I manage updates using WSUS and have it set up to download updates but not automatically install them. However, today, when I went to manually approve some updates and clicked 'check for updates' on one of our servers, it immediately started installing them. Is this the expected behavior? I thought that when updates are approved through WSUS, they should still adhere to the automatic update group policy. Can someone explain why the updates started installing right away?
7 Answers
When you hit 'check for updates' manually in the Windows Update GUI, it might actually override the group policy that says "notify for install". So it’s not just checking—it’s prompting the install too.
Yes, that manual check triggers the installation as well, which can be a little misleading.
From my understanding, the GUI doesn’t just check—it actually starts the installation too. If you're only looking to check, using the command line like 'wuauclt /detectnow' should do the trick without triggering an install. Just give it a moment to process!
Basically, when you click 'Check for Updates' in Windows, the system is actually detecting and installing updates. If there are updates already downloaded, it’ll let you know to 'install now' instead of saying 'check for updates'. It might be worth getting to know some command line tools too, as they can give you more control over the process.
Thanks for explaining! I didn't manually click that before setting up WSUS, so it makes sense now that the updates are applying. The GPO is supposed to handle downloading, so seeing the install option instead of just checking is a bit unexpected.
Wuauclt can be such a pain. I loathe how uninformative it is. No feedback, no indication of what it's doing! Getting used to WSUS could be better, for sure.
Don’t forget about deadlines! When you approve an update in WSUS, you can set a deadline. If that deadline is set to an immediate time or even in the past, the update will start installing right away when you check for updates.
If the WSUS policy isn’t set to prevent manual updates through the Windows Update interface, your manual check goes directly to online Windows Update and uses default settings, which usually includes downloading and installing updates immediately. It's crucial to set the right policies for both WSUS and Windows Update to avoid surprises like this.
I typically start by ensuring that the servers have the correct registry settings. Check under HKLM/software/policies/microsoft/windows/windowsupdate to make sure everything is set as it should be.
There might be a group policy setting that auto-installs critical or minor updates, which could be conflicting with your schedule. I used to struggle a lot with WSUS while managing thousands of machines; eventually, I disabled auto-updating. Now I use a different tool to better control the update schedule, and it’s made my life so much easier.
That definitely seems to be what happened! But it does feel a bit confusing. Isn't the 'Check for Updates' button supposed to just check for new updates?