Log in

No account? Create an account

Previous Entry | Next Entry

I've recently had a spat of clients who were not able to select Restart Later when they received updates via Automatic Updates. I validated that they should in fact be able to perform this function - Elevate non-admins was enabled and the updates did not have a deadline within WSUS. After quite a bit of investigation, we figured out what the cause for us was. As always, your mileage may vary.

In the registry, under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate, there was a key DisableWindowsUpdateAccess with a value of 1. That indicates that a policy, either Group Policy or Local Policy, is in effect. You can attempt to delete the key, but any sort of policy will put it back upon refresh. You can do a gpresults to figure out which.

For me, it was a local policy, so I launched GPEdit.MSC, navigated to User Configuration\Administrative Templates\Windows Components\Windows Update, selected Remove Access to use all Windows Update features, and changed it to Disabled. This is one of those great double negatives of policy - disable the removal of access means that it's effectively enabled.