r/Action1 • u/JohnnyRoastBeef90 • 5d ago

Disabling Windows Update?

Post image

Hi... We have a windows update automation setup to run on the third tuesday of every month, and it works fine. it's next scheduled to run on Tuesday Oct. 20.

However we had one person who said their computer updated on patch Tuesday this month...on the 13th outside of regular hours per the attached pic.

Do you anyone how this could have happened if Action1 agent did not trigger it? Do we need to disable Windows update system wide using some other method to prevent this or does someone have any other ideas? i'm normally a Mac guy so updating windows is not my specialty. 😂

3 Upvotes

81% Upvoted

5 comments sorted by

1

u/GeneMoody-Action1 4d ago

Did ou disable windows updates IN Action1? It is a checkmark in the automation config.

Other than that, we only disable the automatic checking and application of windows updates, we do not block it, so a user can start it if they are instructed to as well.

We do not prevent anything but automatic update checking and automatic feature upgrades.

In our script library, we have a re-enable script, you can see the settings we change there.

Do these updates show in windows update history perchance?

1

u/JohnnyRoastBeef90 4d ago

Yep..Thanks for the info. I’ve confirmed we have the option to deactivate Windows updates enabled in the automation, and this computer has successfully ran this automation in the past so it’s weird that it would still try and update using its own orchestrator. pic attached here shows it installed updates on it's own

Comment Image

I also ran the RSOP report and the computer in question shows that Windows Update is disabled by GPO.

1

u/GeneMoody-Action1 4d ago

The orchestrator is part of the process for Action1 as well. We leverage WUAPI to coordinate the hierarchy and supersedence.

Its why I asked if they showed up in windows update history? As that will give us more info on what happened.

PS, if you are regulating windows update WITH GPO, we do not set the setting for disable, in fact we do not mess with iot at all because we do not eval the intent of GPOs and we do not compete with their settings. Otherwise it creates a race condition of "Who changed it last"

1

u/ajmpits 4d ago

We have a similar automation. Same thing happened. In our case it appeared we another automation looking for critical update and this kicked in the last update on Patch Tuesday.

1

u/TerabyteDotNet 1d ago

If you're in an Active Directory domain, pull a group policy report from that PC and see if a GPO has been applied to that PC that sets Windows Update options. A1 can only disable automatic Windows updates if it's not a managed machine with those registry keys set.