Server 2008 R2 WSUS updating Server without approval

Hello,

We currently setup a WSUS server and for some reason without us allowing it in the group policy the WSUS started installing update on our server and rebooting it without approval.

Is there a setting in the WSUS that perhaps supersedes the GPO?

I can see the Automatic approval rule in the WSUS is set to default.

I also see under "Options" "Computers" it says "User Group Policy or the computer registry"

But then when I go to the left pane and click on "Computers" under "unassigned Computers" I see all my computers and even my server.

Today all servers were updating and rebooting without our consent.

So again can the WSUS force the updates and reboot without GPO consent?
Spirit_USAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ChrisCommented:
WSUS is only a source for updates. No policies are applied to computers from the WSUS console. You will need to check over your group policy settings and probably enforce settings to prevent automatic installation and reboot.
0
akhalighiCommented:
when you deploy WSUS ; your GPO will point your domain computers to WSUS ; rules in WSUS are not GPO related . if you have a "let go" rule ; then it deploys !

This is a very common issue and many admins ran into it . make sure you will disable rules OR WSUS automatic synchronizations ; because every time it synchronizes , your machines receive updates.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
akhalighiCommented:
reboot option can also be controlled within GPO . It's better to exclude servers from auto reboot .( bu putting them on a different OU )
0
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

ChrisCommented:
Look under:

Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows Update

The settings which will possibly need changing are:

Allow Automatic Updates Immediate Installation
Configure Automatic Updates
No Auto-restart with logged on users for scheduled automatic updates.

I would advise that you turn off automatic installation for servers and run the updates during maintenance windows.
0
Tushar_DarwatkarCommented:
Hello,

Check the below link which help you to configure the Automatic Updates with GPO.

http://technet.microsoft.com/en-us/library/cc720539%28v=ws.10%29.aspx
0
Spirit_USAuthor Commented:
I've attached what I currently have going on in my GPO... I see "Configure Automatic Update" is enabled but "Allow Automatic Updates immediate installation" is set to Not Configured.

Does this mean that it was the WSUS pushed the installation?

Also should I set set all of these options to a "Not Configured" state and create 1 Policy linked to a OU for servers where it does not update the server so I can do that manually and create another Policy for Computers and linked that one to a Computers OU?

I'm assuming that by changing the State to "Not Configured" in the "Default Domain Policy" will not interfere with the 2 new policy that I would create to link to Servers OU and Computers OU.

Please advise guys. Thanks!
gpo-settings.jpg
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.