5

Scenario:

  • A few Windows 2003 servers, part of our corporate network
  • Corporate IT has set up a WSUS server.
  • But it seems Corporate IT is unable to operate the WSUS server properly. On "my" servers, I get 'unable to download updates'-messages in the event log regularly. And no patches are downloaded/installed to the servers.
  • I have admin access to the servers, since there are a few things I support myself for our branch office.

Question:

  • I want to disable my servers usage of the corporate WSUS server. I would like to configure it the "normal" way - use Microsoft's windows update.
  • How and where do I change this setting? I have no idea how corporate IT has configured the servers in the first place - maybe using group policy?

4 Answers 4

7

If it is set using a Group Policy, you probably cannot override the setting (that's the whole point of Group Policies), but you should be able to visit the Windows Update website and still download updates yourself, you just won't get the prompts and reminders of new updates.

You really should open a ticket with your Corporate IT department and work with them to resolve the issue. Likely there is something not configured properly between your server and their WSUS server.

5
  • +1 on both points. Although I have a feeling that the second point is probably a non-starter. Jun 15, 2009 at 20:14
  • 1
    You may be blocked from using the Windows Update site too, if IT have enabled the relevant Group Policy settings. Jun 15, 2009 at 21:01
  • I like the order presented here. Pull down the patches now so as to stay up-to-date, then work to fix the problem. Even if opening a ticket doesn't go anywhere, it is still the right place to start.
    – Scott Pack
    Jun 16, 2009 at 11:49
  • Agreed. Much better than my misinformation below. :O +1 Jun 16, 2009 at 22:35
  • For now, I will use the Windows Update website - that seems like the simplest option. Luckily, it was not blocked.
    – codeape
    Jun 17, 2009 at 8:39
4

For temporarily disabling it you can do this:

Rename or delete:

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

Restart the wsus client

net stop wuauserv
net start wuauserv
3

I just had someone do this for me. Uber easy. Just go into the roles portion of your server manager and select WSUS as a role to remove. And it ought to get rid of the app and also any updates that have been grabbed by WSUS.

I was lucky that my updates had not installed for some reason so there was no need to dump the op and re-install. But be careful what you do...

0

You can create a new OU under their OU for your servers with a GPO that will override their settings. When creating the GPO look under Computer Configuration-->Policies-->Administrative Templates-->Windows Components-->Windows Update.

Oh, and you could also use local security policy on each server to override their group policy.

3
  • 3
    Methinks if he had the ability to create OUs and GPOs, this question would not have made it this far. And no, you cannot override Group Policy using Local Policy settings. Policies are applied in the following order, with each subsequent conflicting setting overriding the previous: Local Policy, Group Policies linked to AD Site, Group Policies linked to the domain, Group Policies linked to OU/s. Jun 15, 2009 at 20:59
  • Well he did say, "maybe using group policy?" indicating that he might have access to actually change group policy. Your're right about the local sec policy, though. My LSDOU was UODSL for a moment. ;) Jun 16, 2009 at 22:33
  • @Graeme Donaldson: Great comment. I was not aware of how policy ordering works.
    – codeape
    Jun 17, 2009 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .