NT Domain - GPO - Windows Updates Greyed Out - Need Released

Typical NT Domain, DC - Server 2008 R2, about 50 clients - Windows XP, 7 and 8. When logged in as typical domain user on client computer, the windows update is greyed out. Which GPO makes this available? The Windows update settings in the Default Domain Policy - none of the settings are configured. If I disable them or create a new GPO and place computers inside and disable Windows Update settings, and run gpupdate on client, there is no difference; still greyed out. Ran gpresults and don't see any other gpo afecting the computer. I am missing a step, what? Thx for help...
xav1963Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

xav1963Author Commented:
Forgot to mention ... WSUS not installed on server.
Will SzymkowskiSenior Solution ArchitectCommented:
This GPO can be setup on ANY GPO you configure. This is a computer based policy so what i would do is the following...
- locate where the computer account resides in Active Directory
- open gpmc.msc
- go to that OU where the computer object resides
- check all of the COMPUTER settings for every policy that is linked to this GPO
- Once you have found this setting you modify it or simply disable the setting if that is what you want to do

Will.
xav1963Author Commented:
That is what I have done ... created a new GPO, placed computers inside, disabled the Configure Automatic Updating ... still is greyed out on client ....

Let me ask the question this way, where in Domain GPO can I disable or enable the Windows Update feature on a Windows 7 client computer?
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Will SzymkowskiSenior Solution ArchitectCommented:
What are you using for Security Filtering on your GPO's? Authenticated Users? Also if the GPO that is applying the policy is applied after the one that you have applied it will take precedence and overwrite the setting.

You need to FIND the origainal GPO that has this policy enabled and either do the following...
- change the security filtering so that it does not apply to the machine specifically
- disable the GPO setting entirely in the original GPO
- set a deny permission on the GPO for the computer you want to disable this on
- move the computer out of this GPO and into another one, if it is a sub OU then use blocked inheritance to stop the parent policy from applying, if it is in another OU then you do not have to do anything

Will.
Joseph DalyCommented:
If you cant find the GPO that is causing the issues you could try manually editing the registry on the affected computers. There are mainly two locations that control windows updates

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
and
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Take a look here and see if you have a WSUS server configured.
Will SzymkowskiSenior Solution ArchitectCommented:
GPO's are registry driven, so unless he completely isolates this machine or find the GPO the policies will always apply.

Will.
xav1963Author Commented:
I wanted to first test my new gpo ... so I did this ... made a couple of changes in the default domain policy, applied, ran gpupdate /force and success... Now I change these back to "non configured", do the same changes in my new gpo, apply, gpupdate and failed ... no changes...
Yes, the computer is inside the OU where the new GPO is linked.
I want to let the Default Policy apply with its changes and then allow this New GPO to apply with its different changes. I assume this works when the Default Policy has those items "Not configured", correct? So why is it not working for me?
Will SzymkowskiSenior Solution ArchitectCommented:
Ok now that you have explained exactly what you are trying to accomplish, it should work as you have illustrated. However because this is a computer based policy most of them require a reboot before they actually take affect.

When you are on the machine logged in, open cmd type rsop.msc, right click computer configuration, select properties, This will show you all of the policies that have actually applied to the machine. If you do see the correct policies then reboot the machine and check again.

If you do not see your policy make sure that you check Security Filtering and ensure that your computer is not being filtered out anywhere.

Also in rsop.msc default screen, you can expand the settings that are applied to your machine. expand the settings on your machine where Updates are applied. See what the setting is configured to.

Will.
xav1963Author Commented:
Will.... I rarely change GPOs and forgot all about the rsop.msc. That is exactly what I needed to see what is and isn't applied.... thanks ... however back to my original question ... I have enabled, disabled and not-configured "Configure Automatic Updates" and no matter, the Windows Update page on an XP box is still greyed out. I have looked through all the rsop results and I see nothing there that is greying it out.
Any ideas?
Will SzymkowskiSenior Solution ArchitectCommented:
There are only a few reasons why policies would not apply, as I have told you what to check. If you say everything is correct then there must be another underlying issue you have not mentioned. Or this might have been something you have overlooked.

Is it possible to post screenshots? I cannot really add anymore value as I have told you where to lock but I cannot see the rest of your environment.

Will.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
xav1963Author Commented:
Couldn't specificly find the gpo affecting the issue ... but appreciated the help...
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.