Objective
To troubleshoot and resolve scenarios where Windows endpoints continue to receive automatic updates directly from Microsoft Windows Update despite automatic updates being disabled within Automox Group settings.
Problem / Symptoms
Endpoints assigned to an Automox group with native Windows automatic updates disabled continue to download or install updates automatically outside of scheduled Automox policy windows.
Root Cause
Automox configures local registry keys on managed Windows endpoints to suppress native Windows Update behavior. However, local or Active Directory Group Policy Objects (GPOs) take precedence over standard registry settings.
If an active GPO or local policy explicitly enables Windows Automatic Updates (or sets conflicting AUOptions), the operating system honors the GPO, effectively overriding the configuration defined in your Automox Group settings.
Troubleshooting & Resolution Steps
To identify and remove conflicting Group Policies on an impacted endpoint:
1.Inspect Applied Policies Using Resultant Set of Policy (RSOP):
On the impacted Windows endpoint, open the Run dialog (Win + R), type rsop.msc, and press Enter.
Review the policy tree under Computer Configuration > Administrative Templates > Windows Components > Windows Update to identify which GPO is explicitly enforcing automatic update settings.
2.Generate a GPRESULT HTML Diagnostics Report:
For a comprehensive view of all applied policies and filtering rules, open an administrative PowerShell or Command Prompt window and execute:
gpresult /h C:\Windows\Temp\GPOReport.htmlOpen C:\Windows\Temp\GPOReport.html in a web browser, navigate to the Windows Update policy section, and identify the Winning GPO overriding your local update settings.
3.Reconcile Conflicting Group Policies:
- In Active Directory: Modify or unassign the conflicting GPO in your Domain Controller's Group Policy Management Console (GPMC) so it no longer enforces Windows Automatic Update settings on Automox-managed endpoints.
-
In Local Group Policy: On standalone devices, open
gpedit.mscand set Configure Automatic Updates to Not Configured.
4.Refresh Policy & Re-evaluate Automox Group:
Force an immediate Group Policy update on the endpoint:
gpupdate /forceOnce the GPO is removed, Automox will successfully manage and enforce your desired Windows Update behavior according to your group settings.