We're running a Windows 2008 R2 domain. On the root of the domain, I have a GPO to turn on automatic updates and install them at 5pm on Thursday. In a lower OU (made for computers using Deep Freeze), I have a GPO to disable automatic updates.

For most computers, this setup works fine. computers not in the Deep Freeze OU update as scheduled, and computers that are in the Deep Freeze OU do not update.

However, some of the machines within the Deep Freeze OU still update as if the "disable automatic updates" policy is not being applied, even though gpresult shows that it's pulling both policies.

I've tried:

  • checking DNS settings (it's fine)
  • disabling machine account password changes (a la this link)
  • turning off McAffee Access protection, Windows Firewall, etc.
  • setting the Deep Freeze GPO to "Enforced"
  • pulling my hair out (that never helps, though)

I've also found that running "gpupdate" rarely does anything, but running "gpupdate /force" will change the automatic update setting until the computer is rebooted -- even when Deep Freeze is thawed.

Affected machines are Windows XP running McAffee VirusScan Enterprise and Fabronics Deep Freeze

Does anyone else have any ideas?

EDIT: "gpresult" on the affected machines shows that link is not slow and both GPOs are being applied in the right order despite the fact that Automatic Update settings are still incorrect.

1 Answer 1


two possible simple solutions: - 'hook' the policy to each tree where you want to apply it - Exclude the deep freeze machines by only applying the root gpo to machines in a particular security group

gpupdate not doing anything may have something to do with the link speed detection - does windows detect it as being slow - ie. WAN? You can see this in gpresult. Gpresult should also tell you which gpos are being applied or not applied.


  • gpresult on the affected machine(s) shows link speed to be fine and both GPOs are being applied in the proper order.
    – Tim F.
    Jan 24, 2011 at 21:30
  • I think I should qualify my last comment... though gpresult shows the GPOs to be applied in the right order, the Automatic Update settings are still incorrect.
    – Tim F.
    Jan 25, 2011 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .