WSUS does not see XP clients in Non Active Directory Domain

[Herb Jabs]

On a Windows 2000 server WSUS is installed with all it's default settings.
This server is on an NT4 domain and group policies that are in effect do not
apply or impact windows update services.
(Don't ask why NT4, I don't understand corporates tight wallet)
On the client side, an XP SP2 laptop was configured via the registry to look
for downloads from the WSUS server (named WUSS- 10.64.34.190).

The problem is that the server does not see the client.

The server is configured for computer-based targeting.
The client is configured according to the article
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSDeploymentGuideTC/30e04407-0d2a-4e28-983e-b2a82e5fa411.mspx

Active Directory GPO obviously does not apply here in an NT4 domain.
For "Local computer policy-computer configuration-administrative
templates-windows components-windows update" the client local policy is
configured as:

Enabled- Configure Automatic Updates
Enabled- Specify intranet Microsoft update service location . Tried
(http://10.64.34.190) and (http://wuss).
Enabled- Client-side targeting (tried enabled and disabled modes)
Enabled- Reschedule Automatic Updates scheduled installations.
Enabled- No auto-restart for scheduled Automatic Updates installations.
Enabled- Automatick Updates detection frequency
NotConfig- Allow Automatic Updates immediate installation
NotConfig- Delay Restart for scheduled installations
NotConfig- Reprompt for restart with scheduled installations.

Registry settings on the client machine are as follows:

HKLM-Software-Policies-Microsoft-Windows-WindowsUpdate

reg_dword 1 ElevateNonAdmins
reg_dword 0 TargetGroupEnabled
reg_sz http://10.64.34.190 WUServer
Also tried http://wuss
reg_sz http://10.64.34.190 WUStatusServer
Also tried http://wuss

HKLM-Software-Policies-Microsoft-Windows-WindowsUpdate-AU
(Decimal notation)

reg_dword 3 AUOptions
reg_dword 0 AutoInstallMinorUpdates
reg_dword 34 DetectionFrequency
reg_dword 1 DetectionFrequencyEnabled
reg_dword 1 NoAutoRebootWithLoggedOnUsers
reg_dword 0 NoAutoUpdate
reg_dword 15 RebootRelaunchTimeout
reg_dword 1 RebootRelaunchTimeoutEnabled
reg_dword 30 RebootWarningTimeout
reg_dword 0 RebootWarningTimeoutEnabled
reg_dword 15 RescheduleWaitTime
reg_dword 1 RescheduleWaitTimeEnabled
reg_dword 0 ScheduledInstallDay
reg_dword 3 ScheduledInstallTime
reg_dword 1 Use WUServer

I have treid to run wuauclt.exe /detectnow on the client without the client
showing on the server.

At this stage of the game I do not know what the "secret sauce" is to get
the server to see my client. I have investigated this on the web but really
have not been able to find a resolution outside of the GPO under Active
Directory.

Any input is very much appreciated:

Herb Jabs

[Torgeir Bakken (MVP)]

Hi,

As you have configured the server for computer-based targeting, you
need to set the registry value TargetGroupEnabled to 1 (it is set to
0 in your listing)

Also, you need to create a registry value TargetGroup (reg_sz) that
contains the name of the group you want the computer to show up in
(the group needs to exist on the server!). The TargetGroup registry
value is to be created under the same registry key as the
TargetGroupEnabled value.

If the above doesn't help for your problem:

I suggest you run the "Client Diagnostic Tool" download it from here:
http://www.microsoft.com/windowsserversystem/updateservices/downloads/default.mspx

Some tips here as well:

