locked
Paused updates switched on and greyed out after 1089 updated RRS feed

  • Question

  • I have several local GPs governing the rules for Windows updates. Prior to the 1809 update, Paused updates was switched off and greyed out. After the 1809 update (11/10/18), Paused updates was switched on and still greyed out. I am logged-in as the Administrator Account (I had to re-enable it after the update because the update disables it) The only way I could re-gain control of the slider was to reset all local GPs regarding Windows Update  to Not-Configured, re-boot, then set Remove access to "Paused Updates" feature to disabled, reboot, and then set Remove access to "Paused Updates" to not configured and reboot.

    Once I have regained access to the slider, I turned it off, and put all my GPs back in place. I did not change the setting for Remove access to paused updates. I left it as not configured.

    After my reboot the slider was switched back on and greyed out again.

    I do set a 3 day deferral for Feature and a 2 day deferral for Quality updates, as a buffer incase MS sends a bad update and then pulls it right away, but I do not pause them. I am not sure what GP setting is turning the slider on, but I know I am not specifically telling it to pause updates.

    As an side question, why does the 1809 update disable the local administrator account on Win 10 pro? It is kind of a PITA.

    Any Thoughts?  

    Monday, November 19, 2018 5:55 PM

All replies

  • After my Windows 10 upgrade to 1809, I don’t do anything on policies.

    Besides WSUS required GPOs(configured before), all other update group policies are configured as Not configured on my machine, in Settings, Pause update is turned off and greyed out.

    I have a concern about your configurations:

    >>The only way I could re-gain control of the slider was to reset all local GPs regarding Windows Update  to Not-Configured, re-boot.

    I agree with your operations.

    >>then set Remove access to "Paused Updates" feature to disabled, reboot, and then set Remove access to "Paused Updates" to not configured and reboot.

    I don’t think you need to do anything on Remove access to "Paused Updates" feature, after reboot, just configure your policies as before.

    You may try Not Configure on Windows Update for business and check result.

    Regards


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, November 20, 2018 3:23 AM
  • Teemo Tang:

    Sorry it has taken me a bit to reply. I have been looking into this situation in between my other work. I did another walk through on 1809 with my standard set of local group policies in place on a freshly loaded instance instead of an upgrade from 1803. Once I applied my GP settings the same problem cropped back up, Updates Paused for 35 days and the slider to pause greyed out.

    I then set all Windows Update GP settings to not configured, and the slider was still greyed out. Sometimes it takes a while for the Settings UI to update even after a reboot. Once it unlocked, I went and started setting things one at a time and found that it is Local Computer Policy\Computer Config\Admin templates\Windows Components\Windows Update\Configure Automatic Updates - enabled and configured, that caused the problem. Once this is enabled the 35 day deferral and slider lockout happens.

    I went digging around in the registry to find where the date range is being set and found

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Policy State

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings

    Inside here Keys were being added and updates with deferral start and end dates, a value for the 35 deferral, Paused Feature and Quality update were enabled and a hex code was added. 

    also

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

    Had new information added.

    I removed the start date, end date, the 35 deferral, and changed the Paused settings from one to zero.

    I exported the registry folders:

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy

    Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

    Rebooted

    Checked all my settings in the registry to make sure nothing had been reset, and then advanced the date in control panel to >35 days, Checked to make sure updates started, the set the date back to today and everything is running fine now.

    BTW, simply advancing the machine date >35 days will also start windows updates flowing, but w/o the reg fixes as soon as you set the date back they stop. I speculate that if you simply wait >35 days the pause will drop away and you will be fine, just way behind on updates.

    After a while windows repopulates the registry fields I fixed, but it does not seem to be causing me any problems.  

    It seems to be another "feature" of the 1809 debacle. The GP setting in question should not be configuring the registry in this way. There is no field in that GP line item for setting deferrals or start/end dates. I do have deferrals in the Windows Update for Business, but it is 2 days for Feature Updates and 3 days for Quality Updates, just in case MS releases something that blows up. Those locations have Pause Start date fields, but I have nothing entered into them. I also Disable Preview builds.

    My speculation is that the Settings UI is mis-interpreting the information in the Windows Update for Business GP settings and writing spurious information to the registry. It is time to take the Settings UI out back and put it out of our collective misery. The Control Panel worked very well thank you very much.

    Enjoy.

    Wednesday, November 28, 2018 7:48 PM