Fix: Location Cannot Be Turned On in Windows 10/11
Why This Is Happening
I've seen this exact scenario on hundreds of machines. You go to Settings → Privacy & Security → Location, you try to flip the toggle on, and instead of it just turning on, you get that maddening gray toggle and a message that reads: "Some settings are managed by your organization" or "Your organization must make changes to this setting." And you're sitting there thinking , I am the organization. It's my personal laptop.
I know how frustrating this is, especially when you're trying to use Maps, weather apps, or anything that relies on location data. The fix exists. Let's talk about why it happens first, because understanding the root cause will save you from going in circles.
Windows has a layered policy system. When a Group Policy or Mobile Device Management (MDM) policy is in place that disables location services, the toggle in Settings gets locked out, even for administrators. The policy always wins over the GUI toggle. What's sneaky about this situation is that these policies can be left behind long after the source is gone.
Here are the four most common reasons this happens on a "personal" PC:
- Leftover work or school account. You once signed into your organization's Microsoft 365 or Azure AD account on this machine. Even after you thought you removed it, the MDM enrollment or associated policies can persist in the registry and in the device's enrollment records.
- Stale MDM enrollment (Microsoft Intune). If your employer ever enrolled this device in Microsoft Intune, even briefly, Intune could have pushed a configuration profile that disables location. Unenrolling the account doesn't always scrub those policies automatically.
- Local Group Policy was set manually. Someone (maybe a previous owner, a repair shop, or a "privacy hardening" guide you followed) ran
gpedit.mscand toggled the "Turn off location" policy to Enabled. It's now sitting there blocking you silently. - Registry policy key written directly. Third-party privacy tools, things like O&O ShutUp10, privacy "debloaters," or enterprise imaging scripts, sometimes write directly to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensorswith aDisableLocationvalue of1. The GUI has no idea why it's blocked, so it just shows the generic "organization" message.
The fix isn't complicated once you know which of these four scenarios you're dealing with. Most of the time it's one of the first two. Browse all Microsoft fix guides →
The Quick Fix, Try This First
Before you dive into registry edits and Group Policy, try this. It resolves the location cannot be turned on problem in roughly 60% of cases and takes under three minutes.
You're going to check whether your PC still thinks it belongs to an organization, and disconnect it if so.
- Press Win + I to open Settings.
- Go to Accounts → Access work or school.
- Look at every entry listed there. If you see anything, a work email, a school domain, anything labeled "Connected to [Organization] Azure AD" or "Enrolled in [Organization]'s device management", click it once to expand it.
- Click Disconnect (for school/work accounts) or Info → Disconnect if it's an MDM enrollment.
- Confirm the disconnection when prompted. Windows may ask for your local account password.
- Restart your PC. This step is non-negotiable, policies often don't flush until a reboot.
- After the restart, go back to Settings → Privacy & Security → Location and try the toggle again.
If the toggle is still grayed out, don't worry, the remaining steps will handle it. But many people have a stale school or work account they genuinely forgot about, and this alone clears the policy lock.
dsregcmd /status in an elevated Command Prompt before you start. Look at the output lines for AzureAdJoined, DomainJoined, and MDMEnrollmentUrl. If any of those say YES or contain a URL, your machine still has an active organizational connection, and that's your smoking gun.
Before touching anything else, let's get a ground-truth snapshot of your machine's enrollment state. This tells you exactly what kind of organizational connection Windows still thinks exists.
Right-click the Start button and choose Terminal (Admin) or Command Prompt (Admin). At the prompt, type:
dsregcmd /statusThe output will be a few sections. Focus on the Device State section at the top. Here's what each line means for your situation:
AzureAdJoined : YES, Your PC is joined to an Azure AD tenant. This is a corporate join, not just an account added in Settings.WorkplaceJoined : YES, A work or school account has registered this device. Less severe than a full join, but still capable of pushing policies.MDMEnrollmentUrl : https://enrollment.manage.microsoft.com/..., Your machine is or was enrolled in Microsoft Intune (or another MDM). This is very likely your culprit for the location cannot be turned on error.DomainJoined : YES, You're on a corporate Active Directory domain. Less common for home PCs but possible on machines that were previously used in an office environment.
