none
Removed PC from WSUS group, added to another group PC still getting updates assigned to the initail group.

    Question

  • Hi
    I am trying to remove IE9 off a PC as we have a requirement to run IE8 on a number of PCs.
    IE9 was deployed through WSUS.
    I have created an OU & policy in AD,  & a group in WSUS.
    The PC has appeared in the WSUS group ok & I have removed the IE9 update for that group only, so it is not deployed.
    I can remove the update from the PC & IE8 will work but the IE9 update is still being forced down to the PC.
    As it is categorised as an important update it installs itelf.
    When I run GPRESULT on the PC, it is bringing up that the correct policy is being deployed.
    I do notice when I look at the WSUS interface that the update does not support removal.
    I think there are some IE 9 Prerequisite updates that are iniating the deployment but I cannot find which one they are, I have removed KB2454826 bit IE is still coming back through WSUS.

    Friday, October 04, 2013 9:21 AM

Answers

All replies

  • examine the windowsupdate.log on that client machine - is it correctly reflecting the targeting group for WSUS?
    It's a client-side targeting group, set by your GPO ?

    Does windowsupdate.log show IE9 is being installed by WUAgent?


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Saturday, October 05, 2013 12:00 PM
  • Hi,

    Not all updates support removal. You can see whether an update supports removal by selecting an individual update and looking at the Details pane. Under Additional Details, you will see the Removable category. If the update cannot be removed through WSUS, in many cases it can be removed with Add or Remove Programs from Control Panel.

    Please refer to the below similar thread:

    uninstall-update-from-client

    http://social.technet.microsoft.com/Forums/windowsserver/en-US/8a14c4f9-9d41-443a-b512-56df9f1d74ee/uninstall-update-from-client?forum=winserverwsus


    Cataleya Li
    TechNet Community Support

    Monday, October 07, 2013 6:32 AM
    Moderator
  • I can remove the update from the PC & IE8 will work but the IE9 update is still being forced down to the PC.

    Did you remove the APPROVAL for Internet Explorer 9?

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2013)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Monday, October 07, 2013 11:25 PM
    Moderator
  • Yes, I have the removed the approval for IE 9.

    Friday, October 25, 2013 9:49 AM
  • Yes, I have the removed the approval for IE 9.

    Then there's no known way in which Internet Explorer 9 could be installed "automagically" in October, 2013 by WUAgent. Are there actual log entries in the WindowsUpdate.log demonstrating that the WUAgent installed IE9?

    Generally speaking, if a Windows 7 system were talking to AU or WU, it would be getting IE10 or IE11, not IE9. Ergo, either IE9 is still approved, or you have some other methodology completely outside the scope of WSUS (i.e. a Group Policy implementation?) that is pushing IE9.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2013)
    My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence R Garvin
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Friday, October 25, 2013 10:58 PM
    Moderator