WSUS troubleshooting
http://www.wsuswiki.com/WSUSTroubleshooting

Regards,
Torgeir

Post by Herb Jabs
On a Windows 2000 server WSUS is installed with all it's default settings.
This server is on an NT4 domain and group policies that are in effect do not
apply or impact windows update services.
(Don't ask why NT4, I don't understand corporates tight wallet)
On the client side, an XP SP2 laptop was configured via the registry to look
for downloads from the WSUS server (named WUSS- 10.64.34.190).
The problem is that the server does not see the client.
The server is configured for computer-based targeting.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSDeploymentGuideTC/30e04407-0d2a-4e28-983e-b2a82e5fa411.mspx
Active Directory GPO obviously does not apply here in an NT4 domain.
For "Local computer policy-computer configuration-administrative
templates-windows components-windows update" the client local policy is
Enabled- Configure Automatic Updates
Enabled- Specify intranet Microsoft update service location . Tried
(http://10.64.34.190) and (http://wuss).
Enabled- Client-side targeting (tried enabled and disabled modes)
Enabled- Reschedule Automatic Updates scheduled installations.
Enabled- No auto-restart for scheduled Automatic Updates installations.
Enabled- Automatick Updates detection frequency
NotConfig- Allow Automatic Updates immediate installation
NotConfig- Delay Restart for scheduled installations
NotConfig- Reprompt for restart with scheduled installations.
HKLM-Software-Policies-Microsoft-Windows-WindowsUpdate
reg_dword 1 ElevateNonAdmins
reg_dword 0 TargetGroupEnabled
reg_sz http://10.64.34.190 WUServer
Also tried http://wuss
reg_sz http://10.64.34.190 WUStatusServer
Also tried http://wuss
HKLM-Software-Policies-Microsoft-Windows-WindowsUpdate-AU
(Decimal notation)
reg_dword 3 AUOptions
reg_dword 0 AutoInstallMinorUpdates
reg_dword 34 DetectionFrequency
reg_dword 1 DetectionFrequencyEnabled
reg_dword 1 NoAutoRebootWithLoggedOnUsers
reg_dword 0 NoAutoUpdate
reg_dword 15 RebootRelaunchTimeout
reg_dword 1 RebootRelaunchTimeoutEnabled
reg_dword 30 RebootWarningTimeout
reg_dword 0 RebootWarningTimeoutEnabled
reg_dword 15 RescheduleWaitTime
reg_dword 1 RescheduleWaitTimeEnabled
reg_dword 0 ScheduledInstallDay
reg_dword 3 ScheduledInstallTime
reg_dword 1 Use WUServer
I have treid to run wuauclt.exe /detectnow on the client without the client
showing on the server.
At this stage of the game I do not know what the "secret sauce" is to get
the server to see my client. I have investigated this on the web but really
have not been able to find a resolution outside of the GPO under Active
Directory.
Herb Jabs

[Herb Jabs]

Excellent, thank you for your reply. This is what I suspected that the URL
is incorrect, but is also unable to connect using the http://wuss url (wuss
is server name).

From some of the suggested reading as to questions of whether WSUS is
installed on the default web site, from what I gather it is. Under Internet
Information Services-wuss there is a Default Web Site and an Administration
Web Site. I do see a self update folder under the default web site for the
various operating systems.

As for the client diagnostics, the following information is posted for
review. What is puzzling to me is that the diagnostic tool shows that the
windows update service is not running, but viewing the local group policy
(gpedit.msc) under administrative templates-windows components I do show
"configure automatic updates" to be enabled. I did enable "client side
targeting" here as well.

I am trying to verify the port number used between the client and server,
but if I recall, the default is port 80 and the installation of WSUS has not
been customized.

WSUS Client Diagnostics Tool

Checking Machine State
Checking for admin rights to run tool . . . . . . . . . PASS
Automatic Updates Service is not running. . . . . . . . FAIL
Background Intelligent Transfer Service is not running. PASS
Wuaueng.dll version 5.4.3790.2182 . . . . . . . . . . . PASS
This version is WSUS 2.0

Checking AU Settings
AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
Option is from Policy settings

Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy. . . . . . . . . . . . . . . . . NONE
User IE ProxyByPass. . . . . . . . . . . . . . NONE
User IE AutoConfig URL Proxy
http://internal.artesyncp.com/proxy.pac
User IE AutoDetect
AutoDetect not in use

Checking Connection to WSUS/SUS Server
WUServer = http://10.64.34.190
WUStatusServer = http://10.64.34.190
UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS

VerifyWUServerURL() failed with hr=0x80072efd

A connection with the server could not be established


Press Enter to Complete

[Herb Jabs]

Another tidbit of information. On the server I sucessfully ran the script
from %systemroot%\program files\update
services\setup\installselfupdateonport80.vbs.

