Wsus server not updating itself forensics age dating ink
The use of GPOs for managing self-updating is fully documented in this white paper from Tech Net.
The apparent abundance of information on the subject seemed to go unnoticed this week.
"To the contrary, people have told us that we should have been clearer on how Windows Update behaves when it updates itself.
This is helpful and important feedback, and we are now looking at the best way to clarify WU's behavior to customers so that they can more clearly understand how WU works.
These upgrades are important if we are to maintain the quality of the service." The discovery, which came as news to many, is that the Windows Update service (known internally as WSUS) updates itself through a separate channel, managed through Internet Information Services.
While turning off Automatic Updates makes certain Windows doesn't receive any general update downloads without the user's consent or knowledge, WSUS still checks for updates, including those meant for itself.
(Good connection.) Of course, as some have noted, if the event was clearly recorded in the logs..isn't exactly stealth.
If you check additional languages, you will need to go back to your internet connected WSUS server and re-download those versions of the files.
At the same time, however, we wanted to explain the rationale for the product's behavior so our customers know what the service is doing: WU updates itself to make sure it continues to work properly." Clinton went on to point out that the time in which WSUS updates itself is while the user is using Automatic Updates directly, whether it's set to automatic or manual. That fact does appear to be missing from documentation we've seen.
One prominent blogger yesterday, in presenting what he described as evidence of stealth updates, inadvertently proved Clinton's point.
It can then - and typically will - update itself anyway.
"It's surprising that these files can be changed without the user's knowledge," wrote Scott Dunn for Windows earlier this week.He showed screenshots of his event logs, which recorded WSUS updating itself.