SUS group policy

[Bill]

I've had my sus policy working for about a year now, but
recently some users who have been removed from the local
admin group of their machines, have had the no option
during the reboot option, grayed out. I've got the 'no
auto-restart for scheduled automatic updates installation'
enabled and as i've mentioned hadn't had any problems.
I've revisited some of the documentation regarding SUS,
but didn't see any mention of the user having to be part
of the local admin group in order to receive the no option
during the reboot phase, but did find this bit from
http://www.microsoft.com/technet/security/guidance/secmod19
7.mspx

"For users without local administrator rights, the update
will install in the background at the scheduled time.
These users can only delay a computer restart, if the No
auto-restart for scheduled Automatic Updates installations
policy setting has been enabled."

by "delay" I would imagine that meaning they could say no,
but on these users machines it counts down and reboot
automatically.

thx,
Bill

 

[Brian Desmond [MVP]]

Bill-

What you're seeing is expected behavior, with the no button and all. If you
set the GP to force install at download time, the users will see a
countdown.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Bill]

I have to disagree. I have 100+ machines using this group
policy, and only a few machines see this behaviour, the no
button grayed out. The rest can choose yes or no as to
whether they want to reboot now or later.

 

[Bill]

To clarify my GPO. I have the 'auto download and install'
setting enabled and the 'no auto-restart for scheduled
automatic updates installations' enabled. Is it expected
behaviour that users not belonging to the local admins
group can not choose no to the 'Do you want to restart
your computer now' prompt?

 

[serverguy]

Yes. But it doesn't mean you must click on the button as soon as you see
it. It is best to teach those users that they can ignore that prompt and
save their work before actually clicking on the Yes button. Not a great
solution, but an unfortunate limitation of SUS.