Screenshot or copy this output. You'll want it for reference as you go through the next steps. If everything says NO and MDM URLs are blank, skip to Step 3, the issue is a local Group Policy or a registry key written by a third-party tool rather than a live organizational connection.
If dsregcmd /status showed any active connections, this step removes them properly. Going through Settings → Accounts → Access work or school is the right way to do this, don't try to hack around it with registry deletes first, because Windows needs to send an unenrollment signal to the MDM server when possible.
Open Settings → Accounts → Access work or school. For every connected account or enrollment:
- Click the entry to expand it.
- Click Disconnect.
- In the confirmation dialog, click Yes. If prompted for credentials, use your local Windows administrator account password, not the work email password.
If you see an entry that says something like "Connected to [Company] Azure AD" with no Disconnect button, only an Info button, your machine may be Azure AD joined rather than just registered. That's a harder remove. See the Advanced section below for that scenario.
After removing all accounts, run this command in an elevated PowerShell to force a policy refresh:
gpupdate /forceThen restart. After the reboot, check Settings → Privacy & Security → Location. If the toggle is now interactive, you're done. If it's still locked, move to Step 3, there are residual policy keys to clean up.
This is the step that fixes location cannot be turned on in most of the remaining cases. Even after removing work accounts, MDM policies they pushed often leave registry values behind. Windows reads these keys at startup and re-applies the restrictions, so the account being gone doesn't automatically undo the damage.
Press Win + R, type regedit, and hit Enter. When UAC prompts, click Yes.
Navigate to this path (you can paste it directly into the address bar at the top of Registry Editor):
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensorsIf the LocationAndSensors key exists, look in the right pane for a value named DisableLocation. If it's there and set to 1, that's your lock. You have two options:
- Option A (recommended): Right-click
DisableLocationand choose Delete. This removes the restriction entirely. - Option B: Double-click
DisableLocation, change the Value data from1to0, and click OK. This keeps the key but sets it to "not disabled."
Now check the user-level policy path too:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensorsDelete any DisableLocation value you find there as well. Close Registry Editor and restart your PC. After the reboot, the location toggle should be fully functional again.
If the registry approach didn't work, or if you want to confirm and fix the Group Policy setting at the source rather than just patching the registry value it wrote, use the Local Group Policy Editor. Note: this tool is available on Windows 10/11 Pro, Enterprise, and Education editions. If you're on Windows Home, skip to the Advanced section for a PowerShell alternative.
Press Win + R, type gpedit.msc, and hit Enter.
In the left-hand tree, navigate to:
Computer Configuration
└── Administrative Templates
└── Windows Components
└── Location and SensorsIn the right pane, you'll see several policies. The one you're looking for is "Turn off location". Double-click it.
Check the current state. If it says Enabled, that's your problem. Change it to Not Configured, not Disabled, but Not Configured. The distinction matters: "Disabled" technically means "disable the policy that turns off location," which should work, but "Not Configured" is cleaner and leaves no ambiguity.
Click Apply, then OK. Then open an elevated Command Prompt and run:
gpupdate /forceWait for it to complete, you'll see "Computer Policy update has completed successfully." Restart, and go check your location settings. The toggle should now respond normally.
Once the system-level location toggle is back under your control, you may find that individual apps still can't access location. This is a separate layer of permissions, fixing the master switch doesn't automatically re-grant per-app access, especially if those permissions were also locked down by the same policies.
Go to Settings → Privacy & Security → Location. You'll now see three sub-sections:
- Location services, the master toggle. Make sure this is On.
- Allow apps to access your location, a second toggle that controls whether the OS even routes location requests to apps. Turn this On.
