WSUS not doing what it's told. :-)

Long story short: I've installed WSUS, approved all updates, created GPO and
applied to OU.

Computers are downloading updates but prompting uses to install even though
the GPO is set to #4 download and install.

Any other setting in the GPO I've overlooked or suggestions?

Thanks

[[ Right pew, wrong church. Forwarded to WSUS newsgroup
(microsoft.public.windows.server.update_services) via crosspost as a
convenience to OP.

On the web:
http://www.microsoft.com/communities...pdate_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
]]

David wrote:
> Long story short: I've installed WSUS, approved all updates, created GPO
> and
> applied to OU.
>
> Computers are downloading updates but prompting uses to install even
> though
> the GPO is set to #4 download and install.
>
> Any other setting in the GPO I've overlooked or suggestions?
>
> Thanks

"PA Bear [MS MVP]" <> wrote in message
news:...
>
> David wrote:
>> Long story short: I've installed WSUS, approved all updates, created GPO
>> and
>> applied to OU.
>>
>> Computers are downloading updates but prompting uses to install even
>> though
>> the GPO is set to #4 download and install.
>>

Sounds like your users have Administrator permission. Admins will get
prompts. Regular users won't.

Thanks John, any way to override that?

David



"John" wrote:

>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
> >
> > David wrote:
> >> Long story short: I've installed WSUS, approved all updates, created GPO
> >> and
> >> applied to OU.
> >>
> >> Computers are downloading updates but prompting uses to install even
> >> though
> >> the GPO is set to #4 download and install.
> >>
>
> Sounds like your users have Administrator permission. Admins will get
> prompts. Regular users won't.
>
>
>

Not that I know. Perhaps someone else knows a trick that I don't.

"David" <> wrote in message
news:A7094082-EA6B-45F9-88B9-...
> Thanks John, any way to override that?
>
> David

"John" <a> wrote in message news:...
> Not that I know. Perhaps someone else knows a trick that I don't.

Take away their Administrator permissions.

Or, enable the User policy to "Remove access to use all Windows Update
features" found in User Configuration | Administative Templates | Windows
Components | Windows Update



--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

"Lawrence Garvin [MVP]" <> wrote in message
news:...
>
> Take away their Administrator permissions.

This is pretty obvious.

> Or, enable the User policy to "Remove access to use all Windows Update
> features" found in User Configuration | Administative Templates | Windows
> Components | Windows Update

I learn something new everyday :-)

I posted it too soon.

I've just finished reading the description of "Remove access to use all
Windows Update". If I understand it correctly, it sounds like Automatic
Update will not function if this option is enabled. Or will it only not get
updates from Windows Update sites but still get updates from WSUS box?

<snip>
Windows automatic updating is also disabled; you will neither be notified
about nor will you receive critical updates from Windows Update.

"John" <a> wrote in message news:...
>
> "Lawrence Garvin [MVP]" <> wrote in message
> news:...
>>
>> Take away their Administrator permissions.
>
> This is pretty obvious.
>
>> Or, enable the User policy to "Remove access to use all Windows Update
>> features" found in User Configuration | Administative Templates |
>> Windows Components | Windows Update
>
> I learn something new everyday :-)

"John" <a> wrote in message news:...
>I posted it too soon.
>
> I've just finished reading the description of "Remove access to use all
> Windows Update". If I understand it correctly, it sounds like Automatic
> Update will not function if this option is enabled.

Incorrect. What the policy does is:
[a] Block access to the Windows Update Agent User Interface (including
the Notification Icon)
[b] Block access to scan/download/install updates from WU/MU.


> Or will it only not get updates from Windows Update sites
> but still get updates from WSUS box?

Correct.


<snip>
> Windows automatic updating is also disabled; you will neither be notified
> about nor will you receive critical updates from Windows Update.

Well... yes... but in a =WSUS= environment it's an academic point, since the
client doesn't talk to AU/WU/MU anyway. The client will still talk to the
WSUS Server.

The key words in all of the above is the explicit definition of "Windows
Update" which does not include WSUS.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Got it.

"Lawrence Garvin [MVP]" <> wrote in message
news:...
> "John" <a> wrote in message news:...
>>I posted it too soon.
>>
>> I've just finished reading the description of "Remove access to use all
>> Windows Update". If I understand it correctly, it sounds like Automatic
>> Update will not function if this option is enabled.
>
> Incorrect. What the policy does is:
> [a] Block access to the Windows Update Agent User Interface (including
> the Notification Icon)
> [b] Block access to scan/download/install updates from WU/MU.
>
>
>> Or will it only not get updates from Windows Update sites
>> but still get updates from WSUS box?
>
> Correct.
>
>
> <snip>
>> Windows automatic updating is also disabled; you will neither be notified
>> about nor will you receive critical updates from Windows Update.
>
> Well... yes... but in a =WSUS= environment it's an academic point, since
> the client doesn't talk to AU/WU/MU anyway. The client will still talk to
> the WSUS Server.
>
> The key words in all of the above is the explicit definition of "Windows
> Update" which does not include WSUS.
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>