RE: Updates coming from Microsoft as INSTALL

[craig]

Same here. with approval set to "Install" for all computers and "same as
all computers" for all my groups. this means that production servers will
start shutting down. this kind of "cure" is worse than the viruses!

new files at about 1GB downloaded and with Install WUS is taking over my
network like a virus. Messing with Netware's Client when it installs the
KB899589. This is rubbish!

at the console, I did a search on Install and within last month and set all
to Detect only for all computers. but already been pushed out to over 50 PCs

somebody at MS better answer!
--
system engineer

"Dean" wrote:

> I thought I had my system set up to install updates only after I approved
> them. I received 57 updates from Microsoft last night and all was approved
> for install. Is there a way to flag all new updates from Microsoft as "Detect
> Only" till I approve for install????

[Ken]

KB896358,KB890046,KB896422 all came down as "Install" . I realize these are
updates that supercede but should they not be comming down initially as
"Detect Only" since this is what I have set ??

[Lawrence Garvin [MVP]]

There are two settings you need to check on your WSUS server
configurations...

(1) In [Automatic Approval Options] | [Approve for Installation], is the
option "Automatically approve updates for installation by using the
following rule" enabled?

(2) In [Automatic Approval Options] | [Revisions to Updates], is the option
"Automatically approve the latest revision of the update" enabled?

This response applies to all three posters in this thread.

"Dean" <De...@discussions.microsoft.com> wrote in message
news:C20355BB-EE88-4524...@microsoft.com...

[craig]

yes and yes.
But...has the setting (1) always existed? curious as to what could have
changed because I was using this same system in August, and didn't get
Install with those updates. I am the only one accessing it, so no colleague
to blame.

question: were all those 10/6/2005 files "revisions". I know Oct was a
large month, but nearly a gig of download today.

thank you for the quick reply and accurate answer. seems like it should
take care of my issue.
--
system engineer

[Dean]

Thanks for you assistance - Took the check out and will monitor.....

[Lawrence Garvin [MVP]]

Then the "Auto approve updates for installation..." is what caused /all/ of
your Critical and Security updates to be auto-approved, to the extent you've
defined the products and classifications in that section for auto-approval.

And the "Automatically approve the latest revision..." will cause all
/revisions/ of previously released updates to be automatically installed.

Setting (1) is /not/ the default. Somebody changed that. The /default/ is
"Auto approve updates for detection..." and the only updates auto-approved
for detection are Critical Updates and Security Updates, for all platforms
and products.

I'll have to revisit the 10/6/2005 list again, but it's not likely that any
of them were revisions. To determine if an update is a revision, click on
the "Revisions" tab in the lower pane on the Updates screen. If it is a
revision, you'll see more than one revision listed, and the one with the
highest number should be the current revision.

Some of the updates released in the past week were /repackaged/. Sometimes
the repackaging is merely to correct errors in the metadata. In rare cases,
the repackaging is to actually fix content issues. In the case of the Update
Rollup 1 for Windows Server 2000 SP4 -- that is a repackaging that actually
includes fixes in the content.

The excessive downloads you are noticing are a direct consequence of the (1)
setting we're discussion. Because you have updates set to auto-approve for
installation, all of that content will automatically be downloaded, whether
it is needed or not.

The /default/ configuration of the WSUS server is:
(a) Auto-approve for detection
(b) Only download approved (for installation) updates

If those defaults are maintained, then the only content that will be
downloaded is content actually intended for distribution to clients.

Note also that changing the settings will not affect metadata or content
already downloaded, but will only affect subsequent synchronization
activity.

"craig" <cr...@discussions.microsoft.com> wrote in message
news:26841E39-2ACB-4AD0...@microsoft.com...

[craig]

this is a bit like beating a dead horse...however, I will keep my eye on that
checkbox! 'cause I know it was not changed by a user... I think we all
believe in gremlins....

again, I thank Lawrence for the testing and sharing of his experience in
this forum. I hope to meet his peer in Terminal services, now that I can go
back to the other project. Anyone know if 120 days begins when you turn on
terminal server (it was in remote admin mode since 2003 was installed in
oct2004) or if it checks the date of the OS install (which would be well over
120 days) certainly behaves like OS not activating that it is checking based
on the nature of the errors. Stinks b/c it is my development image. who the
heck wants to load the OS everytime you want to try a new app?
--
system engineer