Group Policy vs. Windows Update

[Gongalong]

Hi folks,

 

We've got a problem with Windows Update settings applied by Group Policy on Windows 7 PCS (with Windows 2008 R2 servers).

 

I've followed a couple of guides that are supposed to prevent the "Restart your computer to finish installing important updates", yet it still appears.

 

The two purportedly key settings are applied as follows:

 

(Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update)

No auto-restart with logged on users for scheduled automatic updates - Enabled

Re-prompt for restart with scheduled installations - Enabled and set to 600 minutes

 

Just for information there are a bunch of other settings also applied, partly for WSUS, and partly to resolve other related issues:

Allow non-administrators to receive update notifications - Disabled

Configure Automatic Updates - Enabled

Enable client-side targeting - Enabled

Specify intranet Microsoft update service location - Enabled

Turn on Software Notifications - Disabled

 

I've used RSOP.MSC on a client PC displaying the issue, and that says the group policy in question has been applied and all the settings are there without issue.

 

Can anyone identify what setting is incorrect, or needs to be applied to get rid of this nagging dialog?

 

TIA

[Ashm]

I had this issue as well, I found I had to also add a user configuration policy for the following:

Windows Components/Windows Update

• Remove access to use all Windows Update features Enabled (Configure notifications: 0 - Do not show any notifications)
  

 

And then enable User Group Policy loopback processing mode in the computer configuration policy and set to Merge.

[Gongalong]

Thanks, will give that a try.

[Gongalong]

This is 2008 R2, so it seems loopback no longer exists (possibly).

[Quackers]

This is 2008 R2, so it seems loopback no longer exists (possibly).

 

It does, we use loopback in 2008 R2 Server for some things.

[Gongalong]

Any ideas where it's hidden? I found an MS article that was appropriate for 2003, but the loopback item didn't seem to exist.

 

Wow does GP need a search function.

[Quackers]

Computer Configuration -> Administrative Templates -> System -> Group Policy -> Use Group Policy Loopback Mode

[Gongalong]

Thanks!

[Gongalong]

Curiously turning on loopback caused a script to get processed twice, which in turn caused errors on startup (and confused users), so I've disabled it.

[Ashm]

Do you have any settings other than the WSUS ones configured in that GPO? And do you have it linked to an OU with the computers that you want to target?

 

I have a separate WSUS GPO with mainly just the computer settings you specified above and the user loopback set to merge plus the one user setting I mentioned above and it works correctly with no pop ups etc for the logged on user. I would test this with a separate GPO on a test OU and computer to make sure it works as expected.

Edited July 16, 2012 by Ashm

[Gongalong]

The GPOs aren't linked to OUs (a setup I inherited). They are scoped using the security filtering.

 

We have GPOs for WSUS Policy, Software Deployment, Teaching Staff, All Users, and All PCs.

[Gongalong]

I set loopback in the All PCs GPO.

[Ashm]

You'd only want to set lookback on the WSUS GPO. Which should only have the following setting in the User Configuration part of that GPO:

 

Remove access to use all Windows Update features (Configure notifications: 0 - Do not show any notifications)

[Gongalong]

Ah, I have a feeling that was enabled in one of the user GPOs.

 

So I should remove that from the other GPO, enable in the WSUS GPO, and enable loopback?