Group Policy for Windows Update

[y2k1981]

If I set the User configuration > Admin Templates > Windows Components > Windows Update > Remove access to al windows update components will this affect another part of the policy which says download updates and automatically install them (under computer configuration)? I can't test it because when I log in obviously I can't see windows update and it doesn't notify me, so I have no way of knowing for definite. can somebody help clarify?

 

[ntinlin]

Well the explanatory text on the first item says that setting it will stop automatic update running and will neither notify you or allow you to receive critical updates.

My reading of that is that updates won't work at all.

Neill

 

[Albion]

Take a look at Computer Config > Admin Templates > Windows Components > Windows Update. I would set all my Windows Update setting per computer, not user. Unless of course you want to stop an individual user from using windows update.

-Al

 

[y2k1981]

I am, but there's no option in computer configuration to remove access to windows updates, that's only done in user configuration. I don't want users (on any computer) to have access to windows updates, but do want them to install. If I configure the GPO to point windows update to an SUS server, will the users still be able to use windows update to download updates from the M$ windows update site?

 

[BigFunkyChief]

It's my understanding that if they log into the domain, they'll download the GPO, and then if they try to run Windows Update, it'll look to the SUS Server.

 

[Albion]

A user can still get to Windowsupdate.microsoft.com if there is an SUS server enabled on the domain.

I think if you're running an SUS server I think you can disable Windows Update. Personally I would test it in a lab first. Don't forget though, SUS only does critical updates. It doesn't do any of the recommended updates. So you may want to enable that for your users just in case.

If you are worried about Service Pack 2 coming down, there is a way that you can block that with a policy setting without stopping any of the other updates from coming down.

Check out this link:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2aumng.mspx

Good Luck

-Al

 

[y2k1981]

Just to test this, I've configured GRP as follows:
user policy: remove all links to windows update - enabled
computer policy: download updates at scheduled time and notify admin-privledged user

However, when I log onto the PC in my test OU, the "bubble" to tell me that there are new updates available for download doesn't appear. Presumably because I've said remove windows update? It should because I approved several updates on my SUS server this morning. And my user account is in the test OU also so that the user settings apply.

It was my managers' decision to use SUS so I guess they must only want critical updates.

 

[jpaf]

Check the WIndows update.log file under c:\winnt or c:\windows. It will tell you what's happening when windows update runs and where it points to.

Have you specified the SUS Server's name in the GPO as well?

Regards
jpaf