none
Installing Updates Manually After Being Auto-Approved

    Question

  • Hi,

    I've set up auto-approve on SCE 2010, which works well. Within a 22 hour period, the clients will download the updates. I have the GPO set to 'Configure Automatic Updates' = 3; Downloand and NOTIFY of updates. All of this works well.

    When I log on, and go to Windows Updates - even as a domain Administrator (and my membership is part of the Local Administrator group), I cannot manipulate the Update process; i.e. I can't start the install process. If I log on to the local administrator account, the updates are available to install.

    (I can't upload a screenshot at this time)

    The screen says 'Some settings are managed by your system administrator'. There is no option to install updates. Clicking on the Check for Updates link shows 'Windows Update cannot currently check for updates, because updates on this computer are controlled by your system administrator'.

    What GPO or Group Membership am I missing to be able to kick off the update process? I really don't want to have to log on with the local administrator account.

    Is there a command line to start the update process remotely?


    • Edited by mriksman Monday, April 08, 2013 10:45 PM
    Monday, April 08, 2013 10:43 PM

Answers

  • After days of hunting around, I found the group policy setting that was causing my headache;

    User Configuration \ Policies \ Administrative Templates \ Start Menu and Taskbar \ Remove Links and Access to Windows Update

    Having this ENABLED removes the ability to kick off the install process.

    • Marked as answer by mriksman Tuesday, April 09, 2013 1:06 AM
    Tuesday, April 09, 2013 1:05 AM

All replies

  • After days of hunting around, I found the group policy setting that was causing my headache;

    User Configuration \ Policies \ Administrative Templates \ Start Menu and Taskbar \ Remove Links and Access to Windows Update

    Having this ENABLED removes the ability to kick off the install process.

    • Marked as answer by mriksman Tuesday, April 09, 2013 1:06 AM
    Tuesday, April 09, 2013 1:05 AM
  • Only if you include the "administrator" account inside this policy. Otherwise, the administrator account (or other designated account) can and will apply the updates and if set up correctly will only wait and prompt the end user if/when it needs to reboot.

    Of course there are several such policy configurations that can tweak the update experience based on Domain Machine, Domain User, and Local computer/user accounts and what you wish them to do.


    Randall

    Tuesday, April 09, 2013 7:50 PM