Woody Leonhard's no-bull news, tips and help for Windows, Office and more… Please disable your ad blocker – our (polite!) ads help keep AskWoody going!
Home icon Home icon Home icon Email icon RSS icon
  • Windows Update Agent and WSUS oddity

    Posted on February 16th, 2016 at 11:43 woody Comment on the AskWoody Lounge

    I’m no expert on WSUS, so I pass this on for general consumption. From IT:

    I’m a System Admin, running SBS2011 with WSUS. In the SBS Console I have updates for Client AND Server computers set to none… On the Client Workstations that use WSUS (Not WU) I have them set to update automatically… My thinking is The clients will update automatically only after I manually OK the updates, yet this morning everything has been updated Windows updates, Office updates… Is Microsoft pulling a fast one or am I missing something?


    Also please see screenshot of Windows Update Agent 7.6.7600.256 being installed as well as updates that aren’t security related (I have several of them on other screenshots) despite having security only which has since been changed to NONE, Windows update seems to only be honoring our request unless MS really wants it installed and this is using WSUS… Do a search for the windows update agent in “Installed Updates” and it won’t show up, but from my screenshot you can clearly see it was successful…

    If that helped, take a second to support AskWoody on Patreon

    Home Forums Windows Update Agent and WSUS oddity

    This topic contains 14 replies, has 4 voices, and was last updated by  Davey 1 year, 6 months ago.

    • Author
    • #47154 Reply

      Da Boss

      I’m no expert on WSUS, so I pass this on for general consumption. From IT: I’m a System Admin, running SBS2011 with WSUS. In the SBS Console I have up
      [See the full post at: Windows Update Agent and WSUS oddity]

    • #47155 Reply


      This business of Microsoft bypassing update settings needs to go. I posted in the previous thread about Windows 10 pro.

      I am a consulting (old-school) engineer. I am the only employee. I don’t have an IT dept on call and I am scared to death that one of these days, an update is going to bite me in the behind. If an update borks my computers, I begin losing money *immediately*.

      I have enough stress and anxiety trying to make sure that I have money to pay the bills every month. I don’t need this constant threat. Where is the appropriate forum to let Microsoft know how much this annoys me?

    • #47156 Reply

      Da Boss

      Your guess is as good as mine…

    • #47157 Reply

      AskWoody MVP

      Windows Update agent is installed automatically regardless of any settings. This comes from the WSUS server normally, although the agent checks the internet update site sometimes.
      I can’t tell from your post if the WSUS installation is new or has changed recently, however out of the box you will have Security Updates and Critical Updates installed automatically via a default rule. If you don’t need that level of automation and you should not, the default rule needs to be disabled.
      I use multiple WSUS servers at the moment, 2012R2 and 2008R2 on which SBS2011 is built and I am not aware of any forced update from Microsoft in relation to WSUS, other than the agent which was mentioned before and it has always been updated automatically. Even the version of the agent that was pushed seems old (.256) as the current one is .320 but this may be different according to the OS version.

    • #47158 Reply


      Apparently M$ is giving everybody what they decide is needed now whether we want it or not. Welcome to forced updates one and all!

      It sounds like even WSUS is experiencing the same lack of the user’s control as in this thread…


    • #47159 Reply


      I have McAfee LiveSafe antivirus software and discovered recently that they added a feature, vulnerability scanner. This finds and installs latest software updates for Microsoft Windows and other programs you may have installed. I disabled the feature. Wonder how many other antivirus software companies will follow suit.

    • #47160 Reply

      Dave B.

      Microsoft doesn’t actually care how much it annoys you (or anyone), nor would they care if you were inconvenienced in any way. They are currently of a “we’ll do it the way we want, not the way it should be” state of mind.

    • #47161 Reply

      Da Boss

      I continue to recommend Microsoft Security Essentials and Secunia PSI.

    • #47162 Reply



      Go to Navigation in your McA user interface.
      Click on “Vulnerability Scanner” –> Click on “Custom Scan Settings” –> Click “Don’t Check for Windows Updates”.

      Next, Click on “Scheduled Scan Settngs” –> scroll down and check “Don’t set a scan schedule”.

    • #47163 Reply


      I second MSE and Secunia PSI… However with PSI make sure you uncheck Microsoft updates and automatic updates in general, otherwise your Adobe Acrobat will be updated to A-dopy Cloud… Yeah just what I want… To give A-dopy access to all of my PDF’s as well… For heavens sake, do they strive to be just as bad as MS?

    • #47164 Reply

      AskWoody MVP

      Just a note to what I said before. On Windows 2008R2/SBS 2011 WSUS, you need to have KB2938066 to receive the .320 version of the agent and in general to have the latest functionality of the WSUS server version 3.0 SP2 (or 3.2 as it is also known).
      This update KB2938066 does not come on Windows Update for SBS2011 and has to be downloaded and installed manually.

    • #47165 Reply

      rc primak

      Then again, there are alternatives to Adobe Acrobat. Nothing 100 percent the same, but many alternatives.

    • #47166 Reply


      True, since Adobe went Cloud I have halted all Adobe updates and have been moving to other PDF readers where possible. Acrobat has been the standard for years and for some users in our company advanced PDF creation is essential. Mass confusion would entail if I moved everyone at once.

    • #47167 Reply

      AskWoody Lounger

      My Bitdefender Internet Security software has the same kind of vulnerability scan and I’ve disabled it on all of my computers to avoid any possibility of accidentally installing any Windows 10 enabler updates…

    • #47168 Reply


      Updates to Adobe Reader XI are available, as of January’s release it’s at 11.0.14.

      If you check for an update in Adobe Reader XI click on the “Details” link in the lower left area instead of the “Install” button. You have to jump through a few hoops along the way by choosing your patch but you can manually download and install the patches. The most recent patch from January is named “AdbeRdrUpd11014.msp”

      I have XI on all my computers here, I save the download while updating the first system and put the patch on a flash drive to update the others.

      Looks like Adobe has adopted the M$ tactic to hide what you really want and guide you to installing what they want you to use.

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Windows Update Agent and WSUS oddity

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.

    Your information: