We're running a Windows 2008 R2 domain. On the root of the domain, I have a GPO to turn on automatic updates and install them at 5pm on Thursday. In a lower OU (made for computers using Deep Freeze), I have a GPO to disable automatic updates.
For most computers, this setup works fine. computers not in the Deep Freeze OU update as scheduled, and computers that are in the Deep Freeze OU do not update.
However, some of the machines within the Deep Freeze OU still update as if the "disable automatic updates" policy is not being applied, even though gpresult shows that it's pulling both policies.
- checking DNS settings (it's fine)
- disabling machine account password changes (a la this link)
- turning off McAffee Access protection, Windows Firewall, etc.
- setting the Deep Freeze GPO to "Enforced"
- pulling my hair out (that never helps, though)
I've also found that running "gpupdate" rarely does anything, but running "gpupdate /force" will change the automatic update setting until the computer is rebooted -- even when Deep Freeze is thawed.
Affected machines are Windows XP running McAffee VirusScan Enterprise and Fabronics Deep Freeze
Does anyone else have any ideas?
EDIT: "gpresult" on the affected machines shows that link is not slow and both GPOs are being applied in the right order despite the fact that Automatic Update settings are still incorrect.