How do I disable WSUS for a single server?

Question

Scenario:

• A few Windows 2003 servers, part of our corporate network
• Corporate IT has set up a WSUS server.
• But it seems Corporate IT is unable to operate the WSUS server properly. On "my" servers, I get 'unable to download updates'-messages in the event log regularly. And no patches are downloaded/installed to the servers.
• I have admin access to the servers, since there are a few things I support myself for our branch office.

Question:

• I want to disable my servers usage of the corporate WSUS server. I would like to configure it the "normal" way - use Microsoft's windows update.
• How and where do I change this setting? I have no idea how corporate IT has configured the servers in the first place - maybe using group policy?

Solution 1

If it is set using a Group Policy, you probably cannot override the setting (that's the whole point of Group Policies), but you should be able to visit the Windows Update website and still download updates yourself, you just won't get the prompts and reminders of new updates.

You really should open a ticket with your Corporate IT department and work with them to resolve the issue. Likely there is something not configured properly between your server and their WSUS server.

Solution 2

For temporarily disabling it you can do this:

Rename or delete:

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

Restart the wsus client

net stop wuauserv
net start wuauserv

Solution 3

I just had someone do this for me. Uber easy. Just go into the roles portion of your server manager and select WSUS as a role to remove. And it ought to get rid of the app and also any updates that have been grabbed by WSUS.

I was lucky that my updates had not installed for some reason so there was no need to dump the op and re-install. But be careful what you do...

Comments

[Dayton Brown]

+1 on both points. Although I have a feeling that the second point is probably a non-starter.

[ThatGraemeGuy]

Methinks if he had the ability to create OUs and GPOs, this question would not have made it this far. And no, you cannot override Group Policy using Local Policy settings. Policies are applied in the following order, with each subsequent conflicting setting overriding the previous: Local Policy, Group Policies linked to AD Site, Group Policies linked to the domain, Group Policies linked to OU/s.

[ThatGraemeGuy]

You may be blocked from using the Windows Update site too, if IT have enabled the relevant Group Policy settings.

[Daniel Lucas]

Well he did say, "maybe using group policy?" indicating that he might have access to actually change group policy. Your're right about the local sec policy, though. My LSDOU was UODSL for a moment. ;)

[Daniel Lucas]

Agreed. Much better than my misinformation below. :O +1

[codeape]

For now, I will use the Windows Update website - that seems like the simplest option. Luckily, it was not blocked.

[codeape]

@Graeme Donaldson: Great comment. I was not aware of how policy ordering works.