Solved

Prohibit Installation of .NET via Windows Updates

Posted on 2010-11-12
3
362 Views
Last Modified: 2012-05-10
How can I prohibit windows updates from installing Microsoft .NET 3.0 and 3.5? (I am assuming they were  automatically installed since all PC's curently show in Add/REmoce Programs.  Although I did not think it was part of the 'critical' automatic updates.  I have managed the network for quite a while and have not manually installed either of these versions)

History: Our organization does not currently use a tool such as Microsoft SMS to manage PC updates.  All are Windows XP Pro workstations configured to run windows updates at the default weekly interval.  

Dilemma: A new application set to 'go-live' in two weeks does NOT work with .NET 3.0 or 3.5.  I have scripted the uninstall of the application and, in testing, appears to remove both .NET's listed above.  I am concerned that when Windows Updates runs next, it will automatically install the 3.0 and 3.5 versions again.  

What is the best approach to keep these .NET versions off the Windows XP PRO workstations?

Thanks for your insight!
0
Comment
Question by:davis
3 Comments
 
LVL 9

Assisted Solution

by:tsaico
tsaico earned 100 total points
ID: 34125379
If you want to keep these out, you will have to manage them via WSUS or similar tool, then in the console disprove of the hot fixes in question.

Two weeks sound a little short for your environment, but spend the weekend trying to figure out the WSUS so you can change the GPO now to at least get your deployment off.  You may also want to check out any current workstation deployment scenarios you have in the GPO already, it might have been pushed out like that to your workstations.

As for desktop management, when I was first starting to play with larger networks and getting some expereince, I had used ScriptLogic's solution and it was pretty good for what I needed at the time.  It was really good for me, since at the time I really hadn't had much real world experience with working with AD, GPO, and dealing with 300 devices at once.  
0
 
LVL 7

Accepted Solution

by:
BobintheNoc earned 400 total points
ID: 34125565
If you can figure out the installer's actual executable name, you could try a Software Restriction Policy from Group Policy to list the executables that shouldn't be allowed to run.
0
 
LVL 1

Author Closing Comment

by:davis
ID: 34219157
Without having to deploy another utility like WSUS, Software Restriction Policy via GPO should work well for keeping this version of .NET off the netwok systems.  I need to use this for prohibiting IE 8 installs, since the app is incompatible with it as well! thanks for the assistance
0

Join & Write a Comment

Synchronize a new Active Directory domain with an existing Office 365 tenant
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now