Hi,
I’m having a bit of trouble with windows update in that when it wants to restart a machine, after it has automatically installed updates, it just does it without prompting.
Our users are in a locked down environment. They can only run programs allowed by policy (we specify exe’s allowed to run) (wuauclt.exe and update.exe are allowed by the way). They cannot see, but have access to, the C drive, and are users on the machines, not administrators. Normally problems of this nature have been resolved by increasing permissions on certain folders/files or adding extra exe’s to the allowed list. Oddly I can’t seem to find what is stopping the windows update notification from appearing.
to clarify, users don’t see the notification advising them of updates available, or downloading etc and don’t know when their PC will restart. it is all set to happen automatically.
Our computer configuration is:
Allow Automatic Updates immediate installation – Enabled
Configure Automatic Updates – Enabled
Configure automatic updating: 4 – Auto download and schedule the install
Scheduled install day: 0 – Every day
Scheduled install time: 00:00
Re-prompt for restart with scheduled installations – Enabled
Wait the following period before
prompting again with a scheduled
restart (minutes): 15
Reschedule Automatic Updates scheduled installations – Enabled
Standard Workstation WSUS Policy
Wait after system
startup (minutes): 3
The user configuration also includes:
Remove access to use all Windows Update features – Enabled
This problem is not experienced by users who are not in the locked down environment, even if they use the PC’s that are in that group. would the “remove access to user all windows update features” setting be causing this? and if so would turning it off allow our users to change the windows update settings?
Thanks
EDIT: i have compared the policy results from an unrestricted user/machine and a restricted machine/user and the only windows update policy difference is the user configuration:
remove access to use all Windows Update features – Enabled
