Network workstations fail to communicate with WSUS.

Question

Guys, greetings to everyone.

I set up a WSUS and created a GPO correctly, so that network stations can get updates through it.
But the stations insist on getting updates on Windows Update on the internet, if I block this access on the firewall, they fail the updates, as if they can't connect to the update source, which is WSUS, but on the WSUS console, I see the stations and all the updates they've got.

Any idea how to solve this?
We need all stations to download updates only on WSUS, not on the internet.

Answer 1

Sounds like dual scan going on
https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/

Also, see:
https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/

as it has a bunch of troubleshooting steps under the client side script.

Answer 2

Hi IvanildoGalvo-8865,

Thanks for your posting on this forum.

Perhaps we could try to check the default AU Service as the below script. Open the PowerShell as an administrator and then post the below script on the clients:

$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager"   
   
$MUSM.Services | select Name, IsDefaultAUService   

Please share with us the result. We could try to apply the below policy on the clients to prevent the clients getting updates from the Internet if the default AU Service is not WSUS/SCCM.

Please apply the Do not allow update deferral policies to cause scans against Windows Update policy.
Reference picture:

Hope the above will be helpful. Please feel free to post on this forum if there are any confuse or questions.

Regards,
Rita

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.