Scheduling Windows Update using GPO

[Hebba]

I've followed the steps listed below.

As a result clients that are members of the domain are
unable to change their own settings from the windows
update applet in the control panel, which indicates
successful application of the policy. However, those
clients are not configured with the latest windows
updates; namely SPs, patches and hotfixes.

1. Computer Configuration > Administrative Templates.
Right click it and choose Add/Remove Templates.
2. add a new .ADM template
3. WUAU.ADM template and click Open
4. Computer Configuration > Administrative Templates

Windows Components > Windows Update. Right click the

Configure Automatic Updates setting in the right pane and
choose Properties.
5. Click Enabled and set it to level 4 - Auto
download and scheduled installation. Set your day of the
week and desired time.
6. secedit/refreshpolicy machine_policy. I even
rebooted the server.

 

[Laura E. Hunter \(MVP\)]

Did you reboot the individual client machines as well?

The Windows Update policy is a funky one that seems to require 2 reboots to
apply any changes - Mark Minasi had this great rant at the Security Roadshow
about how XP processes GPOs at startup; it's an internal monologue that goes
something like:

"Okay, that one's easy, I'll apply that one...yeah, that one's simple too,
I'll apply that one...oh wow, that one's HARD, I'll do that one later..."

 

[Guest]

Yes, I did reboot the clients. As a matter of fact to make
sure the GPO is applied I used the command GPRESULT and
the it stated that the Registry has received that
particular GPO.

The Automatic Update Applet in the Control Panel is
inactive and has received the setting of the GPO

I also had a look at the %windir%\Windows Update.log. The
schedule set in the GPO is daily at 2PM. Following is part
of the log. As you can see the time is 7AM; this is when I
restarted my computer. I wonder why this does not go
according to the schedule set.
-----------------------------------------------------------
2004-06-13 07:38:59 04:38:59 Success IUCTL
Starting
2004-06-13 07:38:59 04:38:59 Success IUCTL
Shutting down
2004-06-13 07:39:00 04:39:00 Success IUCTL
Starting
2004-06-13 07:39:05 04:39:05 Success IUCTL
Downloaded iuident.cab from
http://windowsupdate.microsoft.com/v4/ to C:\Program
Files\WindowsUpdate\V4
2004-06-13 07:39:05 04:39:05 Success IUCTL
Current iuengine.dll version: 5.4.3790.14
2004-06-13 07:39:05 04:39:05 Success IUCTL
Current iuctl.dll version: 5.4.3790.14
2004-06-13 07:39:05 04:39:05 Success IUENGINE
Starting
2004-06-13 07:39:05 04:39:05 Success IUENGINE
Determining machine configuration
2004-06-13 07:39:08 04:39:08 Success IUENGINE
Determining machine configuration
2004-06-13 07:40:15 04:40:15 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-06-13 07:40:22 04:40:22 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-06-13 07:40:26 04:40:26 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/getmanifest.asp