WSUS Client Settings

[MOCInfo]

On certain Windows 2000 computers where Auto Update was enabled to "download
updates but prompt for installation" prior to us setting up WSUS, the
registry entries listed below do not override the previous settings. I've
tried removing the policy settings, rebooting, then disabling AU via the
Control Panel, then reapplying the policy, but the old settings still
prevail. Computers that were never configured for Auto Update work fine with
these settings. Any ideas?

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ElevateNonAdmins"=dword:00000001
"TargetGroupEnabled"=dword:00000001
"TargetGroup"="TestArea"
"WUServer"="http://165.24.135.139"
"WUStatusServer"="http://165.24.135.139"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"UseWUServer"=dword:00000001
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000005
"RescheduleWaitTime"=dword:00000010
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"RescheduleWaitTimeEnabled"=dword:00000001

[Lawrence Garvin [MVP]]

The registry entries provided are 100% valid. If your policy is not replacing
these values with those you have configured in the policy, then this is a
=policy= problem.. not a WUA problem.

Is the listing below from the REG file being used to /import/?
Or is it an actual export of what is configured?

If this is the import file, it would be more useful to see an actual export:
Run 'REG /EXPORT HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
WUExport.txt'
and post the WUExport.txt file

Also "RescheduleWaitTime"=dword:00000010 is actually set to 16 minutes. The
dword value is specified in hexadecimal. If you want the system to wait ten
minutes after power up before installing updates, you should set this to value
to "RescheduleWaitTime"=dword:0x0000000a.

"MOCInfo" <MOC...@discussions.microsoft.com> wrote in message
news:715DB19C-8BD7-4998...@microsoft.com...

[MOCInfo]

That is the actual registry export. I think what I am trying to solve is the
difference between the detection and the installation. I learned that the
"alert" in the systray cannot be hidden or suppressed, but if a detection
takes place say midday and an updated has been approved for installation, the
alert is displayed (no bubble text). If you click on the alert you are
informed that updates are available, click to install. (Which means the
update has already been downloaded from the WSUS server to the client - I
observed) . However, there is also an advanced button that displays what
updates will be installed and gives the user the opportunity to deselect the
update from installation. Is there a way to gray out that option via the
registry? If the user does deselect the update will it still get installed
during the next scheduled installation?

[Lawrence Garvin [MVP]]

Most of these facilities exist because the user logged in is a member of the
local Administrators group.

Non-admin users have no ability to interact with the WUA, and everything
occurs according to policy.

If the status of "Administrators" is problematic, you can remove access to the
WUA for "Administrators" by enabling the /User/ policy "Remove access to all
Windows Update features".

"MOCInfo" <MOC...@discussions.microsoft.com> wrote in message

news:6EC8218E-8CF4-405D...@microsoft.com...

[MOCInfo]

Most of the references for this pertains to Windows XP. Do you have a link to
how the registry would look in Win2k for this entry? ... Thanks.

[Lawrence Garvin [MVP]]

The registry entries for the Windows Update Agent are /identical/ regardless
of the platform being used:
- Windows 2000 Professional SP3 or later
- Windows 2000 Server SP3 or later
- Windows Server 2003 or later
- Windows XP Professional or later
- Windows XP Home or later

"MOCInfo" <MOC...@discussions.microsoft.com> wrote in message

news:4FF8F449-6382-4C84...@microsoft.com...

[MOCInfo]

I have been unable to find a reference to the /User/ policy "Remove access to
all
Windows Update features" registry key. I do not not use Group Policy which
is what I have seen as the means to set this entry. Do you have a reference
for this registry entry that shows the proper syntax, location and data type
for this entry so I can manually edit the registry?

[Lawrence Garvin [MVP]]

Setting this policy on my system and doing a refresh produces the following
registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

with the value/data pair:

"DisableWindowsUpdateAccess"=dword:0x1

which derives from the registry key

HKUsers\<GUID>\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

"MOCInfo" <MOC...@discussions.microsoft.com> wrote in message

news:0718E7A3-E51C-4378...@microsoft.com...

[MOCInfo]

This should do the trick! Thanks for all your help!