2

I've recently replaced Windows Server 2008 R2 RDS Servers with 2016 Servers and ran into this issue. It seems that the GPO option to "Allow Non Administrators To Receive Update Notifications" (Computer Policy) and "Turn off access to all Windows Update features" (User Policy) no longer works on Server 2016.

This leads to situations where regular users would be prompted to install updates now. They can do so and they can even reboot the server afterwards. This is not only annyoing as hell for everyone working on the server, it's also a security issue. Under no circumstance non-admin users should be able to reboot a Windows Server.

The only viable option I've found so far is to use the Computer Policy to block access to all Windows Update features. Since this is a computer policy, now Administrators aren't able to install updates, which is a useless configuration. Currently I've disabled auto-approvals on the WSUS server to prevent these issues, but it adds extra workload on the admin team to manually approve updates and schedule downtimes for the servers.

Win 2016 has been around for a while. I wonder if anyone has experienced this issue as well and managed to resolve it or find some middle ground.

  • Allow non-administrators to receive update notifications. This works on my servers, are you sure you are not overwriting the setting with something? – Lenniey Jan 14 at 15:53
  • I'm positive. gpresult shows this policy applied on the RDS hosts. Still everyone gets update notifications. According to getadmx.com, this policy is supported up to 2012 R2 only. – Nyuton Jan 14 at 16:34
  • Whoops, sorry. You are right, I enabled Turn off access to all Windows Update features and push the updates through SCCM. – Lenniey Jan 14 at 16:50
  • I just researched this some more, it really seems that MS disabled that GPO since Server 2016. I don't know why, but this is a very stupid design decision. Obviously you can only disable the prompts by using Turn off access to all Windows Update features. Dumb. – Lenniey Jan 15 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.