10

I have configured WSUS server in order to preserve bandwith in the network wile keeping essential updates turned on using that WSUS.

Intranet WSUS server pointing to client pc and other settings are pushed via group policies in Domain controller 2003.

Following policies are configured in the domain..

Computer configuration section

enter image description here

User configuration section

enter image description here

and its correctly configured in the clients in this manner..

enter image description here

yet I wish to disable/remove ,

(1) Ability for users to check the updates (since its automatically scheduled to install at friday 4 pm)

(2) Ability for users to install the updates

(3) ability to check online for updates from windows (Only i want wsus to be the source of download)

If I out line above 3 facts, in the windows 7 client settings its below what i Wish to disable

enter image description here

Is this possible using existing Server 2003 Group policies ? To achieve above 3 requirements? As clients we do have windows xp,7,8,8.1 that needs above 3 requirements.

Any help would be greatly appreciated.

Improve this question
10
  • 1
    Except for the ability to "Check online from Windows update", why would you remove the other two options?
    – Andy
    Apr 6, 2015 at 14:54
  • I don't want user to have any control over updates .. At least "Check online from Windows update" is disabled , is fine if other two are not possible via group policy or similar
    – Aravinda
    Apr 6, 2015 at 14:57
  • 1
    You can prevent users from accessing Windows Updates and from checking for updates with Group Policy, found under the Windows Updates settings under User Configuration Settings.
    – joeqwerty
    Apr 6, 2015 at 15:12
  • Not sure what im missing here, i have edited and added user configuration section .. i.stack.imgur.com/zj2C5.png What im missing? may be 2003 group policies are not compatible with latest clients such as 7/8 etc ?
    – Aravinda
    Apr 6, 2015 at 15:21
  • 1
    it's possible but why would you want your users to not be able to install updates whenever they need to? I see this somewhat often and am often puzzled since when I do security reviews this setting is a fail. It's a guarantee that an application or system can get exploited. By default since you've configured WU to use WSUS the only reason a user would use WU is because they are away from the WSUS server or you haven't put the update in WSUS yet.
    – Jim B
    Apr 6, 2015 at 15:49

1 Answer 1

Reset to default
10

There are settings in the Server 2008/2012 policies that aren't accessible on your 2003 server I believe, such as "Do not connect to any Windows Update Internet locations" under the Computer settings you show above.

I believe the settings you are looking for in a 2003 environment are:

Disable access to Windows Update

The correct policy for v6 operating systems to achieve the desired objective is: Turn off access to all Windows Update features

and is located in Administrative Templates | System | Internet Communication Management | Internet Communication Settings

If this policy setting is enabled, all Windows Update features are removed. It blocks access to the Microsoft Update and Windows Update Web sites, and in Windows Vista will gray out the Check for updates option in the Windows Update application. The machine will not get automatic updates directly from Windows Update or Microsoft Update, but it can still get updates from a WSUS server. This setting overrides the user settings Remove links and access to Windows Update and Remove access to use all Windows Update features. To disable access to Windows Update
1.In the Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, expand System, expand Internet Communication Management, and then click Internet Communication settings.

2.In the details pane, click Turn off access to all Windows Update features, and click Enabled.

3.Click OK.

Improve this answer
5
  • That is awesome.. “check online for updates from windows update” gone by enabling that group policy.. Just wondering now when a user click on check for update , will this be checking updates from my internal wsus ? not any place ?
    – Aravinda
    Apr 6, 2015 at 15:48
  • 1
    Correct, from your WSUS server.
    – TheCleaner
    Apr 6, 2015 at 15:52
  • so that is awesome.. So that is everything i really want.. Thank you very much for sharing this great nugget!!
    – Aravinda
    Apr 6, 2015 at 15:55
  • @TheCleaner - I just posted this - serverfault.com/questions/718232/… - I think some similar steps may help - What if the WSUS server downloads the not wanted telemetry updates, then all clients will get it as well?
    – Alex S
    Sep 1, 2015 at 9:43
  • @Aravinda - Any thoughts on my question?
    – Alex S
    Sep 1, 2015 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .