I am having trouble applying group policies on computers with deep freeze installed on them. They are domain joined and pulling updates from our WSUS server before being frozen. When we freeze them they seem to lose their group policy settings. I have tried thawing, gpupdate/ force, and then refreezing, but they lose their group policy as soon as they are brought back up. What could be causing this? Everything was working fine until a bad Windows update came through. We blocked the update on our WSUS server and thawed, removed the update, and re-froze all the computers. The next day I came to work to find out that all the computers had reached out to the Internet and pulled the bad update again.
I don't know the answer about Deep Freeze but this is the kind of problems that this type of software generates. The software freeze the machine in a point of the time, and everything you do is lost when the machine is restart. That is bad thing because machines stops to taking changes of important things like updates. These type of software let you make execptions to dont have this issues, but in lots of cases still fails.
Some time ago Microsoft had a software like this called Steady State for Windows Xp but for Windows 7 it was disccontinuated.
¿Why? Because this kind of software is not necessary. With Windows natively you can have mandatory profiles, a type of user profile that lost all the changes when the user close his session.
So my recommendation here is dont use Deep Freeze, Windows natively can do to a similar behavior with lots of advantages for free. Microsoft has a guide to do this using GPos and mandatory profiles: Creating a Steady State by Using Microsoft Technologies
What exactly is the group policy setting (or settings) being lost? Deep Freeze will keep the settings on the machine as they were (unless they're updated during, say, a maintenance window), but it can still be overridden at runtime. Just like with viruses. Deep Freeze will protect the machine from infection in that when you reboot, it's gone; but it can still be infected during runtime.
Also if there are alterations during runtime the policy may get overridden. I.e., user-specific settings from their portions of the registry (pulled from a profile) will take effect at login, just like if they have malware in their profile it'll infect the machine each time they log in and get wiped when restarted (assuming the profile isn't part of the freeze state.)
The bad update shouldn't matter if the machine is frozen. Restarting will eliminate it, unless they're doing it over a maintenance thaw. One solution to that is to either alter your DNS records so you can't reach the Windows Update server except from your WSUS server (not a great solution) or blocking access at a proxy or firewall except for your server.