Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?
-
I found this setting, which is applicable to at least Win 10 and Server 2016
However, it restricts admins from performing updates.
-
With the above setting enabled, not even admins can run checks for updates.
-
@wrx7m : The "not available to administrators" is an easy fix with GPO, but does this latter policy also block pending update/reboot notifications as the prior did on ≤ 2012 R2?
-
@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.
-
Do you have any of these policies set?
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Remove Notifications and Action Center
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off all balloon notifications
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off feature ad balloon notifications
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off notification area cleanup
-
@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.
Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else.
I am guessing creating another OU as a sub container and move the RD servers into.
Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way.
-
@pmoncho said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
Do you have any of these policies set?
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Remove Notifications and Action Center
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off all balloon notifications
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off feature ad balloon notifications
User -> Policies -> Admin Templates -> Start Menu/Taskbar -> Turn off notification area cleanup
I don't think I have those setup or specific to the RD servers.
-
@manxam said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@wrx7m : The "not available to administrators" is an easy fix with GPO, but does this latter policy also block pending update/reboot notifications as the prior did on ≤ 2012 R2?
I don't know if that will block the notifications. But, I do know that I don't want some random user trying to update the servers.
-
@wrx7m said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.
Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else.
I am guessing creating another OU as a sub container and move the RD servers into.
Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way.
If you can make those changes directly in the registry, maybe can allow you to use GPP and item level targeting.
-
@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@wrx7m said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:
@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.
Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else.
I am guessing creating another OU as a sub container and move the RD servers into.
Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way.
If you can make those changes directly in the registry, maybe can allow you to use GPP and item level targeting.
Hmmm. That makes sense. Let me mull it over.
