Windows 10: Client systems are not checking for updates after setting the GPO from Windows Server 2016

Hi,


I'm struggling to figure out why my wsus clients aren't reporting in on a regular basis. They seem to only report in if I execute a manual check for updates on the device itself. I have the following GPO set, I'm not sure what else I'm missing.


Computer Configuration/Policies/Administrative Templates/Windows Components/Windows updates/Policy


- Automatic Updates detection frequency --> 22hours

- Configure Automatic Updates --> 3 - Auto download and notify for install

- Specify intranet Microsoft update service location

- Set the intranet update service for detecting updates (http://[internalwsus]:8530)

- Set the intranet statistics server (http://[internalwsus]:8530)


I know my intranet settings are valid since the servers to register initially but for whatever reason none of them check within the 22 hour interval. I've left some devices go for several days with no update so I don't think it's a matter of me not letting WSUS do it's thing....


Client: Windows 10

WSUS Server: Windows 2016


Any advice would be appreciated!


***Original title: WSUS clients not reporting in***

:)

 

Windows server 2012R2 GPO failed to apply on windows 10 creators update clients

I have a PDC windows server 2012R2 and BDC 2012R2, GPO is configured in BDC.

I have the below GPO's configured.

->By default, my company intranet page is the default page in internet explorer.

->Lock screen

These are not getting applied on the windows 10 clients where as the remaining clients like windows 7, windows 8.1 are able get these GPO settings.

GPResult command shows that the settings are applied but actually they are not.

Please suggest.

Thanks in advance

***Post moved by the moderator to the appropriate forum category.***

 

Memory leak in Windows kernel with GPO setting "Audit System Integrity" set to "Success and Failure" (Windows 2016 Server and Windows 10)

Hello to all

I have detected a memory leak in Windows kernel

Environment:

2016 Server (2016 DataCenter edition) acting as a domain controller

Windows 10 workstations (Windows 10 Enterprise 2016 LTSB) and

2016 Servers (2016 DataCenter editions) in other roles, such as terminal servers.

Occurs on:

Both Windows 2016 Servers and Windows 10 Workstations

Most likely the problem also occurs on lighter editions of Windows OS.

The culprit, security-hardening GPO setting, set into the domain controller:

"Advanced Audit Policy Configuration"

"System"

"Audit System Integrity"

"Success and Failure"

For example, Microsoft's recommendation

"SCM Windows Server 2016 - Member Server Baseline - Computer (20180219)"

sets this GPO setting

Symptoms:

Any application that is started leaks 5-20 kB memory on the kernel side.

Servers and workstations run out of memory after 1-2 weeks, depending on the operating conditions.

The Taskmanager does not show any application using huge amounts of memory,

just that the total amount of available memory gets lower and lower.

It does not seem to matter if the application is 32-bit or 64-bit.



Steps to verify:

1) Install poolmon from the Windows Driver toolKit (WDK) into the target machine

2) You can use any test application or create a test .cmd file containing

@echo off

:loop

cmd /c "echo foo"

timeout /t 1

goto loop

3) Set the GPO setting so that it applies in the target machine,

preferably in a domain environment and by using "gpupdate /force"

4) Start poolmon from the command prompt using the following command-line

poolmon -b -iToke

5) Start the .cmd file created in step 2 from the command prompt

6) Watch the amount of kernel memory used by driver tag "Toke" to get ever higher, about 5-10 kB every screen update

Eventually this eats up all available memory.

7) After a while, set the GPO setting from "Success and Failure" to "Failure" only.

Use "gpupdate /force" if needed. The memory counters reported by poolmon should stabilize shortly.

After a while, the memory counters of the driver tag should remain somewhat constant instead of growing all the time.

Notes:

Some other driver tags also show ever growing memory counters such as "SeAt" tag,

but the "Toke" tag had the highest counter values.

This was tested originally on virtual machines.

I'd like to have this problem corrected on the kernel side.

// U

 

Windows server 2012R2 GPO failed to apply on windows 10 creators update clients

Just a note... GPO settings for Internet Explorer are separate from the setting for Microsoft Edge.