After BSOD/recovery I am stripped of many Admin rights, e.g. RIGHT MOUSE CLICK on Services in MSCONFIG ('organizational mode')

You are on an expiring version of Windows 10. version 1909 but you can repair install Windows 10 version 1909 you will need to download a previous version, these are not available direct from Microsoft.

https://tb.rg-adguard.net/public.php allows an ISO image file download from Microsoft servers. Select version 1909 and the latest build, if there is one.

Open File Explorer and mount the ISO then select the new drive letter and run setup. Be sure it offers to keep all files, apps and programs, if not cancel the repair. If you have a USB flash drive with 1909 install media you can use that.

http://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

Thanks for the reply!

The provided respository does not offer the needed ISO file for my Win10 x64 pro.

I will try to locate the proper ISO elsewhere and try my luck with the in-place upgrade repair.

Isn't there a registry modification to reset all messed-up policies  in general?

Being locked out of rights sure make it hard to change them..

I think the best thing to do is the repair install. I'm not aware of any registry fixes for this type of thing.

You should be able to use the build of version 1909 to repair. Any build updates will be applied during the repair.

Thanks! The naming convention 'Windows 10' 'Home' was confusing, as they do not specify the real version like 'pro'.

I tried downloading the suggested ISO in Chrome, but AFTER pulling 5GB it removed the downloaded file with 'Error in Virus scan',.. Interesting, as Defender is officially not running, cannot be activated.

Yet a 'Smartscreen' seems to run, can be stopped and will automatically restart.

But I DO know that the same downloads (of EXE, ZIP etc) WILL work in Firefox on the same compromised system. I will continue to work on this inplace-repair, IF it can fix the registry debacle,

What 'mode' is my Windows running in, if telling me about 'organization managed' updates, blockng me from accessing security measures, blocking right mouse clicks in MSCONFIG's service pane etc?

Its invocation must also have wiped all my restore points I had built over time. 

I DO HAVE a good CCleaner reg backup file left, from Feb 2021. How can I throw this at my confused Windows?

Or how can I inject specfic registry calls, deletes etc in this state? From Safe Mode? From externally manipulating the registry files offline from the O/S?

Very aggravating, not really 'professional' Windows 10..

Within the download filter selectors I don't see a ref to Home or Pro from the link I posted. The ISO contains all files for many editions.

I would never run CCleaner on the registry and honestly wouldn't run it unless I thought something was giving me trouble.

As you use Windows 10 Pro it sounds like there may be some Group Policy settings enabled via gpedit.msc but as I don't use Windows 10 Pro I cannot comment on those.

Are you restricted from creating a new local user as administrator. If not you could try that to see if there are still restrictions on the new account.

In Windows 10 restore points are temporary and get replaced or removed during version updates and if this tool ran some sort of reset then it could have removed the restore points. It obviously didn't run a windows reset or all non native Windows 10 apps and programs would have been removed.

Following other advice I created a new profile with Admin rights in SafeMode. It did get created. But didnot change any behavior, in fact all restrictions I encounter are visible in SM as well. All that while being listed as Adminstrator, albeit being  a toothless tiger with no more power to change anything crucial. Windows behaves as malware itself, keeps my Defender virus protection off, yet has no virus or root kit on board, based on various scan tools, eg KRD from Kaspersky.

I doubt that an in-loco repair/update will fix this, but will give it a try on a drive mirror I have reserved for experiments.

A clean reinstall will throw me back 5-6 years in tweaking my system. Data, databases, photos, docs, mail archives are NOT affected, I keep SEVEN backup copies of these elsewhere around the globe.. I had different recovrry images for my Windoes, but all failed for different reasons, as did the Windows10 original CD

I did use cleaners like Privazer and CCleaner, always let them create fallback copies, never had to use their backups.

There MUST be a way to change the group policy mess from outside or even inside Windoes. Without rights this is of course a tailbiting cat. But virus repair tools do exactly that trickery, yet nobody can suggest good tools like the famous Combofix. It worked well on older Win revisions, bent all broken hooks back, removed rootkit infestations.

Not in Win10.

I'm fishing here as I don't know if this works.

https://www.windowscentral.com/how-reset-local-group-policy-objects-their-default-settings-windows-10#reset_gpedit_settings_cmd_windows10

could you set group policy back to default using a bootable USB flash drive with windows install media by using the command prompt. Using shift + F10 once you have booted from the USB flash drive should open a command prompt.

Or could it work by entering WinRE via Start > Power > (hold down shift) Restart.

Before trying the Inplace-Update Repair I have tried this suggested removal of all UAC and GroupPolicies (as it would make the most sense).  I could do this only once, repeated calls tell me that there is 'nothing left'.

Apparently the command:
RD /S /Q "%WinDir%\System32\GroupPolicyUsers" && RD /S /Q "%WinDir%\System32\GroupPolicy" followed by

grpupdate /force

will wipe the settings out, but the system still reacts in the same restricted way after a reboot.

I am still confronted with the message that system 'settings are maintaned by my organization',

stripping me out of many crucial rights.

As Defender antivirus cannot be started (the Defender Firewall AND SmartScreen ARE running, how weird) I will try to install a 3rd party virus scanner like Avast and then remove it with its special  in-depth deinstallation tool. Hoping that it can re-bend hooks that these virus checkers usually bend on their own, And often causing similar havoc to security settings when deinstalling them incompletely. But a new antivirus app may not even install - will see.

Someone suggested a real brutal-force registry cleanup (maybe only possible from a CD boot command):

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKCU\Software\Policies" /f

reg delete "HKLM\Software\Microsoft\Policies" /f

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f

reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKLM\Software\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f

This looks VERY scary to me, like a "root canal" surgery. Probably bad advice?  Maybe to be tested on yet another mirror drive copy of the O/S first.

The 1909 update/'repair' USB boot stick is ready as my last remedy.

Thanks for the advice and hints!

95% there:

3rd party virus check install/deinstall brought no change, Defender still not functional

ISO update/repair DID change  most, not all issues:

- Defender now fully accessible and running again, that was the biggest risk I had to deal with

- most functions are working under my own profile Admin control: security, update, virtual memory etc.

- MSCONFIG will NOT start as Admin; in regular mode the right click on any service is still blocked

- I still see that some 'settings are maintained by my organization', whoever that may be.

While I can 'live'  with this scenario the Win10 1909 installation remains in a weird and unnormal state, even after the ISO insitu update.

Anything else I could try?

Thanks!

Is there any ref in the Settings > Update and security > Activation screen that shows the licence is via an organisation, or does it show there is a digital licence linked to your Microsoft account?

If you go to Control Panel > Administrative tools > Services (or Search Services and select the top result) are you able to make changes or run as administrator?