Friday, May 24, 2013

Change the settings for Automatic Updates

Microsoft did a wonderful service for "regular people" to get their operating system updated with very little fuss.  The original Windows Update web site, with a shortcut icon on the Start menu was great.  Over the years it grew ...

What it grew into was ... up for debate.  But that's not why I'm here.

Today, we who administer computers would like to change how these things go so that a proper schedule for patches is maintained.  We want to ensure that only the ones that are really necessary are installed, and the machine isn't going to be adversely affected by the patch.

Well, Microsoft addressed that, too, didn't they?  YES! SUS (Software Update Services) was born!  For FREE!  (Oh, wait, sorry - no additional charge.)  Then it was killed.  No, it was REborn!  Windows Update Server!  (What a wuss.) 

So today we have WSUS - Windows Server Update Services - now in it's 3rd iteration (3.0).  Depending on who you talk to it's still wussy or maybe it's double-you-suss, or wi-suss, or just PITA.  (But only if you've administered it for more than 30 minutes or so.)  Don't get me wrong: a great product. It really is; I wouldn't want to be a system administrator without it.

oh wait.  Yeah, I might want something that actually admits that I use software from someone other than Microsoft. Or maybe one that will work outside an Active Directory.

So, MAX brought in one of GFI's other products, GFI LanGuard.  GFI LanGuard does patch management for not only Microsoft products, but a whole array of other products as well.

So why not turn off the Automatic Updates settings on each independent Windows computer and let Patch Management take care of it? Sure.  It's Windows, right?  So --- I can script that.

GFI recently launched a script-submission problem/fix site called Fix-it scripts (  So I've uploaded a VBScript based solution there to go along with another publisher's PowerShell-based script.

The PowerShell script was the inspiration, the VBScript allows you to change the Automatic Update Settings between the options by passing one of these values at the command-line.
1 = "Never check for updates"
2 = "Check for updates but let me choose whether to download and install them"
3 = "Download updates but let me choose whether to install them"
4 = "Install updates automatically"
I've tested this in my own environment on a Windows 2008 server and it works.  I'll be working with it on Windows 7, Vista, XP, 2003, and WHS shortly. Of course - your environment may well be different.  So I cannot and will not guarantee how it will work there.  To twist an age-old saying, test it twice, deploy it once.

... good luck!


  1. So are you saying that Windows Updates could be set to "Never Check for Updates" and you would still be able to control/install updates with MAX? It would be great to have an article detailing how MAX and Windows Updates work together or interact with each other. For example should WU be set to On or OFF? What happens if they are both on with a different install schedules?

    1. That's exactly what we're saying, Mr. Anonymous. (you have a very common name, by the way) I tested it and use it with success in all the environments I mention above, as well. (Unknown success on Win8.)

      The script is a necessity at this time because the SERVICE needs to continue to run for some patches to install from MS.

      The two systems can work side-by-side, but it depends on how much detail you want/need when leaving both running. Overlaps on timing have resulted in different lists for instance. WU popups would result (if not turning "off" as above) even during MAX Patch Management installation. Things like that. If you don't cut out the "noise" between the two you just end up with one more variable in your headache-equation.

      We'll look into a deeper look into an article about the PM-WU relationship as well. Thanks for the suggestion.

    2. I would, also, like to know more about the PM-WU relationship, in addition to some example/suggested use cases that would include both being enabled, or just one enabled, along with any caveats or pros and cons of each possible configuration. We currently leave WU enabled, and use PM as a WU fallback, and for 3rd party patches. --Anonymous (but not the OP)