Discussion:
nowindowsupdate
(too old to reply)
nowindowsupdate
2004-11-15 14:04:09 UTC
Permalink
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
change this registry key from 1 to 0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate.
Two issues:
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Athif
2004-11-20 16:53:49 UTC
Permalink
Certainly, the registry value "NoWindowsUpdate" will block the
Automatic Updates, if you manually go the MS windowsupdate site..Thatz
what it is supposed to do.. So I would suggest you to remove the
offending "NoWindowsUpdate" registry value

For a sample registry script, have a look at my article on;
Manipulating SUS Settings through the Registry:
http://www.faqshop.com/sus/hotips/manip%20settings%20through%20reg.htm#Top
http://tinyurl.com/634yc

HTH,
Mohammed.Athif Khaleel.
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate.
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
MF
2004-11-22 09:55:12 UTC
Permalink
Athif,

Could I adapt the code from the URL you included to remove a registry entry
rather than add one? That would solve it. Otherwise I'll have to remove it
manually everytime a new user logs in to a PC - what a nightmare!

Thanks very much...

Mike
Post by Athif
Certainly, the registry value "NoWindowsUpdate" will block the
Automatic Updates, if you manually go the MS windowsupdate site..Thatz
what it is supposed to do.. So I would suggest you to remove the
offending "NoWindowsUpdate" registry value
For a sample registry script, have a look at my article on;
http://www.faqshop.com/sus/hotips/manip%20settings%20through%20reg.htm#Top
http://tinyurl.com/634yc
HTH,
Mohammed.Athif Khaleel.
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate.
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
MF
2004-11-22 09:49:09 UTC
Permalink
Thanks for this. I've tried that but it only works on a per-profile basis. If
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear to be
in any default profile and it doesn't appear to get it from any GPO. It's
driving me mad!!!!!

Thanks...

Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate.
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Athif
2004-11-23 08:47:24 UTC
Permalink
I believe you have some policy for nowindowsupdate registry entry, check it out!
You might have something which is conflicting/disabling with Automatic Updates.

HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile basis. If
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear to be
in any default profile and it doesn't appear to get it from any GPO. It's
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate.
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Steve Seguis [MVP]
2004-11-23 23:03:44 UTC
Permalink
The best way to check if you have a policy being applied to that PC is by
running GPResults.exe from the windows 2000 resource kit to determine your
RSoP (Resultant Set of Policies). That should accurately inform you whether
or not this policy is being implemented via a policy.
--
Steve Seguis - MCSE, Microsoft MVP, SCJP
SCRIPTMATION
Automating the Enterprise
http://www.scriptmation.com
Post by Athif
I believe you have some policy for nowindowsupdate registry entry, check it out!
You might have something which is conflicting/disabling with Automatic Updates.
HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile basis. If
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear to be
in any default profile and it doesn't appear to get it from any GPO. It's
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUp
date.
Post by Athif
Post by MF
Post by nowindowsupdate
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and scan
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it out. If
you change the setting from 1 to 0 it stays that way for half an hour or so
then reverts back - even if you restart the machine it'll stay that way for
about half an hour and then revert. There is no policy in AD that is doing
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it would run
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
MF
2004-11-25 10:13:02 UTC
Permalink
Steve,

I've run GPresult and it's not getting it from any GPO in AD or local
policies - I don't know where else it would get it from - there's no system
policies in place either. If you build a new machine from scratch and join it
to the domain, within an hour or so it also get the nowindowsupdate registry
entry.

Where else could it come from?

This has happened since we first migrated from NT4 - the first W2K machines
on the NW got this nowindowsupdate setting and it's never gone away.

I'm exasperated trying to find the source of this and think that maybe a
workaround would be to remove the registry entry with vb or wsh and a logon
script - is there anyway this can be done?

Thanks...

Mike
Post by Steve Seguis [MVP]
The best way to check if you have a policy being applied to that PC is by
running GPResults.exe from the windows 2000 resource kit to determine your
RSoP (Resultant Set of Policies). That should accurately inform you whether
or not this policy is being implemented via a policy.
--
Steve Seguis - MCSE, Microsoft MVP, SCJP
SCRIPTMATION
Automating the Enterprise
http://www.scriptmation.com
Post by Athif
I believe you have some policy for nowindowsupdate registry entry, check
it out!
Post by Athif
You might have something which is conflicting/disabling with Automatic
Updates.
Post by Athif
HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile
basis. If
Post by Athif
Post by MF
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear
to be
Post by Athif
Post by MF
in any default profile and it doesn't appear to get it from any GPO.
It's
Post by Athif
Post by MF
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if
i
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUp
date.
Post by Athif
Post by MF
Post by nowindowsupdate
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and
scan
Post by Athif
Post by MF
Post by nowindowsupdate
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it
out. If
Post by Athif
Post by MF
Post by nowindowsupdate
you change the setting from 1 to 0 it stays that way for half an hour
or so
Post by Athif
Post by MF
Post by nowindowsupdate
then reverts back - even if you restart the machine it'll stay that
way for
Post by Athif
Post by MF
Post by nowindowsupdate
about half an hour and then revert. There is no policy in AD that is
doing
Post by Athif
Post by MF
Post by nowindowsupdate
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it
would run
Post by Athif
Post by MF
Post by nowindowsupdate
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Athif
2004-11-25 18:10:33 UTC
Permalink
Okk.. Here you go..
The policy you are worried about is "Disable and remove links to
Windows Update"
This policy Removes the Windows Update link from the More Programs
list
in Start menu, from the Tools menu in IE, and blocks user access to
windowsupdate.Microsoft.com.
Registry Value:"NoWindowsUpdate"
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

