Win 7 Devices getting updates not approved in WSUS

[nevets2001uk]

We have a WSUS server setup locally where all devices are directed for Critical updates. This is set via GPO. Recently we noticed that the Win 7 devices we checked were also getting many smaller Windows, Office, .NET updates and security updates (found by reviewing the installed updates list). However when we checked in WSUS most of these were not approved, yet showing as installed.

We reviewed the Windows Update Log and while I'm no expert it didn't appear that these extra updates were being logged. I checked a given date were we had had over 20 installs and the log showed none have been found as required and appeared to be correctly checking with WSUS.

Therefore we're now stumped as to how these are being applied. It's as if the clients are also checking and downloading from MS but I would have expected to see this in the Windows Update log.

Has anyone else seen similar or can suggest how we find out where these are coming from and prevent it? We only want the approved WSUS updates to be applied. End users report that this is installing in the normal manor via Windows Update.

Steve G (MCSE / MCSA:Messaging)

 

[goombawaho]

Have you checked the client windows 7 registry settings that govern WHERE the WSUS server is??
Look at the "update storage" area as well as everything else.

http://technet.microsoft.com/en-us/library/cc708545(v=ws.10).aspx

 

[nevets2001uk]

Thanks for the reply. However that link and it's registry entries appeared to relate to the server not the client registry settings. On the client I have checked the registry also and see for WUServer it is set with our internal WSUS server as is the WUStatusServer setting. I can confirm that the clients are indeed reporting to the server. It's the additional minor updates which are the mystery.

Steve G (MCSE / MCSA:Messaging)

 

[goombawaho]

Sure it was. My mistake. Here they are.

http://support.microsoft.com/kb/328010#method3