Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're running the latest WSUS server 3.0 sp-something-or-other. Add the admin template to domain group policy to get everyone into the pool, so to speak.

Now, for various reasons, I have two servers that I need to remove from the WSUS family. They need to go back to getting their updates from Microsoft.

I created a new OU ("Non WSUS Servers"). I created a new GPO as a copy of the Default Domain Policy ("non WSUS") and removed that wsus admin template.

Deleted the 2 servers from WSUS. Yet they keep getting added back in. Clearly I'm missing a step here -- any ideas?

While writing this, I noticed that my "Non WSUS Servers" OU "Group Policy Inheritance" lists my non WSUS GPO and then the Default Domain policy under it. Is that what's tripping me up?

(can you tell I'm not a GPO wizard? ;-) )

share|improve this question
up vote 1 down vote accepted

With WSUS settings at default domain level and no WSUS policy defined on the new OU, the settings you will be getting on these PCs will be the WSUS settings, and this is correct behaviour according to the rules of GPOs. What you need to do is create a new OU in your AD structure, move all your computers to that (aside from DCs, of course), define your WSUS policy on that OU, and then things should work the way you want them to.

share|improve this answer
I believe this is the direction I should be headed. New OU with a new GPO with the wsus template added. Then I should remove the wsus template from my default GPO. Sound about right? – Chris_K Oct 16 '09 at 16:54
Yup, that's the way! :) – Le Comte du Merde-fou Oct 16 '09 at 17:19
One last question: Since my new OU has a new policy that only has WSUS stuff do I add that same policy to the Domain Controllers OU as well? – Chris_K Oct 16 '09 at 17:33
OK, that was a dumb question. Of course I should add that wsus policy. Think I'm all squared away now :-) – Chris_K Oct 16 '09 at 18:34

I would use the Group Policy Modeling Wizard to determine exactly what policy is being applied to the OU. Also, it sounds like you are linking the Default Domain policy to an should NOT need to do this (policies flow down through AD and the "closest" policies have highest priority).

Also, remember that policy processing takes some time. You may want to run gpupdate /force on your servers.

share|improve this answer
"Also, it sounds like you are linking the Default Domain policy to an should NOT need to do this" Well, as soon as I create a new OU it gets "Default Domain Policy" under the Group Policy Inheritance. Are you saying I should Block Inheritance? – Chris_K Oct 16 '09 at 16:22
I misunderstood what you need to block inheritance. I thought you were re-linking the Default Domain Policy to each OU. – Doug Luxem Oct 16 '09 at 16:35
OK. Modeling shows me that even though my "non wsus" policy is there, the default GPO with the wsus stuff is there too -- via inheritance. Clearly I'm doing this wrong. Looks like mh's approach (no wsus in the default GPO) is the direction I should be headed. – Chris_K Oct 16 '09 at 16:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.