I have a scenario where I have two Windows 2003 servers on an active directory domain (same organizational unit), and a single domain user is being used to log into each server via Remote Desktop (the user is a member of the administrators group).

On server1, I can access the "automatic updates" dialog via Control Panel -> Automatic Updats and can change the settings as expected.

On server2, the "automatic updates" dialog appears, but all the controls are grayed out.

Does anyone know what situations could occur that would cause this difference in behavior, again, noting that it's the same AD user that is accessing each server?

I've looked at the local policy on server2, based on suggestions provided below, but I am not sure which policy I'm looking for. None seemed to jump out at me, so any specific suggestion would be appreciated.



Group policy is probably the reason why this is happening. Group Policy can be applied an many levels, local, AD site, AD domain, OU. This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are aggregated.)

In addition there are essentially 2 versions- computer and User. Computer policy is applied first then the user policy when the user logs on. Check the group policies in the reverse of that order to find the offending policy. The simplest way to see what policies are applied is with the RSOP snapin

  • Selected as answer because although it was fundementally the same as those given sooner, this one provided more explicit details. – Scott Mayfield Jul 14 '09 at 20:11

There are system-based policies on that server that are preventing you from changing the Automatic Update settings. I'd check the local policy first, then check group policy.

This Microsoft KB should help: http://support.microsoft.com/kb/328010


The server that is greyed out is probably set to use Automatic Updates via Group Policy. Another possibility is that somebody installed an SCCM (Microsoft System Center Configuration Manager, formerly SMS) client. SCCM integrates and extends the Automatic Updates agent.


Are Server 1 and Server 2 in the same OU in Active Directory?

Windows Update might have some Group Policy settings on Server 2 that aren't on server 1.


Might be 2 different things: 1) Double-check that you are indeed an admin on both servers. If this is true then... 2) If the servers are in the same OU, and you are an admin on both of them, I would guess that you do not have a group policy setting in active directory for automatic updates and that a local group policy has been set on one but not the other.

Actually number 3 might be that one of the servers is not pulling group policy for some reason (if it was recently added to the domain, moved to the OU, etc.). Go to Start, Run and type gpupdate /force to pull the latest group policies from the domain and then do the following:

Go to Start, Run and type rsop.msc (Resultant Set of Policy). This will tell you if a policy has been set and, if so, at which level it has been applied (Local, Default Domain, some other OU policy, etc...)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.