https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# _general
s
This message was deleted.
p
🍿 I've been bumping hard into weird windows update related issues since upgrading to 21H2. So following this thread.
n
Man, I don't want to hear that, haha
I'm on 20H2, FWIW.
k
Did you disable the Windows Update service?
n
Yep, disabled in my image, and via GPO.
I don't disable that helper service, though...
p
We are on 1809 LTSC. 21H2 LTSC i'm still testing / tweaking. Been using applayer to bake images since it became a Citrix product. 21H2 issues started pretty much immediately with the damn citrix hypervisor drivers automatically updating themselves. Never had that with 1809, and then yes despite setting windows update to be disabled in the layer its enabled in the finished image. Still trying to identify where this is occurring.
n
Windows Update Medic Service, I mean
k
This "fixes" your disabled service:
😡 1
Either delete it or disable it
Gotta love MS 😄
n
For XS drivers, we disable autoupdate:
Copy code
$var_Install_Exec = "msiexec.exe"
$var_Install_Arg = "/i ""managementagentx64.msi"" ALLOWDRIVERSINSTALL=YES ALLOWAUTOUPDATE=NO ALLOWDRIVERUPDATE=NO /quiet /norestart"

$proc = Start-Process -FilePath $var_Install_Exec -ArgumentList $var_Install_Arg -WorkingDirectory $PSScriptRoot -Wait -PassThru

New-ItemProperty "HKLM:\SOFTWARE\Citrix\XenTools\" -Name "DisableAutoUpdate" -Value 0x1 -PropertyType "DWORD" -Force
👍 2
So another scheduled task? Those idiots.
👍 1
p
this was quite the productive thread. We don't enable hypervisor updates from the installer GUI but i'm going to look at the reg settings.
k
I've put it in a Citrix Optimizer template
the disabling of that service
not service task
n
Hmm, if I manually run sc start wuauserv, it fails because it's disabled.
Wait, disabling of what service? The Medic service?
k
No no, forget about me mentioning a service 😄
Hmm...so they changed the schedule task then
let me test that
n
I see that scheduled task in my image, but all it does is run sc
k
Same here
p
@Nick Panaccio there is a magic way to make it start. We tend to run the windows update mini tool to update our layers and it thows up an option to start the service if its disabled. Not sure what magic it runs, but the service does indeed start.
n
wtf, updating my OS layer now, and running the hide windows update utility and I see two new XS drivers. Never had this happen before.
😁 1
@Paul Brown: So the Medic service starts it?
p
no idea. I don't think so since i've seen that behavior prior to medic being a thing.
n
Or do you mean that scheduled task that Kasper wriote?
Ah, okay
I've found other things in the past that started Windows Update, but it's damn near impossible to figure out new ones.
p
I'm specifically talking about this tool. https://win10.guru/toolkit-item-windows-update-minitool-wumt/
It will start a 'set to disabled' windows update service.
k
Hmm..it must have been another scheduled task then, I see the same as you @Nick Panaccio Putting it on my very long list to test
n
If you find it, let me know. I'm going to disable that Medic service now, too, just to be safge.
👍 1
BTW, that show/hide Microsoft utility I mentioned, I use that to block Feature Updates when I update my image, and now XS drivers, I guess: https://www.majorgeeks.com/files/details/wushowhide.html
👍 1
r
For me disabling windows update has never workied in windows 10. I just use local group policy to disbale automatic updates.
n
If the link doesn't work, I can share on my Google Drive.
Local GPO actually works?
Man, that'd be a pain, having to reverse it every time you wanted to patch your image.
@Paul Brown: On the XS drivers thing, give that utility I mentioned a try. I run it before installing Windows Updates in my OS layer, and have done so for years. Works brilliantly.
d
I always disabled the TiWorker via registry, then even if the WU service was active it wouldn't perform anything
n
@Kasper Johansen: Do you disable the Update Orchestrator Service (UsoSvc)?
r
You dont have to reverse it you can always just run update its just disabling automatic updates
So this one
n
I'll give that a shot.
Funny, you can't disable the Medic service. Get an access denied message when I attempt to save the changes.
p
If they allowed that they would then need another service to ensure the service that ensures windows update is OK is OK... 😀
n
Don't give them any ideas...
This is the first time I've seen a sealed image attempt to download an update. What's weird is that I originally built an OS layer that had this patch installed - the bad one from early January. Well, I removed that OS version and built a new version that did not include that patch. Almost wonder if something stuck somehow.
I get to rebuild my Platform layer for like the 4th time in the last 30 days now, which is always fun.
