- At startup, settings are applied and managed settings are loaded before the rest of setup.\n\n**Why**\n\nOn Windows, managed settings that fail the ownership check are not applied, and you may see a related error or warning. Administrators should make sure the registry location has the expected owner and permissions.\n\n- Area: Managed Settings\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: both\n- Heads-up: yes"}