Home / server / Questions / 995502
Accepted
user145837
Asked: 2019-12-14 10:58:12 +0800 CST

Purge all WSUS settings from Windows 2016 domain Win10 windows fleet

  • 772

I have a windows domain that, at one time, used a WSUS server.

This setup wasn't well maintained, and I wanted to stop using it.

I removed the GPO, but it seems that many machines still think the domain: "specifies target server to host updates"

How can I get the Windows 10 fleet to use normal, default Windows updates?

Windows Upgrade Assistant successfully moves the machine to a current patch level, but the machines in question continue NOT looking to MS for updates.

windows

2 Answers

  1. Best Answer

    Here's how I eventually got the hard-core non-updating windows 10 machines back to normal.

    • Restart
    • Log in as a local administrator
    • Stop Windows Update and Background Intelligent Transfer services
    • Clear out c:\windows\softwaredistribution\
    • Clear out c:\windows\system32\grouppolicy
    • gpupdate /force
    • Restart

    In SOME cases, the Windows 10 Update Assistant would at least bump up the current patch level, in some cases not.

    • 3

  2. Windows Server 2016 not updating through WSUS discusses where the Server 2016 install would not talk to WSUS. I'm referencing it because of the GPO setting Computer Configuration > Policies > Administrative Templates > System > Internet Communication Management > Internet Communication Settings > Turn off access to all Windows Update features

    If that's on somewhere else in GPO, it needs turned off. Note that it's not in Windows Update section of Administrative Templates, but rather System > Internet Communication Management, and so might not necessarily been included in your old WSUS GPO(s).

    After that, for testing purposes, pick a server to work on, export (for backup) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, delete the registry key, gpupdate /force, then 

    $MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager"
$MUSM.Services | select Name, IsDefaultAUService

    If you are still pointing at a WSUS server, then I recommend gpresult /h c:\gpresult.htm and looking through the first section labeled Computer Details to determine if anything is still coming through on the Windows Update section. If the policy is still there, you could be looking at a DFS replication issue isn't pulling your GPO changes across the DCs.

    • 0