This entry stores the setting of the Disable and remove links to
Windows Update Group Policy. Group Policy adds this entry to the
registry with a value of 1 when you enable the policy. If you disable
the policy or set it to Not configured, Group Policy deletes this
entry from the registry, and the system behaves as though the value is
0.

To change the value of this entry, use Group Policy. This entry
corresponds to the Disable and remove links to Windows Update Group
Policy (User Configuration\AdministrativeTemplates\Start Menu &
Taskbar).

HTH,
Mohammed.Athif Khaleel.
Post by MF
Steve,
I've run GPresult and it's not getting it from any GPO in AD or local
policies - I don't know where else it would get it from - there's no system
policies in place either. If you build a new machine from scratch and join it
to the domain, within an hour or so it also get the nowindowsupdate registry
entry.
Where else could it come from?
This has happened since we first migrated from NT4 - the first W2K machines
on the NW got this nowindowsupdate setting and it's never gone away.
I'm exasperated trying to find the source of this and think that maybe a
workaround would be to remove the registry entry with vb or wsh and a logon
script - is there anyway this can be done?
Thanks...
Mike
Post by Steve Seguis [MVP]
The best way to check if you have a policy being applied to that PC is by
running GPResults.exe from the windows 2000 resource kit to determine your
RSoP (Resultant Set of Policies). That should accurately inform you whether
or not this policy is being implemented via a policy.
--
Steve Seguis - MCSE, Microsoft MVP, SCJP
SCRIPTMATION
Automating the Enterprise
http://www.scriptmation.com
Post by Athif
I believe you have some policy for nowindowsupdate registry entry, check
it out!
Post by Steve Seguis [MVP]
Post by Athif
You might have something which is conflicting/disabling with Automatic
Updates.
Post by Steve Seguis [MVP]
Post by Athif
HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile
basis. If
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear
to be
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
in any default profile and it doesn't appear to get it from any GPO.
It's
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if
i
Post by Steve Seguis [MVP]
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUp
date.
Post by Athif
Post by MF
Post by nowindowsupdate
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and
scan
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it
out. If
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
you change the setting from 1 to 0 it stays that way for half an hour
or so
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
then reverts back - even if you restart the machine it'll stay that
way for
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
about half an hour and then revert. There is no policy in AD that is
doing
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it
would run
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
MF
2004-11-26 15:21:01 UTC
Permalink
Athif,

Thanks very very much for this.

This policy was enabled in the Default Domain Policy! No wonder...

You can't imagine how happy this makes me - sad by true!

Mike
Post by Athif
Okk.. Here you go..
The policy you are worried about is "Disable and remove links to
Windows Update"
This policy Removes the Windows Update link from the More Programs
list
in Start menu, from the Tools menu in IE, and blocks user access to
windowsupdate.Microsoft.com.
Registry Value:"NoWindowsUpdate"
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
This entry stores the setting of the Disable and remove links to
Windows Update Group Policy. Group Policy adds this entry to the
registry with a value of 1 when you enable the policy. If you disable
the policy or set it to Not configured, Group Policy deletes this
entry from the registry, and the system behaves as though the value is
0.
To change the value of this entry, use Group Policy. This entry
corresponds to the Disable and remove links to Windows Update Group
Policy (User Configuration\AdministrativeTemplates\Start Menu &
Taskbar).
HTH,
Mohammed.Athif Khaleel.
Post by MF
Steve,
I've run GPresult and it's not getting it from any GPO in AD or local
policies - I don't know where else it would get it from - there's no system
policies in place either. If you build a new machine from scratch and join it
to the domain, within an hour or so it also get the nowindowsupdate registry
entry.
Where else could it come from?
This has happened since we first migrated from NT4 - the first W2K machines
on the NW got this nowindowsupdate setting and it's never gone away.
I'm exasperated trying to find the source of this and think that maybe a
workaround would be to remove the registry entry with vb or wsh and a logon
script - is there anyway this can be done?
Thanks...
Mike
Post by Steve Seguis [MVP]
The best way to check if you have a policy being applied to that PC is by
running GPResults.exe from the windows 2000 resource kit to determine your
RSoP (Resultant Set of Policies). That should accurately inform you whether
or not this policy is being implemented via a policy.
--
Steve Seguis - MCSE, Microsoft MVP, SCJP
SCRIPTMATION
Automating the Enterprise
http://www.scriptmation.com
Post by Athif
I believe you have some policy for nowindowsupdate registry entry, check
it out!
Post by Steve Seguis [MVP]
Post by Athif
You might have something which is conflicting/disabling with Automatic
Updates.
Post by Steve Seguis [MVP]
Post by Athif
HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile
basis. If
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear
to be
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
in any default profile and it doesn't appear to get it from any GPO.
It's
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if
i
Post by Steve Seguis [MVP]
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUp
date.
Post by Athif
Post by MF
Post by nowindowsupdate
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and
scan
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it
out. If
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
you change the setting from 1 to 0 it stays that way for half an hour
or so
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
then reverts back - even if you restart the machine it'll stay that
way for
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
about half an hour and then revert. There is no policy in AD that is
doing
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it
would run
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Athif
2004-11-27 09:23:09 UTC
Permalink
Awesome.!
Eventually, what makes the difference is "Back to work, dude"

