Stopping Windows Updates

[abillybob]

Hey Guys,

 

I wanted to stop all machines in school installing Windows Updates. So I removed the link from the OU and thought that would be the end of it but it seems that somehow the clients are still able to update themselves. Does anyone know of a GPO I can create that will completely disable Windows Updates from running?

 

Thanks

Alex

[3s-gtech]

Wait, what? Don't do that.

 

You can change the update frequency via GP, and you can change approval on the WSUS server so that you control which updates get passed through to your clients, but don't go stopping Windows Update entirely. They're published for a reason!

[Davit2005]

Are the clients going directly to MS for updates??

 

How about re-instating the policy and setting 'Configure automatic updates' to setting 2 'Notify before downloading and notify again before installin them'.

 

There is also another policy 'Allow non-administrators to recieve update notifications' if this is not configured then I non admins shouldn't get annoying messages about updates.

 

Have you got WSUS server on site at least this way you should be able to control what updates the clients get but I wouldn't disable updates altogether.

Edited May 15, 2015 by Davit2005

[timbo343]

What about creating a new group policy under user config and set all windows update lines to disable. You could also do this under Computer Config too to doubley make sure that the machine doesnt install the updates. I know ghat we have the updates disabled for teaching staff but admin staff are allowed to install updates.

[abillybob]

So how would I go about setting WSUS to disprove all updates automatically then I can approve them as and when I see fit ? Thanks guys!

[Boredguy]

Well you wouldn't disapprove updates, you would just set WSUS not to automatically approve the updates for the difference categories without your intervention.

 

In WSUS, go to Options and click on Automatic Approvals

You can then update the Default Automatic rule to only be for certain categories and a specific group you have defined.

[LeMarchand]

I had to do this (under duress) on the "child use" laptops. They don't all get used regularly, so sometimes there is a "log jam" of updates getting applied when the kids turn them on. Even if you prevent updates via WSUS, some will still come via MS Updates.

 

I basically copied the existing policy and set the following:

 

 

...so now there are 2 WSUS policies - the one above for the kid's machines and the "proper" one for everyone else. During the holidays I can still manually update the machines.

[abillybob]

Well you wouldn't disapprove updates, you would just set WSUS not to automatically approve the updates for the difference categories without your intervention.

 

In WSUS, go to Options and click on Automatic Approvals

You can then update the Default Automatic rule to only be for certain categories and a specific group you have defined.

 

Cheers. Done that. Hopefully this will stop the never-ending amount of updates that seem to be coming from Microsoft at the moment.

[Boredguy]

If you setup the e-mail notification in the Options, you can at least review each day what WSUS has downloaded and what you need to authorise.

 

I would still ensure that if you have a Server group configured that you automatically authorise updates for them, but leave your workstations on manual.