Updates Install Automatically - Set To Download But Not Install

I have XP machines configured to Download but not Install Windows Updates. I
have checked registry, group policy and Control Panel configurations and all
reflect this option [or in the case of Group Policy they are not configured
which I believe means they do not apply].

Despite this one machine downloaded and installed automatically yesterday
and I am unable to determine why this might be - settings are the same on
multiple machines [they were cloned from a single master image] yet this
happened on only one machine. The machines are running a restaurant POS and
it is preferable for us to shut down the POS prior to any reboot - a hard
reboot like this has the potential to compromise the DB.

Any thoughts as to where I might look to identify the cause of this errant
behaviour would be very welcome.

Thank you

 

With any of the Automatic Updates options selected, you will only see AU's
yellow "Updates are ready to be installed" icon when all of the approved
updates have downloaded or installed.

If some but not all of the approved updates have downloaded, you may
encounter a "Click to install important updates and then shut down" button
when you go to turn off your computer. Doing so will install the
already-downloaded updates (see Event Log | System section).

• Microsoft Update Product Team Blog: Update Notifications and
Install-at-Shutdown Behavior:
http://blogs.technet.com/mu/archive/2009/06/26/update-notifications-and-install-at-shutdown.aspx

Absent any serious numerical Errors in your windowsupdate.log (cf.
http://support.microsoft.com/kb/902093), you may be seeing delays (i.e., in
downloading or installing all approved updates) caused by excessive demand
on the servers ("Update is not allowed to download due to regulation").
See...

• Updates are not downloaded or the “Automatic Updates†icon does not
display the status of downloads when you enable the Automatic Updates
service
http://support.microsoft.com/default.aspx/kb/910340

[With 13 updates plus the MSRT plus 3 other non-security updates released on
9 Feb-10, it could take 2+ weeks for all of the computers needing these
updates to get them via Automatic Updates!]

In most cases, you can install all of the desired updates manually via
Windows/Microsoft Update website (WinXP) or by running Windows Update
manually (Vista & Win7) instead: Understand that by doing so, you're pushing
all other Automatic Updates users further back in the queue...which may
explain, at least in part, why Automatic Updates may not have brought them
in for you yet.

 

The windowsupdate.log will give us a clue to what initiated the install.
If the logged in user is an Admin or ElevateAdmins is enabled it's possible
a user saw the shield and initiated the install.

-Eddie