Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Tuesday, October 24, 2017 12:51 PM
Hello,
We have GPO that is set to control Windows 10 updates. Effectively it should set the follwing registry keys:
AUOptions = 4
NoAutoUpdate = 0
ScheduledInstallDay = 0
ScheduledInstallTime = 16
NoAutoRebootWithLoggedOnUsers = 1
However when I run gpupdate on computer and at the same time I keep refreshing the HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU folder it shows correct value for AUOptions (4) and NoAutoUpdate (0) but after few seconds it reverts them back to value of 1. There are no other GPO objects or login scripts that have same setting set. Why would this kind of behaviour occur?
All replies (6)
Friday, October 27, 2017 2:04 PM ✅Answered
Hi,
We should still focus on who changed the registration form back. Depending on the link below, there are two ways to monitor registry changes. One is to use process Monitor, and the other is to set Audit. To check if you can find out who changed the registration form.
https://blogs.msdn.microsoft.com/cobold/2011/11/29/monitoring-when-registry-keys-are-modified/
Best regards,
Carl
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Wednesday, October 25, 2017 8:30 AM
Hi,
Perform a clean boot and disable the security software to check.
Update the WUAgent.
Check the link below about WSUS WUServer String Value Keeps Restoring to Old SUS Server if it is helpful.
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Hope it will be helpful to you
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Thursday, October 26, 2017 7:33 AM
Hi,
This problem is occuring with 2 customers running different security software so that shouldnt be the case nor fix.
Is there even way to update the agent for Windows 10? I thought it updates itself automatically.
We have never had wsus server in use and there are no registry entries that thread talks about. So sadly none of the above help the issue:/
Weird thing is that if I change the values using local group policies they stick and are not overwritten.
Saturday, October 28, 2017 7:30 AM
Hi, If you have settings being changed after gpupdate then this must be a group policy setting somewhere that is changing it. I’d suggest running an RSOP and checking what policies are allowed and denied to a computer and user who are having the issue. This should show you all the settings that are being applied and what policies they have come from. It could be the change has been made somewhere unexpected, like the default domain policy. Another way to verify it is group policy is the settings won’t be able to be changed or managed by a user if they are configured with group policy. At least this way you know if it is a GPO or not.
Monday, October 30, 2017 9:16 AM
Thank you for this Carl. I was finally able to track what made the changes using the registry audit event logs. Weird as it is, change back is made by our remote support agent. Ill have a talk with them about this. Thanks everyone for your help!
Wednesday, March 6, 2019 2:17 PM
old link but this should be the first step - find out why its reverting,
in my case N-able remote support tool was doing patch management.
https://blogs.msdn.microsoft.com/cobold/2011/11/29/monitoring-when-registry-keys-are-modified/
set up auditing on the registry keys that are changing and the event log will tell you what did it.