[Last Call] Learn how to a build a cloud-first strategyRegister Now


Can't install Windows update as Domain Admin using WSUS

Posted on 2009-04-19
Medium Priority
Last Modified: 2012-05-06
I started using WSUS in my environment.  Once I pointed all of my servers (2003, 2008 servers) to the WSUS server I no longer can install any updates as the Domain Administrator.  I have to log into the servers as the local administrator in order to have the "install" button become available.  Anyone know why this happens?  Is it a GPO issue?  The Domain Admin should have all rights to the local server...
Question by:lecomm
  • 4
  • 2

Assisted Solution

BDoellefeld earned 300 total points
ID: 24181803
Sounds like the GPO is being applied to the Administrator account.

Author Comment

ID: 24185291
The only problem is that I created several other admin accounts by copying the Domain Admin account and they can see the install button to install updates... it is only the Domain Admin account.  I have looked through the GPOs and they are all pretty much default at this point as we really are not using them yet (none of our workstations are in the Domain yet as we are migrating from Novell).
LVL 39

Accepted Solution

ChiefIT earned 1200 total points
ID: 24234890
To effect the domain admin, it could be the default domain controller policy or default domain policy that this particular group policy object is on.

I think on this thread I explained the different policies you can create for WSUS and how each effects the administrator and/or users:

It is recommended not to include your DCs within the main domain's set of policies, especially if you tell them to autoreboot after updates and you also automatically approve all updates. You never know when you could get a bad updated. What I do is wait a month or so and see if an update causes waves before I manually approve and install the update during non-working hours.

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 24304245
I have looked through the policies and I can't seem to find what can be causing this.  Can anyone get specific and tell me where to look in the policies that could cause the Domain Admin to not be able to install updates on my WSUS connected servers?

Author Comment

ID: 24355337
Can anyone  help with this?  I am trying to determine why I can not use my Domain Admin account to install updates on my servers after connecting them to the WSUS server...  It is becoming a pain to have to log into the local administrator to install patches as some of these servers are in NLB configurations or CCR configurations for Exchange and you can't manage the CCR or NLB when logged in as local administrator.
LVL 39

Assisted Solution

ChiefIT earned 1200 total points
ID: 24393903
I can fix this for you. I just need to get on the same sheet of music that you are on.

This is definately a group policy. It is effecting a domain user, not a local user. So, let's fix this.

There is a WSUS group policy object that tells your clients and servers, that are within the group policy, to auto download, and another to auto install Windows updates. This is what I am currently thinking. If you are downloading and isntalling updates automatically, your clients don't need the Microsoft Website Icon for updates.

This leads me to a question I need to ask of you:
When you say the Windows update button is missing, where are you looking for this exactly? Do you mean the Icon within the start button menu that sends you to Microsoft Updates. Because that Icon is for sending you to Microsoft's website, not your WSUS server. I  can replace that as well.


Author Comment

ID: 24473792
Yes, it was a GPO issue and I did track it down.  I have inhertitance blocked on the OU that has my admin accounts in it.  There is no way to block inheritance on the USERS OU which is where the Administrator account is located.  With the setting "Allow non-administrators to receive update notifications" set to enabled then the Domain Administrator will not see the "install" button when you click on the yellow shield to install ready updates.  No work around, just use another account with Domain Admin rights, but located in another OU with inheritance blocked for the GPO.

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Suggested Courses

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question