[Herb Jabs]

Even though the local group policy shows Windows Updates as enabled, the
following registry key conflicted with that setting even after system reboot:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoWindowsUpdate=1

Changed to

NoWindowsUpdate=0

[Adrian Marsh (NNTP)]

Herb,

If the client debug is showing that the AU client is not running, then you
need to check under Services, not registry entries (My Computer -> Manage ->
Services and Applications).

Other things it tells you: wuaueng.dll version is 5.4, this means that it
hasn't "talked" to the /selfupdate tree yet to update to 5.8.

Post by Herb Jabs
Excellent, thank you for your reply. This is what I suspected that the URL
is incorrect, but is also unable to connect using the http://wuss url
(wuss
is server name).
From some of the suggested reading as to questions of whether WSUS is
installed on the default web site, from what I gather it is. Under Internet
Information Services-wuss there is a Default Web Site and an
Administration
Web Site. I do see a self update folder under the default web site for the
various operating systems.
As for the client diagnostics, the following information is posted for
review. What is puzzling to me is that the diagnostic tool shows that the
windows update service is not running, but viewing the local group policy
(gpedit.msc) under administrative templates-windows components I do show
"configure automatic updates" to be enabled. I did enable "client side
targeting" here as well.
I am trying to verify the port number used between the client and server,
but if I recall, the default is port 80 and the installation of WSUS has not
been customized.
WSUS Client Diagnostics Tool
Checking Machine State
Checking for admin rights to run tool . . . . . . . . . PASS
Automatic Updates Service is not running. . . . . . . . FAIL
Background Intelligent Transfer Service is not running. PASS
Wuaueng.dll version 5.4.3790.2182 . . . . . . . . . . . PASS
This version is WSUS 2.0
Checking AU Settings
AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
Option is from Policy settings
Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy. . . . . . . . . . . . . . . . . NONE
User IE ProxyByPass. . . . . . . . . . . . . . NONE
User IE AutoConfig URL Proxy
http://internal.artesyncp.com/proxy.pac
User IE AutoDetect
AutoDetect not in use
Checking Connection to WSUS/SUS Server
WUServer = http://10.64.34.190
WUStatusServer = http://10.64.34.190
UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS
VerifyWUServerURL() failed with hr=0x80072efd
A connection with the server could not be established
Press Enter to Complete

[Herb Jabs]

I did see in the services window that the service was not running. I did
start the service and was eventually able to see the client appear on the
WSUS console window.

This will get me going for now. I am not certain if the client is getting
it's updates from the WSUS server at this point, but is reporting to the
server.

I am trying to backward engineer how to get automatic updates running as
previous systems were built to disable it, expecially on remote computers.

Once the proceedure is figured out, I will have an SMS (version 2.0)
package developed to make the necessary registry changes. I am not clear
right now how I can manipulate the startup status of a service and have that
incorporated in this SMS package, but that is another project.

I very much appreciate all your input. My last question is when a user
clicks on the Automatic Updates Icon, it still points to the Microsoft web
page. Should it instead be pointing to the WSUS server?

Thank you.

Herb Jabs

[Torgeir Bakken (MVP)]

Post by Herb Jabs
I did see in the services window that the service was not running. I did
start the service and was eventually able to see the client appear on the
WSUS console window.
This will get me going for now. I am not certain if the client is getting
it's updates from the WSUS server at this point, but is reporting to the
server.
I am trying to backward engineer how to get automatic updates running as
previous systems were built to disable it, expecially on remote computers.
Once the proceedure is figured out, I will have an SMS (version 2.0)
package developed to make the necessary registry changes. I am not clear
right now how I can manipulate the startup status of a service and have that
incorporated in this SMS package, but that is another project.
(snip)

Hi,

As long as the service is just disabled and not deleted:


Option 1:

Under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
set the Start value to 2 (type REG_DWORD). Next time the computer
reboots, the Automatic Updates are set to "Automatic"


Option 2:

Use a VBScript (no reboot necessary):

