Win10 Updates - How to tell if an installed update came from WSUS or Windows Update

Question

Hello,

I'm needing help determining whether a feature update (20H2) was installed through WSUS & SCCM or Windows Update.

This morning my Win10 1909 Enterprise PC automatically received and installed 20H2 without any action on my part. I noticed an update indicator on the start menu> power button, so I obliged and restarted. I was quite surprised upon the next login to find that 20H2 had installed, since feature updates are blocked by policy.

I'm one of the SCCM admins for my employer, and having a hard time finding out where and why this update was applied to my PC. I'm trying to determine the scope of it. The feature update didn't appear in Software Center - Updates nor Operating Systems. Nobody within my group has schedule or deployed 20H2.

Recently installed updates shows this:
Feature Update to Windows 10 20H2 via Enablement Package (KB4562830) 5/18
Security Update for Microsoft Windows (KB5003173) 5/18
Servicing Stack 10.0.19041.985 5/18

I don't see Feature Update to Windows 10 20H2 via Enablement Package (KB4562830) in SCCM - All Software Updates.

The smsts.log file is still reflecting an old date.
C:\Windows\CCM\Logs - does show quite a bit of files that were modified around the time of the update, and I'm trying to sift through them all.

Any help is greatly appreciated!

Answer 1

I know this is an old thread, but I figured it out and wanted to share.

I had recently added my PC to a CoManagement collection in SCCM in preparation for piloting Intune. It turns out that one of the former engineers had already configured several update rings within Intune, and they were already applied to the group that I was added to. This caused my PC to download the MDM policies, and then began getting updates from Intune instead of WSUS.

Hopefully this helps someone else out, I wish I could have responded earlier but it seems as though I get pulled into fire after fire, and they're never straight forward.

Answer 2

Sounds like you have Dual Scan going on
https://www.ajtek.ca/wsus/dual-scan-making-sense-of-why-so-many-admins-have-issues/

Answer 3

To add to that, since 1909 is no longer in service (https://learn.microsoft.com/en-us/lifecycle/announcements/windows-10-1909-end-of-servicing), those who are checking Microsoft for updates (either Microsoft Update or in a dual scan scenario) would be receiving a supported version (20H2) upgrade.

Answer 4

Hi, @John
Thank you for posting in Microsoft Q&A forum.
You may check the registry key WUServer and WUStatusServer to see whether they have the the locations of the WSUS servers:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

And in Windowsupdate.log we also could see whether this computer use WSUS for updates.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

@AllenLiu-MSFT
Hi Allen, here are the values from the Windows Update registry settings.