Hi,
Last month I noticed that our client PC's, shortly after they had built (using SCCM Task Sequence) were downloading and installing Windows Updates using the usual Windows Update process. What I mean is, I had Software Centre showing Updates as installing,
but also had the Windows Update agent installing various updates. It was also showing in the start menu (Yellow icon saying Shut down and install updates). Now my understanding is, that that shouldn't of been happening, and only SCCM/Software Centre should
be showing Windows Updates as installing.
I noticed that we had some GPO's set for Windows Updates, which I have disabled, as I believed these were not necessary. Also, I like to control my Updates via SCCM Software Update groups after testing them, and not just allow clients to grab any updates
that are required and approved.
My problem now is, none of the clients are getting/installing any updates. I'm getting the following errors in the WUAHandler.log:
Unable to read existing WUA resultant policy. Error = 0x80070002.WUAHandler09/04/2015 19:03:298732 (0x221C)Group policy settings were overwritten by a higher authority (Domain Controller) to: Server and Policy NOT CONFIGUREDWUAHandler09/04/2015 19:03:298732 (0x221C)Failed to Add Update Source for WUAgent of type (2) and id ({FC358571-80C5-4EAA-8A33-F79AD4C14785}). Error = 0x87d00692.WUAHandler09/04/2015 19:03:298732 (0x221C)So, I've checked in:
HKLM\Software\Policies\Microsoft\Windowa\WindowsUpdate\ & HKLM\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate
and neither have a WSUS server set. I'm assuming this is correct?
RSOP shows all policies in \\Computer Configuration\Administrative Templates\Windows Components\Windows Update asDISABLED
GPEDIT shows \\Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location asEnabled and as our server (https://XXX.XXX:8531) - I'm assuming this is what SCCM client sets as if I changed this setting and then restart the setting comes back. If it was a Group Policy conflict then I
would expect to see it in RSOP.
Does anyone have any suggestions? I'm puzzled as to what to look at next. Is my first assumption of having 0 group policies configured for WSUS correct? Am I also correct in assuming Windows Updates shouldn't show in Control panel, or at the Start > Shutdown
prompt, and only show in Software Centre?
Thanks, and sorry for the long winded post!