I have a 2008R2 RDS server with Automatic Updates set to notify. Somewhere along the way the box got checked for "Allow all users to update this computer", which isn't what I want. However, it's done.

Updates ran a few weeks ago and installed. Is there a way to determine which user kicked off the update procedure? I see dates and times in the log, but it only refers to the WU system account and not the original user.


No, Windows Update uses a system account to install when configured to do so automatically. You may see entries under a user account if the updates were installed manually.

  • 3
    You might at least be able correlate with the Security log to determine who was logged in while the updates started... that should at least get you a list of suspects. Not that I necessarily agree that this witch hunt is worth your time.
    – Ryan Ries
    Sep 9 '13 at 15:26
  • I agree Ryan. Mainly the reason to know was to if it's someone who should know better to document the changes, I'd remind them. Otherwise it's futile. Sep 9 '13 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.