> Cecils thanks for the quick reply. I'm thinking back to our previous
> configuration under WSUS 2.0 and I believe we had users locked out from
> accessing windows update there as well but the Prompt functionality
> worked.
> The end goal is prevent users from installing updates that our IT
> department
> has not tested and approved since everyone has admin rights on their
> machine.
>
>
> The 1st thing I will do tomorrow is upgrade to the RTM version hopefully
> this will give me the previous results we had under WSUS 2.0. Going
> forward
> though is it possible to still prevent users from accessing Windows Update
> via Group Policy in WSUS 3.0 and still have the reboot prompt
> functionality?
> ---------------------------------------------
> "Cecils(MSFT)" wrote:
>
>> Well first the Error in your log snippet shows that you are receiving
>> 80240025 for the Client UI (CltUI FATAL) this maps to
>> WU_E_USER_ACCESS_DISABLED
>> Group Policy settings prevented access to Windows Update.
>>
>> So somehow the User Configuration setting has been changed in your
>> Policy,
>> something WSUS does not do, to disallow all access to Windows Update
>> features (2007-06-13 13:11:02:860 1536 e60 AU Windows Update is disabled
>> by
>> policy for
>> > user).
>>
>> Second I notice that you are running the RC version of WSUS with the RTM
>> version of the client installed. I would recommend that you upgrade your
>> WSUS server to RTM.
>>
>>
>> --
>> Cecil [MSFT]
>> Deployment, WSUS
>> Microsoft
>>
>> This posting is provided "As Is" with no warranties, and confers no
>> rights.
>> Use of included script samples are subject to the terms specified at
>>
http://www.microsoft.com/info/cpyright.htm>>
>> "SJohnson_Aerosim" <SJohnsonAerosim[ at ]discussions.microsoft.com> wrote in
>> message news:734E5596-FEE0-4AB7-95D2-5698D8EE0D14[ at ]microsoft.com...
>> > Previously in WSUS 2.0 updates would be pushed out at noon, installed,
>> > and
>> > the users would be prompted with a box to either reboot now or reboot
>> > later.
>> > We upgraded to WSUS 3.0 and now users are not even given the option to
>> > reboot
>> > although none of the GPO settings were changed. When a client reports
>> > back
>> > to the WSUS server they all say pending reboot. I am copying my GPO
>> > settings
>> > here along snipets of a windowsupdate.log
>> >
>> > GPO Settings:
>> > WSUS Aerosim
>> > Data collected on: 6/13/2007 1:31:54 PM hide all
>> >
>> >
>> >
>> > Computer Configuration (Enabled)hide
>> > Administrative Templateshide
>> > Windows Components/Security Centerhide
>> > Policy Setting
>> > Turn on Security Center (Domain PCs only) Disabled
>> >
>> > Windows Components/Windows Updatehide
>> > Policy Setting
>> > Allow Automatic Updates immediate installation Enabled
>> > Allow non-administrators to receive update notifications Enabled
>> > Automatic Updates detection frequency Enabled
>> > Check for updates at the following
>> > interval (hours): 1
>> >
>> > Policy Setting
>> > Configure Automatic Updates Enabled
>> > Configure automatic updating: 4 - Auto download and schedule the
>> > install
>> > The following settings are only required
>> > and applicable if 4 is selected.
>> > Scheduled install day: 0 - Every day
>> > Scheduled install time: 12:00
>> >
>> > Policy Setting
>> > Delay Restart for scheduled installations Disabled
>> > Enable client-side targeting Enabled
>> > Target group name for this computer Aerosim
>> >
>> > Policy Setting
>> > Enabling Windows Update Power Management to automatically wake up the
>> > system
>> > to install scheduled updates Enabled
>> > No auto-restart for scheduled Automatic Updates installations Enabled
>> > Re-prompt for restart with scheduled installations Enabled
>> > Wait the following period before
>> > prompting again with a scheduled
>> > restart (minutes): 30
>> >
>> > Policy Setting
>> > Reschedule Automatic Updates scheduled installations Enabled
>> > Wait after system
>> > startup (minutes): 10
>> >
>> > Policy Setting
>> > Specify intranet Microsoft update service location Enabled
>> > Set the intranet update service for detecting updates:
>> >
http://aerosimdc01:80>> > Set the intranet statistics server:
http://aerosimdc01:80>> > (example:
http://IntranetUpd01)>> > -----------------------------------------------------------------------------------
>> > Windows Update Log after updates were pushed out today at Noon which
>> > should
>> > have required a reboot.
