Stop laptop users downloading windows updates at home?

[tosca925]

Now bear with me on this one,

Our staff have laptops which they have a local account on as well as using their network account at school. We use WSUS in school to deploy all our approved updates. My problem is when staff are at home logged on to the local account on the local laptop (which has admin rights) they can manually download the Windows Updates without our control. Now most of this i suppose is OK but something like IE 7 which we have not deployed yet or even attempted to use the ADM templates for is a pain. I have users coming up and complaining abut IE stuff just because they don't know how to or like the look of IE 7.

Is this possible to block the local user account from doing Updates even though this account is an admin account?

My other dilemma is i guess the 6 weeks holidays if i stop the WU. I guess there should normally be only one patch Tuesday for WSUS to deliver out updates but its still a month before they come back to school.


What are your thoughts on this?

@Grumbledook. I know you have the same type of set up with your staff laptops, how do you handle this?

[eean]

Most people consider users being able to update their own laptops at home a good thing - especially if the staff are connecting to the internet and not bringing them in regularly.
There is a registry key about, which should be fairly simple to deploy, that will stop IE7 from downloading.
I'm surprised that looks to the public update if you have WSUS installed, the settings are machine based and should work regardless.

[Bestbett]

If his WSUS is set via user gpo then it would only get it when logged in locally. You could configure a local firewall setting to block all the ports for updating if your that worried, and have another part of your gpo that sets wsus unblock those ports.

In general though I would never allow a user that takes a laptop home to be an administrator of that laptop. To me this is just a bad bad idea. Think of the licensing issues alone, they can install whatever they want to that thing, including bittorrent and start sharing/downloading/installing with free reign on a system that in the end, at least here, Im responsible for, um no. Not even our head of schools is an administrator of thier own machine.

[GrumbleDook]

We encourage them to run the updates if any appear ... for updates we don't want we use reg tools to block them (which we still have done for IE7 and had previously done for 2 other patches)

The only issue arises when a nasty "I am going to break you" patch comes out during a long holiday ...

So far we have only had a few machines go wrong ... but they were fo unimportant peopl ... head of PE, a food tech teacher and the Head ... noone important.

I am more confident than I used to be about patches from MS now ... so I tend to wait until someone moans that there machine is broken.

Then again ... I don't do support anymore and have an army of minions.

[tosca925]

I'll have to look into the IE7 patch to stop installs. Is it easily removed when you want to allow IE7?

[Geoff]

If you actually do want this to work properly, you must make sure you set the WinHTTP proxy settings correctly.

[mortstar]

Could you use the HOSTS file to stop access to windowsupdate sites?

As you use WSUS, that shouldn't affect your own sanctioned updates.