'--------------------8<----------------------

Set oWshNet = CreateObject("WScript.Network")

' get name of local computer
sComputer = oWshNet.ComputerName

' Automatic Updates service name
sService = "wuauserv"


bOK = EnableAndStartService(sService, sComputer)

' If you want to see the result, enable this code section
'If bOK Then
' WScript.Echo sService & " enabled and started"
'Else
' WScript.Echo "Failed to enable and start " & sService
'End If


Function EnableAndStartService(sService, sNode)

Const ADS_SERVICE_RUNNING = 4
Const ADS_SERVICE_DISABLED = 4
Const ADS_SERVICE_AUTO_START = 2
Const ADS_SERVICE_DEMAND_START = 3

Dim oComputer, oService
Set oComputer = GetObject("WinNT://" & sNode & ",computer")

On Error Resume Next
Set oService = oComputer.GetObject("Service", sService)
If Err.Number <> 0 Then
EnableAndStartService = False
Exit Function
End If

If oService.StartType <> ADS_SERVICE_AUTO_START Then
oService.StartType = ADS_SERVICE_AUTO_START
oService.SetInfo
WScript.Sleep 1000
End If

If oService.Status <> ADS_SERVICE_RUNNING Then
oService.Start
WScript.Sleep 1000
End If

EnableAndStartService = True
End Function

'--------------------8<----------------------

[Herb Jabs]

Brilliant! Much thanks.

Herb

[Shannon Wagner]

I recently realized (while trying to solve the problem of a few machines
that are not part of our AD domain) that I can add the wuau.adm template to
the Local Group Policy Object on a non-domain machine and configure it
identically to how I have my domain machines configured. That way you don't
have to worry about getting the registry settings just right, just do it via
Group Policy.

[Herb Jabs]

Another good option. I think this might be difficult to implement for 300+
clients as it looks like it would require hands on settings. Could one
simply modify this template to only allow a single option and then distribute
the wuau.adm template. Where does this template reside?

[Herb Jabs]

Here is a template modification which I believe should work in that I am
eliminating options so that the settings are according to our preferences:

#if version <= 2
#endif

CLASS MACHINE

CATEGORY !!WindowsComponents

CATEGORY !!WindowsUpdateCat


POLICY !!AutoUpdateCfg

KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
#if version >= 4
SUPPORTED !!SUPPORTED_WindowXPSP1
#endif

#if version >= 3
EXPLAIN !!AutoUpdateCfg_Help
#endif
VALUENAME "NoAutoUpdate"
VALUEON NUMERIC 0


PART !!AutoUpdateMode DROPDOWNLIST REQUIRED
VALUENAME "AUOptions"
ITEMLIST
NAME !!AutoUpdateModeAuto VALUE NUMERIC 4
END ITEMLIST
END PART

Part !!AutoUpdateSchIntro1 TEXT
END PART

Part !!AutoUpdateSchIntro2 TEXT
END PART

Part !!AutoUpdateSchDay DROPDOWNLIST REQUIRED
VALUENAME "ScheduledInstallDay"
ITEMLIST
NAME !!AutoUpdateSchDay_Everyday VALUE NUMERIC 0 DEFAULT
END ITEMLIST
END PART


Part !!AutoUpdateSchTime DROPDOWNLIST REQUIRED
VALUENAME "ScheduledInstallTime"
ITEMLIST
NAME !!AutoUpdateSchTime23 VALUE NUMERIC 23
END ITEMLIST
END PART

END POLICY


POLICY !!CorpWuURL

KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate"
#if version >= 4
SUPPORTED !!SUPPORTED_WindowXPSP1
#endif

#if version >= 3
EXPLAIN !!CorpWuURL_Help
#endif
ACTIONLISTON
KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
VALUENAME "UseWUServer" VALUE NUMERIC 1
END ACTIONLISTON

PART !!CorpWUURL_Name EDITTEXT REQUIRED
VALUENAME "WUServer"
END PART

PART !!CorpWUStatusURL_Name EDITTEXT REQUIRED
VALUENAME "WUStatusServer"
END PART

