none
WSUS GPO (registry) Settings Can't be Removed

    Question

  • Hello,

    I am trying to remove WSUS settings on all workstations in a domain. I have deleted the former policies for the WSUS. When I run RSOP on a machine, I am able to verify the no windows update settings are applied via GPO. However, the registry keys for the WSUS can still be found in "HKLM\Software\Policies\Microsoft\Windows\Windows Update". I still see the WUServer and WUStatusServer keys. If I delete all the WindowsUpdate registry keys, they will reappear on the machine within a few seconds. I have no idea where they could be pulling this information from. It's also peculiar that the workstations are now showing the WUServer value being http://127.0.0.1:1550. Before I removed the WSUS Policies, it was pointing to the old WSUS server. 

    I'm not sure where else to look, I really need to get these registry values deleted permanently. 

    Our domain controllers are Server 2012 and the old WSUS server is 2008. If anyone has any idea's on where to look next I'd greatly appreciate it!

    thanks!


    Monday, December 07, 2015 4:01 PM

Answers

  • Blah, this was caused by Kaspersky  trying to be the WSUS. No one told me Kaspersky was doing so when I took over the network. This thread can be closed/deleted. Thanks
    • Marked as answer by RemyThePitBull Monday, December 07, 2015 8:42 PM
    Monday, December 07, 2015 8:42 PM

All replies

  • hey,

    Several options:

    1. In the WSUS GPO assigned to this server, DISABLE the policy "Specify intranet Microsoft update service location".

    2. If the policy has already been removed, or the machine is in a container with no policy applied for WSUS:
            Reset the registry value UseWUServer = dword:0x0 (DISABLED), or
            Delete the entire registry key HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
                 which will revert the WUAgent to the original installed behavior of Automatic Updates
                 and then set the desired behavior usign the Control Panel | Windows Update dialog.


    Pelicano

    Monday, December 07, 2015 4:30 PM
  • Thanks for the reply, unfortunately I've done both of these and they don't work. The WSUS GPO has been disabled(first thing I started with), and deleting the entire registry key doesn't work, the key is returned within seconds, showing the WSUS settings. 

    I did manage to get the keys deleted on one workstation by changing the permissions on the WindowsUpdate Key. I right clicked the key and choose Permissions>advanced and disabled "inherit permissions", I removed the inheritance and was able to delete the key related to WSUS. I had to go back in and give the registry key permissions for "system" and "administrator" so our remote management system could update the windows update settings.

    Now it appears the workstation has the correct registry settings for Windows Update. My biggest issue now is getting these settings applied to the other 120 workstations. Does anyone know a way to change the permissions for a registry key on all workstations without having to manually do each one as I described above?

    Monday, December 07, 2015 4:47 PM
  • Looks like I spoke too soon, once I put the permissions back in place the registry settings for the WSUS server came back shortly. 

    I need the registry keys gone and I need to keep the permissions for our remote management system for updates. Not sure what else to try.

    Monday, December 07, 2015 4:57 PM
  • Blah, this was caused by Kaspersky  trying to be the WSUS. No one told me Kaspersky was doing so when I took over the network. This thread can be closed/deleted. Thanks
    • Marked as answer by RemyThePitBull Monday, December 07, 2015 8:42 PM
    Monday, December 07, 2015 8:42 PM
  • Hi,

    Appreciate your update and sharing.

    It is greatly helpful information.


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, December 29, 2015 5:27 AM
    Moderator
  • you save my time. Thank you.

    MCT

    Thursday, December 28, 2017 1:15 PM