- Let apps access your location, a per-app list. Scroll through and turn on location access for specific apps you want to use it: Maps, Weather, Edge, and any third-party apps listed there.
For desktop apps (not Store apps), look for the "Allow desktop apps to access your location" toggle further down the same page and make sure it's enabled too.
If specific apps still report no location access even with all toggles on, try this PowerShell command which resets app permission states for the current user:
Get-AppxPackage -AllUsers | Reset-AppxPackageThat's a heavier reset, it won't delete your app data, but it resets permission grants. After it runs, open each app once and when Windows asks "Allow [App] to access your location?", choose Allow.
Advanced Troubleshooting
Windows Home Edition, No gpedit.msc Available
Windows Home doesn't ship with the Group Policy Editor, so you can't use Step 4 above directly. But you can accomplish the same thing via PowerShell. Open PowerShell as Administrator and run:
# Delete the HKLM policy key for location
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" -Name "DisableLocation" -ErrorAction SilentlyContinue
# Delete the HKCU policy key for location
Remove-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" -Name "DisableLocation" -ErrorAction SilentlyContinue
# Force a policy refresh
gpupdate /forceThe -ErrorAction SilentlyContinue flag means the command won't error out if the key doesn't exist, it'll just move on. This is safe to run even if you're not sure whether the key is present.
Azure AD Joined Machines, No Disconnect Button
If your PC is fully Azure AD joined (the dsregcmd /status output showed AzureAdJoined : YES) and you can't find a Disconnect option in Settings, the removal path is different. You need to unjoin from Azure AD, which is a more significant operation.
Go to Settings → Accounts → Access work or school, click the Azure AD connection, then Info, then scroll down to find Disconnect this device from organization. This option sometimes only appears if you scroll. Alternatively, run:
dsregcmd /leaveThis forces an Azure AD disjoin. You'll need to reboot twice, once for the disjoin to process, once more to flush cached policies. After both reboots, check location services.
Using Event Viewer to Diagnose Policy Source
If you want to know exactly which policy is blocking location services and where it came from, Event Viewer can help. Press Win + R, type eventvwr.msc. Navigate to:
Applications and Services Logs
└── Microsoft
└── Windows
└── GroupPolicy
└── OperationalLook for events with ID 4016 (policy processing started) or ID 5016 (policy processing completed). Event ID 7016 is particularly useful, it logs when a policy setting is applied along with the source GPO name. If you see location-related policies being applied there from an unexpected source (like an MDM GUID), that tells you the MDM enrollment is still active even if it doesn't appear in Settings.
Third-Party Privacy Tools Wrote the Keys
If you've run O&O ShutUp10, WPD (Windows Privacy Dashboard), Privatezilla, or any "Windows debloater" script, those tools almost certainly wrote the DisableLocation registry key as part of their privacy hardening. Open the tool again and look for a "Location" or "Privacy" section, there will be a toggle to re-enable it. Then run the registry cleanup from Step 3 to confirm the value was cleared, and reboot.
dsregcmd /status continues to show MDM enrollment even after you've disconnected, there may be a corrupted enrollment record that needs to be cleared from the Microsoft Intune service side. At that point, contact Microsoft Support and specifically ask for help with "removing a stale MDM enrollment record from a personal device." They can clear it from the backend in about 20 minutes.
Prevention & Best Practices
The location cannot be turned on problem almost always traces back to one moment: connecting a personal machine to a work or school account without realizing the full implications. Microsoft makes it very easy to add a work account, one click from Settings, enter your work email, done. What it doesn't make obvious is that adding that account can trigger an automatic MDM enrollment, especially if your organization has auto-enrollment configured in Intune. The moment enrollment happens, policy profiles start flowing to your device.
The best way to use work accounts on personal hardware without this risk is to use a browser-only approach. Instead of adding your work Microsoft 365 account in Settings → Accounts, just open Edge or Chrome, go to office.com, and sign in there. Keep it at the browser level. You get all the same access to Outlook, Teams web, SharePoint, and OneDrive, without letting the OS itself get enrolled in your employer's MDM.