Part !!CorpWUURL_Example TEXT
END PART

END POLICY

POLICY !!AUReschedWait

KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
#if version >= 4
SUPPORTED !!SUPPORTED_WindowXPSP1
#endif

#if version >= 3
EXPLAIN !!AUReschedWait_Help
#endif

PART !!AUReschedWaitTime NUMERIC REQUIRED
VALUENAME "RescheduleWaitTime"
MIN 1
MAX 90
DEFAULT 5
END PART



END POLICY

POLICY !!NoAUAutoReboot

KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
#if version >= 4
SUPPORTED !!SUPPORTED_WindowXPSP1
#endif

#if version >= 3
EXPLAIN !!NoAUAutoReboot_Help
#endif

VALUENAME "NoAutoRebootWithLoggedOnUsers"
VALUEON NUMERIC 1

END POLICY


END CATEGORY ;; WindowsUpdateCat

END CATEGORY ;; WindowsComponents

[strings]

WindowsComponents="Windows Components"
WindowsUpdateCat="Windows Update"

SUPPORTED_WindowXPSP1="Windows Server 2003 family, XP SP1, 2000 SP3"

AutoUpdateCfg="Configure Automatic Updates"
AutoUpdateCfg_Help="Specifies whether this computer will receive security
updates and other important downloads through the Windows automatic updating
service.\n\nThis setting lets you specify if automatic updates are enabled on
this computer. If the service is enabled, you must select one of the three
options in the Group Policy Setting:\n\n2 = Notify before downloading any
updates and notify again before installing them\n\nWhen Windows finds updates
that apply to this computer, an icon appears in the status area with a
message that updates are ready to be downloaded. Clicking the icon or message
provides the option to select the specific updates to download. Windows then
downloads the selected updates in the background. When the download is
complete, the icon appears in the status area again, with notification that
the updates are ready to be installed. Clicking the icon or message provides
the option to select which updates to install.\n\n3 = (Default setting)
Download the updates automatically and notify when they are ready to be
installed\n\nWindows finds updates that apply to your computer and downloads
these updates in the background (the user is not notified or interrupted
during this process). When the download is complete, the icon appears in the
status area, with notification that the updates are ready to be installed.
Clicking the icon or message provides the option to select which updates to
install.\n\n4 = Automatically download updates and install them on the
schedule specified below\n\nSpecify the schedule using the options in the
Group Policy Setting. If no schedule is specified, the default schedule for
all installations will be everyday at 3:00 AM. If any of the updates require
a restart to complete the installation, Windows will restart the computer
automatically. (If a user is logged on to the computer when Windows is ready
to restart, the user will be notified and given the option to delay the
restart.)\n\nTo use this setting, click Enabled, and then select one of the
options (2, 3, or 4). If you select 4, you can set a recurring schedule (if
no schedule is specified, all installations will occur everyday at 3:00 AM).
\n\nIf the status is set to Enabled, Windows recognizes when this computer is
online and uses its Internet connection to search the Windows Update Web site
for updates that apply to this computer.\n\nIf the status is set to Disabled,
any updates that are available on the Windows Update Web site must be
downloaded and installed manually by going to
http://windowsupdate.microsoft.com."\n\nIf the status is set to Not
Configured, use of Automatic Updates is not specified at the Group Policy
level. However, an administrator can still configure Automatic Updates
through Control Panel.

;AutoUpdateMode="Configure automatic updating:"
;AutoUpdateModeNotify="2 - Notify for download and notify for install"
;AutoUpdateModeDownload="3 - Auto download and notify for install"
AutoUpdateModeAuto="4 - Auto download and schedule the install"

AutoUpdateSchIntro1="The following settings are only required"
AutoUpdateSchIntro2="and applicable if 4 is selected."
AutoUpdateSchDay="Scheduled install day: "

AutoUpdateSchDay_Everyday="0 - Every day"
;AutoUpdateSchDay_Sunday="1 - Every Sunday"
;AutoUpdateSchDay_Monday="2 - Every Monday"
;AutoUpdateSchDay_Tuesday="3 - Every Tuesday"
;AutoUpdateSchDay_Wednesday="4 - Every Wednesday"
;AutoUpdateSchDay_Thursday="5 - Every Thursday"
;AutoUpdateSchDay_Friday="6 - Every Friday"
;AutoUpdateSchDay_Saturday="7 - Every Saturday"

