Our workstations now get updates through cloud management, and our servers are moving to Azure Update Manager. The servers still have a Group Policy object with WSUS settings. If I remove that policy, will they stop looking for the old WSUS server, or should I clear the settings another way?
What’s the cleanest way to retire WSUS settings on servers?
Asked by
cobbleweather
Answers
I’d treat this as a staged cleanup rather than deleting the policy right away. First change the WSUS-related settings in the GPO so they no longer direct clients to the old update service. Apply the updated policy to the servers, then check the resulting settings on each server before removing the GPO.
Group Policy settings can sometimes remain in the registry after a policy is no longer applied, depending on the setting. Check the Windows Update policy values under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, including the AU subkey, and confirm the old server address and related WSUS values are gone. Also use policy results to confirm the server is no longer receiving the old GPO. Don’t assume that deleting the GPO cleaned up every machine.
Reply to this answer
Don’t just delete the GPO and call it done. Set the WSUS policies to the state you want, refresh policy on the servers, and inspect the registry for the old WSUS address. Once that’s clean and the new update path works, retire the GPO.
Reply to this answer
Separate “it installs updates” from “it has stopped checking in to WSUS.” Azure Update Manager may be managing update activity while old WSUS configuration is still present, so successful maintenance runs don’t prove the old settings are gone.
After clearing the policy, check the Windows Update client’s configured source and recent update activity on an Arc-enabled server. If it still points to WSUS, review the effective policy and the machine’s local Windows Update settings before assuming the cloud management service has overridden them. The exact cleanup can depend on which policies were configured.
Reply to this answer
Add your answer
Answers are reviewed before publication.
cobbleweather:
So I should verify the actual settings on the servers before I remove the GPO, rather than relying on the GPO change alone?
syrup_onion:
Right. Check a representative server first, then repeat across the rest. If the old values remain, remove them explicitly and verify the server’s update source afterward.