This message was deleted.

Microsoft does have the ability to override custom configurations. Not really what I focus on but my patch management peers have seen this behavior.

ya we're a bit stumped....wsus shows the machine is checked in (we even deleted it from wsus, cleared the software distribution folder locally on the client, reregistered it and using the get-wulist command (or just use windows update gui) kB5005033 keeps coming in as an update even though we have it unapproved in wsus (and of course it fails whenever we try to install it anyways

I may be way off base on this, but somewhere in the back of my head this sounds like what I was seeing when I first deployed WSUS about a year ago and I had to enable some policies for Windows Update for Business that stopped it. This is what I have set for servers and workstations: Not sure how that's going to display...servers have 2 policies, workstations just the one. I do allow manual updates from Microsoft as well if needed, but this seemed to stop them from getting random updates from MS when they shouldn't.

i think i did have something similar on my desktop setup but if you have a wsus server setup shouldn't it use approved updates from there as its guide? we also had a similar issue recently where we had 1909 on all desktops and do not have 2004 approved but desktops started getting i pushed so now we had to scramble to get 20h2 out since 2004 is end of life in december so clearly something is off

I agree with the sentiment, but I remember that not having them set, my systems were going out and getting some updates that I didn't want from MS anyway and I couldn't figure out why. I'm sure I found something, somewhere, that told me to set these policies to stop that from happening. This goes against what the post says though, so I completely off base on it.

If you run the following, does it show WSUS as true for managed and default? (New-Object -ComObject "Microsoft.Update.ServiceManager").Services | Select Name, IsManaged, IsDefaultAUService

i ran that on mine which has all of those dual scan type policies removed now

Looping back to this thread...My workstation updated itself last night and I'm not sure why. Patch is not approved through WSUS, which I administer, so I would know if it were. I have not changed any settings for a while now. I do have it set to Allow connection to Windows Update Internet Locations for "on-demand" patching outside of WSUS, but also have it set "Do not connect to any Windows Update Internet locations" which should prevent it from reaching out during scheduled scans. These settings have been working for months without any issues until last night.

i cant say for sure but at least the delay feature level deferal period MIGHT be one of those weird settings that i was told if you set that policy you automatically fall into that "dual scan" scenario and MS could try and push things from outside WSUS as well (thats what bit us a few months back and we started to see the 2004 feature update come down when we denied that in WSUS. Same thing for us having that deferal setting on for a while was fine until we hit some 365 day deadline i think. we stripped ours down pretty clean now to basically point to our WSUS server, install days/time, UseWSUSServer (forget the exact wording). and its been working well now. i could snapshot what we set if it helps to share

I had read the two linked articles below when I set up WSUS, but I must have misunderstood part of it at the time. It's pretty clear that disabling Dual-Scan is pretty easy by not having the policies configured. Looks like I will be changing my update policies now. 🙂 https://docs.microsoft.com/en-us/archive/blogs/wsus/demystifying-dual-scan https://docs.microsoft.com/en-us/archive/blogs/wsus/improving-dual-scan-on-1607 Thanks for the feedback.

no problem! good luck!

I have my defender updates Auto-Approved in WSUS, but we don't really rely on Defender any longer. For the most part we have removed it from the environment and use 3rd party AV. There may also be a setting in Group Policy to allow updates that do not force a restart to apply immediately that I set for Defender (just going from memory though, so not 100% sure it is needed or not).