(not an issue with App Layering... just changes)
k
@Nick Panaccio No, I do not disable that service
n
Figured as much. Gonna roll with this and see if letting a VM sit for more than 24 causes Windows Update to run.
r
@Nick Panaccio maybe you need to script it so its easier
n
I could script the policy setting, but it's already in my OS layer version, so it doesn't really matter now.
used a local GPO
...unless you're telling me I shouldn't have gone that route, in which case tell me now...
p
If you're not in charge of the corp group policy be aware that local polices can be disabled by cyber security.... ask me how i know.
n
Thankfully, I have full control over the policies applied to my VDAs.
😢 1
d
This is what I used for my images while sealing them off, updates will not run anymore: TiWorker [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance] "MaintenanceDisabled"=dword:00000001 Windows Update [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] "NoAutoUpdate"=dword:00000001
p
i think both those are in the Citrix optimizer.
n
Yeah, I have both of those in my Citrix Optimizer template already, running in my Platform Layer.
I think my issue is a one-off, but won't be able to confirm until next week.
p
@Nick Panaccio I 100% saw what you saw, with WU reanimating itself, hence my popcorn comment. I am in the process of redoing, starting with the new OS layer (1809 -> 21H2) to see if i somehow missed a step. But we run the optimizer and a reseal script that does pretty much all that has been discussed so far. Exceptions being the reg settings for the hypervisor tools, and that new scheduled task., which i will be including by starting again.....
n
Yeah, I hope that isn't a new behavior with 21H1, because I'll be moving to that once we go to the next major LTSR.
n
i had that issue with WU always coming back to life, i ended up just creating a gpo entry pointing it to a bogus dns entry. problem solved.
n
That's my last ditch effort, if it comes to it. I wonder if you can App Locker that shit, haha.
n
i spoke with martin zureg(?) from citrix at a local meeting about this, i live in FTL not far from citrix hq and he agreed it was a point of contention with MS and for them to change the optimizer to rip it out, it had to be blessed by MS and that was going to be very difficult for this piece
n
@Martin Zugec has abandoned us… ;)
n
yea he left a while ago.
n
I just can't believe there isn't a better way to disable it in W10 Enterprise. Home/Pro? Fine, leave it as is. Give us a better option in Enterprise.
n
yea i run 1809 ltsc pooled desktops, i fought like hell with that thing, and that's where i came up with just dns black hole-ing it. works well honestly.
m
I heard from colleagues who hiding Windows Update via AppMasking. Maybe worth a try.
k
Hiding how? Hiding the service?
m
Hiding: HKLM\SYSTEM\CurrentControlSet\Services\wuauserv HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc
👍 1
n
Found a few more of these in my latest image. All of the VMs show as failed in Director, and all attempted to install a WU: Installation Failure: Windows failed to install the following update with error 0x8024001E: Security Update for Windows (KB5010342).
@Markus Zehnle: Using those FSL hiding rules has been 100% successful for you in preventing Windows Updates from running?
r
Nick so you are getting that even though you disabled automatic updates via gpo?
n
Yes, and not on all VMs, just random ones. Today, about 30-40 out of hundreds.
I have them disabled via local GPO, enforced via domain GPO, WU service disabled in my image, etc
Never had a problem until I started this thread.
I don't see any scheduled tasks that ran right before the WU service changed from Disabled to manual. and then updated, so I don't know if it's a task doing any of this.
Seeing this in my latest image, too, in QA.
Hoping that Markus jumps back on, because I've got some questions on that hiding rule. Like, should that apply to everyone, including System, admins, etc. My guess is yes.
And this image in QA is the one where I configured that setting locally based on your previous comment.
Also wondering if I should now be disabling the Update Orchestrator service via policy.
I think I'm going to try and remove the recovery options for all 3 services in my image, and set the services to disabled.
via the registry
Anyone ever use this policy to get around Windows Update randomly running on your images? Setting both locations to 127.0.0.1
o
Similar but I switched the windows update to guest account login and no password so it can't start and that medic service to disabled (one that fixes the windows update service if you change it) and then it won't start up ever. Just part of sealing process
n
I'm torn on which route to go. I hate having to do this hacky shit with services, and am actually leaning towards using that policy listed above, since my initial testing showed that Windows Update failed to connect when pointed to loopback.
FWIW, the enabling and configuring aforementioned policy along with enabling Do not connect to any Windows Update Internet locations appears to have resolved my issue. Started with one site on Friday, and on Monday had zero failures in that site, while the unchanged site had 34 busted VMs and sessions. Made the change in all of Prod and today, 0 issues.
Open in Slack
PreviousNext
Powered by