>> >
>> > *********** Setup: Checking whether self-update is required
>> > ***********
>> > 2007-06-13 13:11:01:610 1536 398 Setup * Inf file:
>> > C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\cdm.dll: target version = 7.0.6000.374, required
>> > version
>> > = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuapi.dll: target version = 7.0.6000.374, required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuauclt.exe: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuaueng.dll: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wucltui.dll: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.0.6000.374,
>> > required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wups.dll: target version = 7.0.6000.374, required
>> > version
>> > = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wups2.dll: target version = 7.0.6000.374, required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup Update NOT required for
>> > C:\WINDOWS\system32\wuweb.dll: target version = 7.0.6000.374, required
>> > version = 7.0.6000.318
>> > 2007-06-13 13:11:01:610 1536 398 Setup * IsUpdateRequired = No
>> > 2007-06-13 13:11:02:766 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:11:02:828 508 290 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:02:828 508 290 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:02:828 508 290 AUClnt Launched Client UI process
>> > 2007-06-13 13:11:02:860 1536 e60 AU Windows Update is disabled by
>> > policy
>> > for
>> > user
>> > 2007-06-13 13:11:02:891 508 290 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:02:891 508 290 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:02:891 508 290 Misc = Module:
>> > C:\WINDOWS\system32\wucltui.dll
>> > 2007-06-13 13:11:02:891 508 290 CltUI FATAL: Failed to get notification
>> > handle, hr=80240025
>> > 2007-06-13 13:11:03:094 1536 61c AU AU received handle event
>> > 2007-06-13 13:11:08:797 1536 398 PT +++++++++++ PT: Synchronizing
>> > server
>> > updates +++++++++++
>> > 2007-06-13 13:11:08:797 1536 398 PT + ServiceId =
>> > {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
>> >
http://aerosimdc01:80/ClientWebService/client.asmx>> > 2007-06-13 13:11:08:844 1536 398 PT WARNING: Cached cookie has expired
>> > or
>> > new PID is available
>> > 2007-06-13 13:11:08:844 1536 398 PT Initializing simple targeting
>> > cookie,
>> > clientId = 8e0a88d8-438e-4ef1-84d3-53c87a46763f, target group =
>> > Aerosim,
>> > DNS
>> > name = techsupport.aerosim.com
>> > 2007-06-13 13:11:08:844 1536 398 PT Server URL =
>> >
http://aerosimdc01:80/SimpleAuthWebService/SimpleAuth.asmx>> > 2007-06-13 13:11:14:610 1536 398 PT +++++++++++ PT: Synchronizing
>> > extended
>> > update info +++++++++++
>> > 2007-06-13 13:11:14:610 1536 398 PT + ServiceId =
>> > {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
>> >
http://aerosimdc01:80/ClientWebService/client.asmx>> > 2007-06-13 13:11:18:110 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:11:18:157 4560 1338 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:18:157 4560 1338 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:18:157 4560 1338 AUClnt Launched Client UI process
>> > 2007-06-13 13:11:18:188 1536 e60 AU Windows Update is disabled by
>> > policy
>> > for
>> > user
>> > 2007-06-13 13:11:18:203 4560 1338 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:18:219 4560 1338 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:18:219 4560 1338 Misc = Module:
>> > C:\WINDOWS\system32\wucltui.dll
>> > 2007-06-13 13:11:18:203 4560 1338 CltUI FATAL: Failed to get
>> > notification
>> > handle, hr=80240025
>> > 2007-06-13 13:11:18:375 1536 61c AU AU received handle event
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Added update
>> > {ABB18003-B0AF-4162-BD1D-180941734EBA}.101 to search result
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Added update
>> > {C4331884-02B2-4420-9960-3D74A48EEFE8}.101 to search result
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Added update
>> > {62111A48-92AF-4107-907C-156B3FC85428}.101 to search result
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Added update
>> > {CBDA4A10-D5D1-432D-9CFC-A699ED43E69F}.100 to search result
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Added update