Cheers,
Athif
Post by MF
Athif,
Thanks very very much for this.
This policy was enabled in the Default Domain Policy! No wonder...
You can't imagine how happy this makes me - sad by true!
Mike
Post by Athif
Okk.. Here you go..
The policy you are worried about is "Disable and remove links to
Windows Update"
This policy Removes the Windows Update link from the More Programs
list
in Start menu, from the Tools menu in IE, and blocks user access to
windowsupdate.Microsoft.com.
Registry Value:"NoWindowsUpdate"
Location: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
This entry stores the setting of the Disable and remove links to
Windows Update Group Policy. Group Policy adds this entry to the
registry with a value of 1 when you enable the policy. If you disable
the policy or set it to Not configured, Group Policy deletes this
entry from the registry, and the system behaves as though the value is
0.
To change the value of this entry, use Group Policy. This entry
corresponds to the Disable and remove links to Windows Update Group
Policy (User Configuration\AdministrativeTemplates\Start Menu &
Taskbar).
HTH,
Mohammed.Athif Khaleel.
Post by MF
Steve,
I've run GPresult and it's not getting it from any GPO in AD or local
policies - I don't know where else it would get it from - there's no system
policies in place either. If you build a new machine from scratch and join it
to the domain, within an hour or so it also get the nowindowsupdate registry
entry.
Where else could it come from?
This has happened since we first migrated from NT4 - the first W2K machines
on the NW got this nowindowsupdate setting and it's never gone away.
I'm exasperated trying to find the source of this and think that maybe a
workaround would be to remove the registry entry with vb or wsh and a logon
script - is there anyway this can be done?
Thanks...
Mike
Post by Steve Seguis [MVP]
The best way to check if you have a policy being applied to that PC is by
running GPResults.exe from the windows 2000 resource kit to determine your
RSoP (Resultant Set of Policies). That should accurately inform you whether
or not this policy is being implemented via a policy.
--
Steve Seguis - MCSE, Microsoft MVP, SCJP
SCRIPTMATION
Automating the Enterprise
http://www.scriptmation.com
Post by Athif
I believe you have some policy for nowindowsupdate registry entry, check
it out!
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
You might have something which is conflicting/disabling with Automatic
Updates.
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
HTH,
Mohammed.Athif Khaleel.
Post by MF
Thanks for this. I've tried that but it only works on a per-profile
basis. If
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
someone else logs in on the same PC then they get a new nowindowsupdate
registry entry. I don't know where it gets it from - it doesn't appear
to be
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
in any default profile and it doesn't appear to get it from any GPO.
It's
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
driving me mad!!!!!
Thanks...
Mike
Post by nowindowsupdate
I'm trying to roll out sus in our W2K AD domain. it works, but only if
i
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUp
date.
Post by Athif
Post by MF
Post by nowindowsupdate
(1) AutoUpdates works if you set it to run from the MS site.
(2) Access is denied if you manually go the MS windowsupdate site and
scan
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
for updates unless you amend the same registry entry.
Issue (2) has been confounding me for some time and i can't work it
out. If
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
you change the setting from 1 to 0 it stays that way for half an hour
or so
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
then reverts back - even if you restart the machine it'll stay that
way for
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
about half an hour and then revert. There is no policy in AD that is
doing
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
this (I've run gpresult). So what is it?
I thought that because AutoUpdates run from the MS site OK then it
would run
Post by Athif
Post by MF
Post by Steve Seguis [MVP]
Post by Athif
Post by MF
Post by nowindowsupdate
from my SUS server - no such luck.
Any help very gratefully received.
Thanks...
Loading...