Home / server / Questions / 796119
Accepted
Mike S
Asked: 2016-08-11 14:18:00 +0800 CST

Windows Update Group Policy Removed but still shows up on Workstation

  • 772

I have a new Windows 7 SP1 workstation. Installation of updates failed, in part I believe because of a misconfigured AD domain controller. So I went through a lot of trouble on the workstation to get the updates to work (installing patches and deleting the below-mentioned registry entry), and I also went to the group policy editor in my Domain Controller and told it to no longer control Windows Updates in my domain. But hours later the workstation still says "Some settings are managed by your system administrator" in the windows update settings control panel, and I notice that- after I had removed HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate using regedit, and performed the updates- it is now back with the old settings (I can see that WUServer has the old entry in it).

My domain controller is running on Windows Server 2003 :-( (old, I know). How do I tell it to stop trying to control updates in the domain?

I had gone to the Group Policy Object Editor in the domain controller and changed all settings in Computer Configuration->Administrative Templates->Windows Components->Windows Update so that the state for each setting is "Not Configured". I also went to User Configuration->Administrative Templates->Windows Components->Windows Updates and made sure that all of those states are "Not configured".

I went to the Workstation and ran gpupdate /force in a cmd window as Administrator. I also have waited some hours since making these changes.

Still, it has reared its ugly head. How can I tell the domain controller to leave my poor workstations alone?

Ultimately, I want to configure a new domain controller with Windows 2012 r2 but I need the updates running nowish, and I'm too green to feel comfortable slamming an upgraded DC into place so I can get a supported solution. I just need this strange little problem to go away for right now.

windows group-policy active-directory

2 Answers

  1. Best Answer

    I went to the Group Policy Object Editor and changed all settings in Computer Configuration->Administrative Templates->Windows Components->Windows Update so that the state for each setting is "Not Configured". I also went to User Configuration->Administrative Templates->Windows Components->Windows Updates and made sure that all of those states are "Not configured".

    Do you mean that you did this on the local machine? If so, then you've modified the local Group Policy and not the domain Group Policy. You need to edit/modify the domain Group Policy by using the Group Policy Management Console on your Domain Controller.

    • 2

  2. As it turns out, there are a number of items in the Group Policies that control your domain. For a neophyte like myself, the methods are myriad and daunting. Thanks to @joeqwerty, this is what I discovered:

    1. You can have local group policies and domain group policies. Make sure you are controlling the domain, by entering the Group Policy Editor from the Group Policy Management (GPM) window.
    2. Inside GPM, you drill down into your Forest, then Domain, then your specific domain name. There you will see a list of items. My settings were in more than one of the items, including the Default Domain Policy and the Small Business Server Update Services Client Computer Policy.
    3. Go to the workstation in question. We need to find which group policies are applied to my computer and account. See http://www.howtogeek.com/116184/how-to-see-which-group-policies-are-applied-to-your-pc-and-user-account/ . Specifically, from the Start Menu->Run box, enter rsop.msc
    4. There, you'll find all the policy settings that were applied to the machine. Drill through them to find the setting that seems to apply.
    5. Right click on it and chose "Properties". Click on the Precedence tab. It will show you the GPO Name that made this apply.
    6. Go back to the Domain Controller, and find that Policy. Go into it and shut it off.
    7. Wait a couple hours for the Group Policies to propagate, or run in an Administrator command prompt: gpupdate /force
    8. Rerun rsop.msc and review your settings.
    • 2