Group policy for automatic updates - Missing option

workaccount

We have windows update server working here and I want to set up the machines to access the server for automatic updates with group policys.

The group policy is WUAU.ADM. However when installed it only gives me three options. It does not give me an option to specify a server like most tutorials ive found on this say you should. Ive even got the latest one from the microsoft site but still no policy. Anyone know anything about this?

ressem

Not looking at the server, so going from memory:
Are you looking at the Windows Updates Policies held under the User Section, or the Domain computer section.

I think that you only get 3 options under the user section.
Under the domain computer section, you'll see about 8 options, including the one where you set the server address and port.

ressem

Under Group Policy/Computer Configuration/Administrative templates/Windows Component/Windows Update, you have the "Configure automatic updates" and "Specify Intranet Microsoft Update Service Location" and others.

I think that you are currently looking
under Group Policy/User Configuration/Administrative templates/Windows Component/Windows Update
where the only options given to you are
"Remove access to use...", "Do not Display...", "Do not adjust default..."

workaccount

Your right I was looking in the wrong section. I have now specified it correctly and applied the policy to every group in the company. Im just after setting up a new laptop here now though and when it searches for updates I get this in my log.

WSUS server: <NULL>
WSUS status server: <NULL>

I specifically have the correct settings applied in the group policy though and it works on other machines.

workaccount

I have it working now by configuring the group policy on the local machine. Doesn't this defeat the purpose though of using a group policy on the server?

WizZard

Don't forget to add the "http(s)://" in the server fields. It does not auto-apply them.

Also, did you force a gpupdate on the client?

workaccount

Yep had the http:// in. Turns out that I just had to apply the policy at the domain level rather than groups of users.

seamus

workaccount wrote:

Yep had the http:// in. Turns out that I just had to apply the policy at the domain level rather than groups of users.

(Someone correct me if I'm wrong).

When applying a group policy, a policy that only applies to a user will only load policy items under User Configuration, when they log in. That is, if you have a policy that is specifically applied to an OU that contains user objects, then any policies under Computer Configuration will be completely ignored.

Thus, in order for Computer Configuration policies to be applied, then the relevant computers must be a member of the OU to which the policy is applied (or an inheriting child container).

The reverse is also true: User Configuration policies aren't applied unless they apply to the user object.

Static M.e.

Some Group Policy stuff to remember

Windows 2000 Pro & Server

SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE: Immediately SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE: Immediate imposes group

Windows Xp & 2003 Server

Gpresult
Gpresult /v
Gpupdate /force

Note: When multiple policies specify the same option the last one applies takes precedence.

Group Policys are applied in this order.

Local Security Policy --> Site Policy --> Domain Policy