Understanding the pause config refresh remote action for Windows devices

This week is sort of a follow up on a post of almost a year ago about scheduling automatic policy refreshes for Windows devices without requiring a check-in. While that post was focused on actually scheduling automatic policy refreshes for Windows devices, by using Config Refresh, this post will be focused on temporarily pausing that scheduled policy refresh. Temporarily pausing the scheduled policy refreshes provides the IT administrator with a window for troubleshooting the device. Without pausing the scheduled policy refreshes, the supported configurations will automatically refresh their policies. That can be pretty disturbing when verifying specific behavior with specific configurations. So, pausing the automatic policy refreshes is an important piece of the scheduled policy refresh. Automatic policy refresh relies on Config Refresh that is part of the the DMClient CSP. This post will start with briefly explaining the remote action to pause the policy refresh, followed with the behavior on the Windows device.

Important: Keep in mind that Config Refresh is available for Windows 11 starting with the non-security update of May 2024 and the security update of June 2024.

Note: Keep in mind that Config Refresh is mainly designed to work with policies that are managed by the Policy CSP.

Pausing the automatic policy refresh

When looking at pausing the configured automatic policy refresh, it’s important to understand the basics of how it’s working. Those basics are all about how the pause is configured. Luckily, the answer is pretty straight forward and actually already answered in the previous blog about that was mentioned earlier. Config Refresh was introduced as part of the DMClient CSP and contains three policy settings: 1) Enabled, 2) Cadence, and 3) PausePeriod. The first policy setting is used to enable Config Refresh and the second policy setting is used to configure the refresh cadence of Config Refresh. The third and last policy setting is used to configure the pause period in minutes for Config Refresh. This is the policy setting that is used by the remote action in Microsoft Intune. That remote action is Pause config refresh and can be used to pause the automatic refresh. Using that remote action is actually pretty straight forward for Windows 11 devices. The following four steps walk through the restoration of a specific configuration profile.

1. Open the Microsoft Intune admin center portal navigate to Device > All devices
2. On the Devices | All devices page, select the required device and click on … > Pause config refresh
3. On the Pause config refresh blade, as shown below in Figure 1, specify the time period for the pause and click Pause

Note: Pausing the automatic policy refresh can be done for a period between 0 and 1440 minutes.

Experiencing the paused policy refresh

When looking at the device, after pausing the automatic policy refresh, there are a few important things that change. Especially when looking at the Config Refresh configuration. The registry key for ConfigRefresh, as shown below in Figure 2 on the left, now contains an additional value PausePeriod that contains the time period to paus the policy refresh. That, however, isn’t the only important change. The Scheduled Task, as shown below in Figure 2 on the right, that was created for the automatic policy refreshes, now has a different next run time. And not only that, the trigger of that Scheduled Task is now also changed to the next run time. That next run time will be exactly the time that the remote was successful (see the Microsoft Intune admin center) plus the time period that was provided to pause the policy refresh.

Note: Keep in mind that to see the Scheduled Task, the user must be a local administrator on the device.

More information

For more information about (remotely pausing the) configuration refresh, refer to the following docs.

• DMClient CSP – Windows Client Management | Microsoft Learn