If you genuinely need an app like the desktop Outlook or Teams installed, you can install them and sign in to the app without registering the device in Settings. Just make sure when you sign in to a Microsoft app and it asks "Register your device with [Organization]?", you always click No or This app only.
It's also worth auditing the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows registry path every few months if you regularly connect to various organizational accounts. Any subkeys under that Policies path represent active policy restrictions. If a key exists for something you don't want restricted, you can safely delete it as long as you understand what it controls.
- Never add a work or school account in Settings → Accounts on a personal PC, use browser-only access instead.
- Before running any "privacy tool" or debloater script, read exactly what registry keys it writes, and keep a log so you can undo them later.
- Run
dsregcmd /statusquarterly to check your PC hasn't been silently enrolled in an MDM by an app or account change. - After any major software installation or account change, verify Settings → Privacy & Security → Location is still in the state you expect.
Frequently Asked Questions
Why does Windows say "your organization must make changes" when I don't have an organization?
Windows displays this message any time a policy is blocking a setting, regardless of whether that policy came from an active employer, a past account you've since removed, or a third-party tool that wrote a policy key directly to the registry. The OS doesn't distinguish between "this is a live corporate policy" and "this is an old key someone wrote two years ago." All it sees is a value in HKEY_LOCAL_MACHINE\SOFTWARE\Policies and it locks the toggle. Deleting that registry key, as described in Step 3, removes the restriction entirely.
I removed my work account from Settings but location is still blocked, why?
Removing the account from Settings → Accounts → Access work or school disconnects the account login but doesn't always scrub the policy values that MDM already pushed to your registry. Think of it like uninstalling an app but leaving its configuration files behind. You need to manually delete the DisableLocation registry value at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors as described in Step 3, and then restart. That cleans up what the account removal left behind.
Will deleting the registry key in Step 3 break anything else on my PC?
No. The DisableLocation value under LocationAndSensors does exactly one thing: it tells Windows to block location services. Deleting it returns that setting to its default, which is user-controlled. It won't affect any other apps, settings, or system components. If you're nervous, you can rename the value instead of deleting it (right-click → Rename, add _BACKUP to the name), that neutralizes it without permanent deletion, and you can rename it back if something breaks unexpectedly.
My location toggle is on but apps still say they can't access my location, what's wrong?
The master location toggle and per-app location permissions are separate layers. Even with the master toggle on, each app needs its own permission granted. Go to Settings → Privacy & Security → Location and scroll down to the per-app list. Make sure both "Allow apps to access your location" (the second toggle) and the specific app's toggle are both turned on. For non-Store desktop apps, also enable "Allow desktop apps to access your location" further down the same page.
Can I fix the location cannot be turned on error without editing the registry manually?
Yes, on Windows Pro and above, use the Group Policy Editor (gpedit.msc) as described in Step 4. Navigate to Computer Configuration → Administrative Templates → Windows Components → Location and Sensors and set "Turn off location" to Not Configured. That achieves exactly the same result as the registry edit but through a safer GUI. On Windows Home, you don't have gpedit.msc, so the PowerShell command in the Advanced section is your cleanest alternative to a manual registry edit.
I ran dsregcmd /status and it shows MDMEnrollmentUrl but I don't recognize the URL, what is it?
That URL is the MDM enrollment endpoint your machine registered with. Common ones include https://enrollment.manage.microsoft.com (Microsoft Intune), https://enterpriseenrollment.something.com (on-premise MDM), or URLs from third-party MDM providers like Jamf or MobileIron. If you recognize the domain as a past employer or school, proceed with dsregcmd /leave and the disconnect steps in Step 2. If the URL is completely unrecognizable and you never connected to any organization, it's worth investigating further before blindly running dsregcmd /leave, in rare cases it could indicate an unwanted management profile was installed by software you downloaded.