>> > {E2E1C013-B99A-4683-921C-B99663F3F8ED}.103 to search result
>> > 2007-06-13 13:11:26:344 1536 398 Agent * Found 5 updates and 34
>> > categories
>> > in search; evaluated appl. rules of 594 out of 855 deployed entities
>> > 2007-06-13 13:11:26:469 1536 398 Agent *********
>> > 2007-06-13 13:11:26:469 1536 398 Agent ** END ** Agent: Finding
>> > updates
>> > [CallerId = AutomaticUpdates]
>> > 2007-06-13 13:11:26:469 1536 398 Agent *************
>> > 2007-06-13 13:11:26:469 1536 b90 AU >>## RESUMED ## AU: Search for
>> > updates
>> > [CallId = {73BF4D3D-3F52-4EBB-B8A2-F07EE1D4880B}]
>> > 2007-06-13 13:11:26:469 1536 b90 AU # 5 updates detected
>> > 2007-06-13 13:11:26:469 1536 b90 AU #########
>> > 2007-06-13 13:11:26:469 1536 b90 AU ## END ## AU: Search for updates
>> > [CallId = {73BF4D3D-3F52-4EBB-B8A2-F07EE1D4880B}]
>> > 2007-06-13 13:11:26:469 1536 b90 AU #############
>> > 2007-06-13 13:11:26:469 1536 b90 AU AU setting next detection timeout
>> > to
>> > 2007-06-13 19:08:26
>> > 2007-06-13 13:11:26:469 1536 b90 AU Setting AU scheduled install time
>> > to
>> > 2007-06-14 17:00:00
>> > 2007-06-13 13:11:31:453 1536 398 Report REPORT EVENT:
>> > {354F4D94-2EED-41C6-82C9-8CA49125A754} 2007-06-13
>> > 13:11:26:453-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
>> > AutomaticUpdates Success Software
>> > Synchronization Windows Update Client successfully detected 5 updates.
>> > 2007-06-13 13:11:31:453 1536 398 Report REPORT EVENT:
>> > {B1AA722C-9713-47EC-A2E4-AED53716B96B} 2007-06-13
>> > 13:11:26:469-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0
>> > AutomaticUpdates Success Pre-Deployment Check Reporting client status.
>> > 2007-06-13 13:11:33:375 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:11:33:438 900 3a4 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:33:438 900 3a4 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:33:438 900 3a4 AUClnt Launched Client UI process
>> > 2007-06-13 13:11:33:469 1536 3ec AU Windows Update is disabled by
>> > policy
>> > for
>> > user
>> > 2007-06-13 13:11:33:485 900 3a4 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:33:485 900 3a4 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:33:485 900 3a4 Misc = Module:
>> > C:\WINDOWS\system32\wucltui.dll
>> > 2007-06-13 13:11:33:485 900 3a4 CltUI FATAL: Failed to get notification
>> > handle, hr=80240025
>> > 2007-06-13 13:11:33:625 1536 61c AU AU received handle event
>> > 2007-06-13 13:11:48:625 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:11:48:704 3320 68c Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:48:704 3320 68c Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:48:704 3320 68c AUClnt Launched Client UI process
>> > 2007-06-13 13:11:48:719 1536 bac AU Windows Update is disabled by
>> > policy
>> > for
>> > user
>> > 2007-06-13 13:11:48:750 3320 68c Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:11:48:750 3320 68c Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:11:48:750 3320 68c Misc = Module:
>> > C:\WINDOWS\system32\wucltui.dll
>> > 2007-06-13 13:11:48:750 3320 68c CltUI FATAL: Failed to get
>> > notification
>> > handle, hr=80240025
>> > 2007-06-13 13:11:48:875 1536 61c AU AU received handle event
>> > 2007-06-13 13:12:03:876 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:12:03:969 1508 e4 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:12:03:969 1508 e4 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:12:03:969 1508 e4 AUClnt Launched Client UI process
>> > 2007-06-13 13:12:04:001 1536 bac AU Windows Update is disabled by
>> > policy
>> > for
>> > user
>> > 2007-06-13 13:12:04:032 1508 e4 Misc =========== Logging initialized
>> > (build: 7.0.6000.374, tz: -0500) ===========
>> > 2007-06-13 13:12:04:032 1508 e4 Misc = Process:
>> > C:\WINDOWS\system32\wuauclt.exe
>> > 2007-06-13 13:12:04:032 1508 e4 Misc = Module:
>> > C:\WINDOWS\system32\wucltui.dll
>> > 2007-06-13 13:12:04:032 1508 e4 CltUI FATAL: Failed to get notification
>> > handle, hr=80240025
>> > 2007-06-13 13:12:04:188 1536 61c AU AU received handle event
>> > 2007-06-13 13:12:19:188 1536 61c AU Launched new AU client for
>> > directive
>> > 'Reboot Pending', session id = 0x0
>> > 2007-06-13 13:12:19:251 3696 10bc Misc =========== Logging initialized