Windows update services install automatic updates while Executing Bigfix Patch

Usage and Config
1

We start the windows update service and set it to manual before bigfix patching start and after patches get executed, services are stopped. There are many endpoints whose startup type changes to automatic and are now having OS build upgrades installed from Web. We push fixlet every time before patching to set the start up type to manual and still it changes on some machines.

Even Automatic updates(AU) in registry is set to 1 to disable Automatic updates. What can we do to fix this issue from Bigfix?

2

I think you’d need to investigate what is turning it back on - if it’s a Group Policy, Local Group Policy, or the user, you need to find a way to make them “stop doing that”.

2 Likes
3

Initially this was our concern too that maybe GPO is doing this but there is no GPO set on these services and it only changes for some users , not everyone. If users are changing it themselves then that we will check. I don’t think users have rights to do that in our environment but that can be validated.

Now, my only question is if we are performing Bigfix patching and we start the services keeping the startup type manual , it should not install updates automatically right?

4

I had a similar situation recently where machines were doing the exact same thing. It was identified as GPO, some even LGPO. We changed the GPO setting and it still occurred with certain users. Our interim solution until the investigation on GPO is complete, is to run a Policy Action which insures that the registry entry is always set to disable. If it changes, BigFix will change it back. The policy is on AU as well as NoAutoUpdate = 1.

One would need to however test it, in our scenario it works as a temp solution, but if you have a backwards and forwards between BigFix and GPO it’s going to become an uphill battle. I will post our findings once we have concluded, hopefully they can assist you.

1 Like
5

Suggestion, if this is windows 10 which I assume it is, why don’t you set the policy to defere quality updates for xx days. In our environment we have this value set for 30 days, so when Microsoft releases the patches we can patch these using BigFix and not have to worry about clients downloading the patches from Microsoft.

It also helps with the end user experience, so they get same reboot popup and you can control more or less the reboots etc.

Registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

you can do this using GPO or via BigFix.

6

If you haven’t dumped the Group policies that the client is seeing, and dump the wsus logs on the client, you might want to. I found at my site the WSUS settings were being inherited from another OU. It had been like that for years, until i finally opened the WSUS logs on the client to see what actually was being set and traced it back.

One of my first fixlets in bigfix, very crude - there are much cleaner ways of doing this:

// 
//
// delete key HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer
// set key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate to 1
//set key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer" to 0

dos reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /va /f

if {x64 of operating system}

waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f /reg:64
waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d 0 /f /reg:64
waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 1 /f /reg:64

else

waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d 0 /f
waithidden reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 1 /f 

endif

waithidden sc config "wuauserv" start= demand
waithidden sc stop "wuauserv"
7

Our GPO is applied already that sets NoAutoUpdate = 1 and it still updates on some machines which is really weird.

8

One last place to check is the windows task scheduler.
You may find a few windows update tasks scheduled to run under various scenarios, and one of them may reset the service

9

There is no such task scheduled. The only conclusion looks like is users are updating it themselves