GPO for controlling Automatic Update Policies - Ignored

%3CLINGO-SUB%20id%3D%22lingo-sub-1719015%22%20slang%3D%22en-US%22%3EGPO%20for%20controlling%20Automatic%20Update%20Policies%20-%20Ignored%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1719015%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20Morning%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPost%20recent%20updates%20we%20are%20noticing%20that%20a%20number%20of%20our%20configured%20GPO's%20for%20Windows%20Update%20for%20Business%20are%20being%20ignored%2C%20particularly%20troublesome%20is%20the%20%22Configure%20automatic%20updates%22%2C%20we%20have%20this%20set%20to%20%223%20-%20Auto%20download%20and%20notify%20for%20install%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%20all%20the%20servers%20in%20the%20specific%20environment%2C%20including%20our%20DC%20are%20ignoring%20this%20and%20other%20settings%20and%20is%20causing%20havoc%2C%20as%20we%20need%20the%20environment%20to%20be%20up%20daytime%20without%20any%20unwanted%20automatic%20restarts%20etc.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20something%20that%20has%20been%20broken%20post%20recent%20updates%2C%20or%20is%20there%20any%20kind%20of%20hint%20that%20people%20can%20give%20as%20to%20where%20to%20look%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1719015%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EManagement%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1720704%22%20slang%3D%22en-US%22%3ERE%3A%20GPO%20for%20controlling%20Automatic%20Update%20Policies%20-%20Ignored%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1720704%22%20slang%3D%22en-US%22%3EApologies%20if%20this%20is%20all%20stuff%20you've%20tried%2C%20but%20have%20you%20checked%20GP%20inheritance%2C%20enforced%20GPOs%2F%20GPOs%20blocked%20on%20the%20OUs%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1720708%22%20slang%3D%22en-US%22%3ERE%3A%20GPO%20for%20controlling%20Automatic%20Update%20Policies%20-%20Ignored%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1720708%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F811745%22%20target%3D%22_blank%22%3E%40rj07thomas%3C%2FA%3E%26nbsp%3BHey%20no%20worries%20any%20hint%20is%20welcome%20at%20present!%3CBR%20%2F%3E%3CBR%20%2F%3ETo%20verify%20the%20correct%20GPOs%20are%20being%20applied%20I've%20been%20using%20gpresult%20with%20the%20html%20output%2C%20which%20definitely%20shows%20the%20Update%20policy%20being%20applied.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETo%20double%20check%20this%2C%20via%20mmc%20I%20also%20used%20RSoP%20to%20determine%20what%20policies%20are%20being%20applied%2C%20and%20the%20windows%20update%20ones%20should%20definitely%20be%20being%20applied.%20I%20got%20my%20manager%20to%20alter%20the%20GPO%20for%20Windows%20Update(s)%20to%20Enforced%20and%20this%20has%20made%200%20difference.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20even%20(because%20this%20is%20happening%20both%20on%20this%20secondary%20network%20and%20our%20primary%20DC%20with%20Win10%20PC's)%20tried%20to%20apply%20the%20setting%20at%20a%20local%20group%20policy%2C%20and%20the%20Windows%20Update%20screen%20on%20my%20Win%2010%20Machine%20did%20not%20budge%20and%20basically%20ignored%20whatever%20I%20set.%20I've%20even%20validated%20that%20the%20policies%20are%20being%20shown%20in%20the%20Windows%20Update%20App%20and%20within%20the%20Registry%20for%20the%20relevant%20policies.%3CBR%20%2F%3E%3CBR%20%2F%3EAs%20stated%20previously%2C%20this%20is%20only%20happening%20post%20recent%20updates.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Good Morning,

 

Post recent updates we are noticing that a number of our configured GPO's for Windows Update for Business are being ignored, particularly troublesome is the "Configure automatic updates", we have this set to "3 - Auto download and notify for install".

 

Unfortunately all the servers in the specific environment, including our DC are ignoring this and other settings and is causing havoc, as we need the environment to be up daytime without any unwanted automatic restarts etc.

 

Is there something that has been broken post recent updates, or is there any kind of hint that people can give as to where to look? 

 

6 Replies
Highlighted
Apologies if this is all stuff you've tried, but have you checked GP inheritance, enforced GPOs/ GPOs blocked on the OUs?
Highlighted

@rj07thomas Hey no worries any hint is welcome at present!

To verify the correct GPOs are being applied I've been using gpresult with the html output, which definitely shows the Update policy being applied.

 

To double check this, via mmc I also used RSoP to determine what policies are being applied, and the windows update ones should definitely be being applied. I got my manager to alter the GPO for Windows Update(s) to Enforced and this has made 0 difference. 

 

I even (because this is happening both on this secondary network and our primary DC with Win10 PC's) tried to apply the setting at a local group policy, and the Windows Update screen on my Win 10 Machine did not budge and basically ignored whatever I set. I've even validated that the policies are being shown in the Windows Update App and within the Registry for the relevant policies.

As stated previously, this is only happening post recent updates.

 

 

Highlighted

apologies@mhopper29 - made the error of not expanding out your question!

 

This is hardly a fix by any stretch of the imagination, but have you tried running updates via PowerShell to see if that works (yes - I run the actual installation & scheduling of WSUS updates via PowerShell, as GPO just isn't flexible enough imho)

Highlighted

@rj07thomas haha indeed it was written rather in a hurry ... and could you expand on what your proposing as an option? 

Highlighted

@mhopper29ok, I don't think there's anything I need to take out of this and yes, the original source for this was a TechTarget email years and years ago. Just a warning: this will download and install any (and all) updates without any warning or prompting - I guess you could CTRL-C it but it doesn't prompt for anything. After this, worth looking in the WindowsUpdateClient & Setup logs in event viewer.

 

 

#Based on a script from a TechTarget email;
#This is going to automatically download and install updates, not provide options.

#Defines update criteria: we're interested in "software" (i.e. Windows/ Office, not drivers or anything) that are not yet installed
$newUpdateCriteria = "IsInstalled=0 and Type='Software'"

#Search for new updates.
$newUpdateSearcher = New-Object -ComObject Microsoft.Update.Searcher
$newSearchResults = $newUpdateSearcher.Search($newUpdateCriteria)

If ($newSearchResults.updates.Count -eq 0)
{
Write-Host "I couldn't find any updates..."
Start-Sleep 5
}
Else
{
#Download updates.
$updateSession = New-Object -ComObject Microsoft.Update.Session #creates a new update session object
$downloader = $updateSession.CreateUpdateDownloader() #creates an object for downloading the updates
$downloader.Updates = $newSearchResults.Updates #assigns the objects found above to the download object
$downloader.Download() #downloads the updates

#Install updates
$installer = New-Object -ComObject Microsoft.Update.Installer #creates a new update installer object
$installer.Updates = $newSearchResults.Updates #uses the updates from the initial search to populate what to download
$installUpdates = $Installer.Install() #installs the updates

#Reboot if required by updates.

If ($installUpdates.RebootRequired -eq $true)
{
Write-Host "This computer needs to be restarted"
}
Else
{
Write-Host "Reboot NOT required!"
Start-Sleep 5
}
}

Highlighted

@rj07thomas Ah okay ... yes i think I may have stumbled upon this during my hunt on the web for similar issues being reported recently ... it's so disappointing that a GPO that most certainly was working, is now not and being simply ignored.

 

As much as I admire your suggestion and comments, it's not practical as some of the users this affects are not technical users, and would make managing the update setup much more cumbersome. I can only hope that whatever has been broken is fixed soon