SUS & GPO

[Jan Didden]

Hi,

A question from a GPO-newbie, using SBS2003 and XP-workstations.

We have setup a SUS-server, and our clients are receiving and installing
updates through a "Scheduled Install SUS Config" GPO (which was described by
MS). This seems to be working fine, with one exception. Because all our
clients are local administrators, they receive notifications when new
updates are downloaded.

We don't want our clients to see anything regarding SUS.

We have found a solution for this problem, and that is to enable the setting
"Remove access to use all Windows Update features" located in User
Configuration\Administrative Templates\Windows Components\Windows Update,
this would stop all notifications regarding SUS.

This is described in the Software Update Services Deployment White Paper
(http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx) in
chapter "Interaction with other policies" on page 60.

The problem we are having is that changes made tot the User Configuration in
the GPO aren't distributed to the users. We have even tried a gpupdate/force
on the workstations. But when we view the "Resultant Set of Policy" through
rsop.msc on the workstations, Users Configuration still has all the default
values, the changes we have made aren't visible.

What are we doing wrong? Do we have to do something special after we have
made such changes?

Jan

 

[Roger Abell]

Your "Scheduled Install SUS Config" GPO,
or whatever GPO it is where you are setting
"Remove access to use all Windows Update features"
needs to be linked to a container within which
the user account objects are located, and, the
GPO needs to have read/apply for such as
Authenticated Users that will include the user
accounts in the scope of application.