WUS No user interaction only wnat a restart now/later (if required

Hi
I have recently installed a WUS 3.0 SP1 Server in our organisation. I have
configured the GPO as follows: download and scedule the install updtaes for
1pm every day. The problem is, even with this configured, a yellow shield is
appearing in the users system tray and they can access this and uncheck
updates from there if they wish. Obviously I do not want this to be possible
to the end user. I want the downloads to be installed 'behind-the-scenes' to
the users, and the only prompt I want them to receive is the restart
now/later prompt. How is this possible (please)?
Ger

Right pew, wrong church. Forwarded to WSUS newsgroup
(microsoft.public.windows.server.update_services) via crosspost as a
convenience to OP.

On the web:
http://www.microsoft.com/communities... date_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
--
~PAB

ger wrote:
> I have recently installed a WUS 3.0 SP1 Server in our organisation. I have
> configured the GPO as follows: download and scedule the install updtaes
> for
> 1pm every day. The problem is, even with this configured, a yellow shield
> is
> appearing in the users system tray and they can access this and uncheck
> updates from there if they wish. Obviously I do not want this to be
> possible
> to the end user. I want the downloads to be installed 'behind-the-scenes'
> to
> the users, and the only prompt I want them to receive is the restart
> now/later prompt. How is this possible (please)?
> Ger

ger wrote:

> I have recently installed a WUS 3.0 SP1 Server in our organisation. I have
> configured the GPO as follows: download and scedule the install updtaes for
> 1pm every day. The problem is, even with this configured, a yellow shield is
> appearing in the users system tray and they can access this and uncheck
> updates from there if they wish.

I take it these users are in the Administrators group on their machines?

> Obviously I do not want this to be possible
> to the end user. I want the downloads to be installed 'behind-the-scenes' to
> the users, and the only prompt I want them to receive is the restart
> now/later prompt. How is this possible (please)?

The user group policy setting "deny access to all windows update features" will
block the yellow shield and the restart notifications. You can turn the restart
notifications back on using these instructions:

<http://groups.google.com/group/microsoft.public.windows.server.update_services/msg/60e7023cbee2712e>

http://groups.google.com/group/micro...e7023cbee2712e

Note, however, that any administrative user can block this and any other group
policy settings if they want to, or for that matter disable automatic updates
altogether.

Harry.

Did you mean the "REMOVE access to use windows update features"? I just want
to ensure that I'm not missing a setting.
And once this user setting is Enabled, then just link my WSUS GPO to the
Users OU as well as computers?

Thanks for the added Restart Link! but a few questions on it....
Does this mean that everything will still be hidden....except for the restart?
Will the restart show for Non-admins as well? Or do I have to Enable the
"Allow non-admins to receive update notifications" setting?
Thanks..
JS

"Harry Johnston [MVP]" wrote:

> ger wrote:
>
> > I have recently installed a WUS 3.0 SP1 Server in our organisation. I have
> > configured the GPO as follows: download and scedule the install updtaes for
> > 1pm every day. The problem is, even with this configured, a yellow shield is
> > appearing in the users system tray and they can access this and uncheck
> > updates from there if they wish.
>
> I take it these users are in the Administrators group on their machines?
>
> > Obviously I do not want this to be possible
> > to the end user. I want the downloads to be installed 'behind-the-scenes' to
> > the users, and the only prompt I want them to receive is the restart
> > now/later prompt. How is this possible (please)?
>
> The user group policy setting "deny access to all windows update features" will
> block the yellow shield and the restart notifications. You can turn the restart
> notifications back on using these instructions:
>
> <http://groups.google.com/group/microsoft.public.windows.server.update_services/msg/60e7023cbee2712e>
>
> http://groups.google.com/group/micro...e7023cbee2712e
>
> Note, however, that any administrative user can block this and any other group
> policy settings if they want to, or for that matter disable automatic updates
> altogether.
>
> Harry.
>

Thanks Harry, I have an additional question re: the reg change to turn on
the restart notification.
Why can't you just Enabled the USER Setting 'Enable Windows Update
Notifications' and set it to '1'?
thx, JS

"Harry Johnston [MVP]" wrote:

> ger wrote:
>
> > I have recently installed a WUS 3.0 SP1 Server in our organisation. I have
> > configured the GPO as follows: download and scedule the install updtaes for
> > 1pm every day. The problem is, even with this configured, a yellow shield is
> > appearing in the users system tray and they can access this and uncheck
> > updates from there if they wish.
>
> I take it these users are in the Administrators group on their machines?
>
> > Obviously I do not want this to be possible
> > to the end user. I want the downloads to be installed 'behind-the-scenes' to
> > the users, and the only prompt I want them to receive is the restart
> > now/later prompt. How is this possible (please)?
>
> The user group policy setting "deny access to all windows update features" will
> block the yellow shield and the restart notifications. You can turn the restart
> notifications back on using these instructions:
>
> <http://groups.google.com/group/microsoft.public.windows.server.update_services/msg/60e7023cbee2712e>
>
> http://groups.google.com/group/micro...e7023cbee2712e
>
> Note, however, that any administrative user can block this and any other group
> policy settings if they want to, or for that matter disable automatic updates
> altogether.
>
> Harry.
>

justscott wrote:

> Thanks Harry, I have an additional question re: the reg change to turn on
> the restart notification.
> Why can't you just Enabled the USER Setting 'Enable Windows Update
> Notifications' and set it to '1'?

I don't have this setting in my group policy console. In fact, until today I'd
never heard of it! I'm guessing you have a Windows 2008 domain controller?

Note that this group policy setting almost certainly sets the same registry keys
I mentioned, so the effect will be the same in either case.

Harry.

This is similar to other thread... but seeing as how I posted 2x....
Yes the reg keys are the same....
And no, I'm not on 2008 server.
My client WUA 7.2.6001.784
wuau adm file dated 7/18/2008


"Harry Johnston [MVP]" wrote:

> justscott wrote:
>
> > Thanks Harry, I have an additional question re: the reg change to turn on
> > the restart notification.
> > Why can't you just Enabled the USER Setting 'Enable Windows Update
> > Notifications' and set it to '1'?
>
> I don't have this setting in my group policy console. In fact, until today I'd
> never heard of it! I'm guessing you have a Windows 2008 domain controller?
>
> Note that this group policy setting almost certainly sets the same registry keys
> I mentioned, so the effect will be the same in either case.
>
> Harry.
>

justscott wrote:

> This is similar to other thread... but seeing as how I posted 2x....
> Yes the reg keys are the same....
> And no, I'm not on 2008 server.
> My client WUA 7.2.6001.784
> wuau adm file dated 7/18/2008

Bit of a mystery, that. You don't have any idea where that version of wuau.adm
came from?

Harry.