Something Overriding My Group Policy Settings

[jayinalaska]

Windows 10 Pro Version 2004 (OS Build 19041.685)

I seem to be losing my ability to control Windows Updates even though I’m running the Pro version and using group policy. I very rarely open the Update and Security section in the Settings app and, when I do, I never click “Check for Updates”. I control my updating in PowerShell using the PSWindowsUpdate module from the PowerShell Gallery.

Today, after I brought my PC out of sleep and logged in, I noticed the “reboot pending” icon in the status area. Upon investigation, I discovered that this month’s cumulative update (CU) had downloaded and was awaiting installation. The “reboot pending” icon shouldn’t have been there because I have group policy settings that:

• Enable quality update deferrals with the deferral period set to 15 days.
• Configure Windows Update to notify me before downloading.

From an elevated PowerShell window, I ran Get-WUSettings, the PSWindowsUpdate command to check my settings. To my surprise, this came back empty. It normally has output. I then opened the Local Group Policy Editor and checked all of my settings. They were all as I had last set them. On a lark, I ran gpupdate /force in the PowerShell window. Both the computer and user policies updated (no logout/reboot was necessary). I then reran Get-WUSettings and got back this output:
ExcludeWUDriversInQualityUpdate : 1
AUPowerManagement : 0
TargetReleaseVersion : 1
TargetReleaseVersionInfo : 2004
DeferQualityUpdates : 1
DeferQualityUpdatesPeriodInDays : 15
PauseQualityUpdatesStartTime :
SetDisablePauseUXAccess : 0
NoAutoUpdate : 0
AUOptions : 2 – Notify before download
ScheduledInstallDay : 0 – Every Day
ScheduledInstallTime : 3
ScheduledInstallEveryWeek : 1

I omitted the computer name from the output. Otherwise, this is the output I normally see.

I don’t remember the last time I checked these settings, either in PowerShell or from the Local Group Policy Editor. This is the third month in a row that my deferral settings have been ignored. There’s no pattern I can discern. IIRC, in November, I saw the CU had downloaded and was awaiting installation maybe a week after Patch Tuesday. In December, the CU was available, but hadn’t downloaded, on day 13/14 of the deferral (it was the Monday of the 4th week). This month, the CU downloaded and is waiting for installation the day after Patch Tuesday. For now, I’ve hidden the CU and I’m hoping the “reboot pending” prompt will go away after the next automated scan cycle.

I’ve been mentioning only the CU for simplicity. The other available updates each month behaved like the CU.

I’m really at a loss here. To the best of my knowledge, I don’t have any malware. I can’t think of any changes I’ve made that would affect Windows Update. As far as I can tell, group policy should be updating every 90 minutes or so, at reboot, and at log in. I’ve only had this issue since going to 2004.

Reply | Quote

[PKCano]

Grasping at straws.
Read through AKB2000016 particularly Sections 3 and 5, and see if there are any clues there.
Did you at any time mess with Metered connections? I have seen that and Resume from Pause both initiate download/install in spite of GP settings.

Reply | Quote

[jayinalaska]

Sorry for the slow response; it’s been a busy couple of days.

Everything I do is consistent with the AKB referenced.

I’ve never changed any of the metered connection settings.

I’ve never used Pause/Resume.

Reply | Quote

[anonymous]

I am in a similar situation.  There are a number of Windows 10 computers at work that I keep an eye on during the year. I have disabled ‘Configure Automatic Updates’ through the local group policy.  This has worked for many months, no problems whatsoever.  It does not check for updates unless I specifically click ‘Check for updates’.  During our busy season, these computers need to be running 24/7 and I have disabled updates so this can happen.  During our slow time, I install the updates so our computers do not get too far out-of-date.

Recently, I installed the new updates so they now have version 20H2.  I have made no other changes.  Ever since then, those computers are checking for updates on a daily basis.  It doesn’t look like any of them have automatically restarted so far. The group policy is still set correctly, so I am unsure of how to stop these updates from proceeding.  I have about a 5-7 month period where I do not want these computers auto-updating and restarting because it will mess stuff up.  Any thoughts?

Thanks!

Reply | Quote

[Author]

Posts