Windows 10: GPO for Automatic Updates doesn't seem to be applying

Howdy,

I'm trying to create a GPO to point our Windows 10 machines to our WSUS server and then use Automatic Download and Install during a maintenance schedule.

• I've gone under Automatic Maintenance Activation Boundary and set that to 13:00 (1PM) for testing.
• I've gone under Maintenance Random Delay and set that to 1 hour

• I've gone under Config Automatic Updates and set it to 4 (download and install). I also set day to Saturday and time to 13:00 (1PM) but I don't know how this affects the Maintenance Boundary up above...
• I've gone under Specify Intranet Site and put in our WSUS server.

Anyway, I then ran a GPUpdate on my laptop which worked and gpresult says it applied the setting. However, when I go under All Settings | Update & security and then click Advance Options, it still shows "Never check for updates" which is what our normal GPO for everyone else uses. I put my machine in a sub-OU and assigned the test GPO to that sub folder. The main WSUS GPO is not Enforced and the test GPO is Enforced.

Should that dropdown change to reflect the current settings? Is there some other way to tell if the settings are applied correctly? I don't want to click "Check for Updates" because that usually checks and installs which is NOT what I want to do. I want to test the automatic install portion but can't tell if the right settings are in place or not.

I hope that all makes sense. Let me know if I can provide any other information.

Thanks!

:)

 

Windows 10 Group Policies - Newly created user GPOs do not apply

Hi all,

I'm after some help with a problem I've started to encounter. Windows AD domain (2012R2 DCs, but 2003 functional level), starting to provision Windows 10 (1703) clients. GPOs applied at container levels within the OU. As of about a week or so ago, any
group policy created to apply to a user object does not apply. GPO applying to Computer Objects apply instantly. If I create a GPO that solely contains a drive map (start simple), this doesn't apply, GPRESULT doesn't show it being denied or empty etc. Using
the GPMC results tool produces the same result as that on the physical workstation.

What seems odd is there were no problems a couple of weeks ago, I could create new User GPOs and they would apply, now it's like they don't exist. The corresponding GUID folder appears in the sysvol directory for the new GPO and permissions look as expected.
Sysvol and Netlogon UNC paths have been excluded from hardening, KB3163622 is not applied to any client. There is no WMI filtering applied, permissions appear fine (auth users, read and apply GPO).

I am aware there have been a lot of community posts from people experiencing problems with GPOs and Windows 10, but the problem I have seems another level, it doesn't even seem to be aware there should be a GPO applying. I'm at a bit of a loss where to
go next and would be hugely grateful for any advice that could be provided.

Best Regards,

Rob

 

How Can I Exclude Windows Printer Driver Updates?

Thanks for the reply.

I tried this option with "wushowhide.diagcab", but this did not even recognize that the updates even failed, so I cannot register it as something to hide. Also, this would be something that I cannot apply network wide with a GPO.

Seems like I'm fighting a losing battle.

I wish Microsoft would provide a GPO option to exclude driver updates by KB number or something. Seems simple to me in concept, but I'm sure its a lot more complicated.

Thanks!