locked
Software Update Client Settings with local GPO processing disabled RRS feed

  • Question

  • Hi,

    when planing our SCCM 2012 environment we've noticed that the Software Update Client Settings create local GPOs.

    However for security reasons we have the domain GPO "Turn off Local Group Policy objects processing" enabled on some systems and therefore problems with the Software Update settings on these clients/servers. 

    Is there any alternative method to apply the settings via ConfigMgr or a known workaround?

    Thanks in advance.

    Hannes

    Wednesday, February 24, 2016 12:06 PM

Answers

  • It should (!) work if you create a GPO that sets the exact same things as the local one would do.

    Torsten Meringer | http://www.mssccmfaq.de

    Wednesday, February 24, 2016 12:52 PM
  • Hello

    Most people will either have a Group Policy that disables Windows Updates or one that sets the WUServer value to your Configuration Manager 2012 instance that is running WSUS to stop clients from inadvertently getting updates from the Internet.

    disabling Windows Updates via GP will not affect Software Updates delivered by Configuration Manager as the local Configuration Manager client will set the required settings locally.

    The only potential downside to disabling Windows Updates is that the Windows OS will not pull Windows Update Client version updates from the WSUS instance. This was a problem for a while as Microsoft stopped releasing the agent updates as a separate download (people would deploy the updates client version as a package with Configuration Manager). However, earlier this year, that changed with them releasing a stand alone updater to fix issues with Windows 7 x86 operating systems and memory issues due to the large number of updates that now apply to that OS.


    Regards, Regin Ravi

    • Marked as answer by Hannes.K Thursday, February 25, 2016 8:11 AM
    Wednesday, February 24, 2016 12:56 PM

All replies

  • It should (!) work if you create a GPO that sets the exact same things as the local one would do.

    Torsten Meringer | http://www.mssccmfaq.de

    Wednesday, February 24, 2016 12:52 PM
  • Hello

    Most people will either have a Group Policy that disables Windows Updates or one that sets the WUServer value to your Configuration Manager 2012 instance that is running WSUS to stop clients from inadvertently getting updates from the Internet.

    disabling Windows Updates via GP will not affect Software Updates delivered by Configuration Manager as the local Configuration Manager client will set the required settings locally.

    The only potential downside to disabling Windows Updates is that the Windows OS will not pull Windows Update Client version updates from the WSUS instance. This was a problem for a while as Microsoft stopped releasing the agent updates as a separate download (people would deploy the updates client version as a package with Configuration Manager). However, earlier this year, that changed with them releasing a stand alone updater to fix issues with Windows 7 x86 operating systems and memory issues due to the large number of updates that now apply to that OS.


    Regards, Regin Ravi

    • Marked as answer by Hannes.K Thursday, February 25, 2016 8:11 AM
    Wednesday, February 24, 2016 12:56 PM
  • Dear Sir,

    Agree with Torsten and Jason has written a blog for ConfigMgr Software Update Management and Group Policy, see below:

    http://blog.configmgrftw.com/software-update-management-and-group-policy-for-configmgr-what-else/

    Best regards

    Frank


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, February 25, 2016 2:35 AM
  • Thanks a lot for the fast reply. 

    We already thought about using the domain GPO. I was just curious if there was any other way for achieving the same result with SCCM' own tools or settings.

    Hannes

    Thursday, February 25, 2016 8:20 AM