switch of workload to intune for some device, issue with a registry key "UseWUServer"

Question

switch of workload to intune for some device, issue with a registry key "UseWUServer"

Brice Vanderstraeten 110

I'm busy preparing the switch of workload from SSCM to intune

I've managed to switch successfully all of the workload to intune but I have a small issue with a value constantly overwritten by the GPO.

Update through windows update are setup for that device collection but in only work if I manually update the following registry key

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

and put the value "UseWUServer" to "0".

After each restart, this value is reverted to "1" and therefore blocked to use windows update.

I've tried to overwritte with an OMA-Uri but it was unsuccessfull (not even sure it has work to overwritte)

Is there a setting in intune that i'm missing? I've a setting turn on for the "MDM wins over GPO" in intune but with no luck. The request from my team is to not alter any existing GPO or modify the AD structure, so I have to found a way to overwritte in intune only. Any idea?

Rahul Jindal 11,511 Reputation points

2023-07-28T05:57:42.9766667+00:00

MDMwinsoverGPO doesn’t support all WU CSPs. The recommended way is to alter GPO. If you cannot do this then you can create a deployment in ConfigMgr to alter the registry frequently. Not elegant, but does the job. Fyi, if all your devices were being managed by ConfigMgr SUP, then you should allow ConfigMgr to take care of the Windows updates settings instead of using GPO.
Brice Vanderstraeten 110 Reputation points

2023-07-28T06:07:40.2666667+00:00

Zut, I was able to overwrite everything, exept that value. Our teams manage the update for windows via SSCM and have done some hack to prevent any use of windows update but now it backfire as they complain of to much work for updating windows, therefore I try to offload everything to windows update instead withoutusing/altering SSCM. I will still try with other stuff to alter my registry setting then, unless they accept those modification.

1 answer

Your answer

Rahul Jindal 11,511 Reputation points

2023-07-28T05:57:42.9766667+00:00

MDMwinsoverGPO doesn’t support all WU CSPs. The recommended way is to alter GPO. If you cannot do this then you can create a deployment in ConfigMgr to alter the registry frequently. Not elegant, but does the job. Fyi, if all your devices were being managed by ConfigMgr SUP, then you should allow ConfigMgr to take care of the Windows updates settings instead of using GPO.
Brice Vanderstraeten 110 Reputation points

2023-07-28T06:07:40.2666667+00:00

Zut, I was able to overwrite everything, exept that value. Our teams manage the update for windows via SSCM and have done some hack to prevent any use of windows update but now it backfire as they complain of to much work for updating windows, therefore I try to offload everything to windows update instead withoutusing/altering SSCM. I will still try with other stuff to alter my registry setting then, unless they accept those modification.

Answer 1

Crystal-MSFT 54,201 Microsoft External Staff

@Brice Vanderstraeten, Thanks for posting in Q&A. For our issue, I suggest firstly go to the Windows 10 device, go to Settings -> Updates and Security -> Windows Update -> Advanced Options. Click View configured update policies, then verify that the policy type to see if "Enable Automatic Updates" is managed by GPO or MDM.

User's image

https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-troubleshooting-windows-10-update-ring-policies/ba-p/714046

If it is managed by GPO, check the GPO applied to this device and remove the policy. If it is controlled by MDM. Go to Intune portal find the device and check the device configuration policy and windows update ring policies applied to this device to see if any policy block this.

User's image

Please try the above suggestion and if there's any update, feel free to let us know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Brice Vanderstraeten 110 Reputation points

2023-07-28T09:46:27.7933333+00:00

Already set to MDM for the autoupdate. Ring are OK, it's juste the registry key that didn't seems to have an equivalent in the configuration policy that kick in. I have a "no-go" to modify existing GPO, I need to find a way to overtook it via intune only.
Crystal-MSFT 54,201 Reputation points Microsoft External Staff

2023-07-31T05:09:56.0133333+00:00

@Brice Vanderstraeten, Thanks for the reply. From your description, I know the "Enable Automatic Updates" type shows as Mobile Device Management. Please check if any configuration policy or PowerShell script related this change the setting.

Meanwhile, please open cmd and run as administrator, run command similar as gpresult /h c:\gpo.html to see if any windows update setting set.
Brice Vanderstraeten 110 Reputation points

2023-07-31T06:47:57.05+00:00

Only thing that stay is the update server address for WSUS via GPO. Can't overwritte those value with something empty apparently. The fact to have those value completed seems to automatically switch the value to "useswsusserver" to active...
Crystal-MSFT 54,201 Reputation points Microsoft External Staff

2023-07-31T07:29:36.26+00:00

@Brice Vanderstraeten, Thanks for the reply. For your situation, you can find the GPO name and unlink the policy from the user and device to remove the policy applying.
Brice Vanderstraeten 110 Reputation points

2023-07-31T07:46:47.2566667+00:00

i can't unlink the GPO... The company doesn't want we alter anything in the GPO and they want to only goes to intune if I can proove we can manage all the update and everything smoothly with intune. I really need to find a way to overwritte everything from GPO via intune mean only.
Crystal-MSFT 54,201 Reputation points Microsoft External Staff

2023-08-01T02:01:23.5133333+00:00

@Brice Vanderstraeten, Thanks for the reply. The only configuration I can think is MDMWinsOverGP. it controls MDM policy that's set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC. But after checking, I find this does not apply to Update Policy CSP for managing Windows Updates. So I am afraid you still need to persuade your company to exclude the GPO from this device.

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict
Riadh BOULARES 5 Reputation points

2023-10-12T22:02:56.6633333+00:00

Hello Brice Vanderstraeten,

Do you have any news ?

Share via

switch of workload to intune for some device, issue with a registry key "UseWUServer"

1 answer

Your answer