Comments on: Windows Update in MDT 2010

By: tmintner

tmintner — Mon, 28 Dec 2009 18:30:00 +0000

Hi Eric,

There isn’t a way to select only critical updates but you can use the exclude variables in the customsettings.ini to exclude certain driver packages that are causing problems. You might also consider implementing a WSUS server. By implementing WSUS, you can specifically control what updates are approved and the script will only download and install the approved updates.

By: Eric

Eric — Wed, 23 Dec 2009 16:09:44 +0000

First I’d like to say thank you for creting this script. It’s been working very well for me. I was wondering if there is a way to only have critical patches identified? I’ve been having problems with windows updates updating drivers with less than desirable ones. Having the script only pull down critical patches would be greately appreciated.

Again, thank you for all your work on this. It’s a very good script.

By: Brian Larsen

Brian Larsen — Mon, 23 Nov 2009 09:45:21 +0000

Hi Keithga

But “NoAutoUpdate_Previous” is set to blank the first time the script runs, because the regkey (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate) doesn’t exists the first time. The second time the script runs, after a reboot, the “NoAutoUpdate_Previous” equals “” in line 484 is still true, but then get set to the value of 1, because line 493 creates the regkey the first time the script runs and set the value of “NoAutoUpdate” to 1.

I can send you a logfile if you want to?

Regards Brian

By: keithga

keithga — Fri, 20 Nov 2009 22:03:13 +0000

I just did a quick scan of the code, and I think it should be working properly. After the reboot “NOAutoUpdate_Previous” should be set to , not blank so the code at lines 485-890 shouldn’t overwrite it.
Later after the scan has completed, the NoAUtoUpdate will be restored to the value from NoAutoUPdate_Previous.

By: Brian Larsen

Brian Larsen — Fri, 20 Nov 2009 14:54:54 +0000

Hi Keithga

Maybe you can help me out here. I think there is a problem with your ZTIWindowsUpdate.wsf script concerning the variable “NoAutoUpdate_Previous”.
The problem occurs when the computer needs to do a restart. The second time around the script test to see if “NoAutoUpdate_Previous” equals “”, it is still true (but in the registry “NoAutoUpdate” is really 1 because the script has already run once). So the second time the script runs, the variable “NoAutoUpdate_Previous” is set to 1. That means when there are no more updates left and the script has finished, it will always set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate to 1, no matter what it was before the script started. (Line 313 is true, and then uses the value in “NoAutoUpdate_Previous” to write to registry).
This means that you can’t enable “windows update” when deployment is done trough the user interface.
So if the computer needs to reboot, you need to make sure that the value in “NoAutoUpdate_Previous” corresponds to the first time the script runs, and not the last time the script runs.

Pleas correct me if I am wrong.

Kind Regards
Brian