AutoUpdateSchTime="Scheduled install time:"

;AutoUpdateSchTime0="00:00"
;AutoUpdateSchTime1="01:00"
;AutoUpdateSchTime2="02:00"
;AutoUpdateSchTime3="03:00"
;AutoUpdateSchTime4="04:00"
;AutoUpdateSchTime5="05:00"
;AutoUpdateSchTime6="06:00"
;AutoUpdateSchTime7="07:00"
;AutoUpdateSchTime8="08:00"
;AutoUpdateSchTime9="09:00"
;AutoUpdateSchTime10="10:00"
AutoUpdateSchTime11="11:00"
;AutoUpdateSchTime12="12:00"
;AutoUpdateSchTime13="13:00"
;AutoUpdateSchTime14="14:00"
;AutoUpdateSchTime15="15:00"
;AutoUpdateSchTime16="16:00"
;AutoUpdateSchTime17="17:00"
;AutoUpdateSchTime18="18:00"
;AutoUpdateSchTime19="19:00"
;AutoUpdateSchTime20="20:00"
;AutoUpdateSchTime21="21:00"
;AutoUpdateSchTime22="22:00"
;AutoUpdateSchTime23="23:00"

CorpWuURL="Specify intranet Microsoft update service location"
CorpWUURL_Name="Set the intranet update service for detecting updates:"
CorpWUStatusURL_Name="Set the intranet statistics server:"
CorpWUURL_Example="(example: http://IntranetUpd01)"
CorpWuURL_Help="Specifies an intranet server to host updates from the
Microsoft Update Web sites. You can then use this update service to
automatically update computers on your network. \n\nThis setting lets you
specify a server on your network to function as an internal update service.
The Automatic Updates client will search this service for updates that apply
to the computers on your network. \n\nTo use this setting, you must set two
servername values: the server from which the Automatic Updates client detects
and downloads updates, and the server to which updated workstations upload
statistics. You can set both values to be the same server. \n\nIf the status
is set to Enabled, the Automatic Updates client connects to the specified
intranet Microsoft update service, instead of Windows Update, to search for
and download updates. Enabling this setting means that end users in your
organization don't have to go through a firewall to get updates, and it gives
you the opportunity to test updates before deploying them. \n\nIf the status
is set to Disabled or Not Configured, and if Automatic Updates is not
disabled by policy or user preference, the Automatic Updates client connects
directly to the Windows Update site on the Internet. \n\nNote: If the
"Configure Automatic Updates" policy is disabled, then this policy has no
effect."

AUReschedWait="Reschedule Automatic Updates scheduled installations"
AUReschedWait_Help="Specifies the amount of time for Automatic Updates to
wait, following system startup, before proceeding with a scheduled
installation that was missed previously. \n\nIf the status is set to Enabled,
a scheduled installation that did not take place earlier will occur the
specified number of minutes after the computer is next started. \n\nIf the
status is set to Disabled or Not Configured, a missed scheduled installation
will occur with the next scheduled installation. \n\nNote: This policy
applies only when Automatic Updates is configured to perform scheduled
installations of updates. If the "Configure Automatic Updates" policy is
disabled, this policy has no effect."
AUReschedWaitTime="Wait after system startup(minutes): "

NoAUAutoReboot="No auto-restart for scheduled Automatic Updates installations"
NoAUAutoReboot_Help="Specifies that to complete a scheduled installation,
Automatic Updates will wait for the computer to be restarted by any user who
is logged on, instead of causing the computer to restart automatically.
\n\nIf the status is set to Enabled, Automatic Updates will not restart a
computer automatically during a scheduled installation if a user is logged in
to the computer. Instead, Automatic Updates will notify the user to restart
the computer to complete the installation. \n\nBe aware that Automatic
Updates will not be able to detect future updates until the restart occurs.
\n\nIf the status is set to Disabled or Not Configured, Automatic Updates
will notify the user that the computer will automatically restart in 5
minutes to complete the installation. \n\nNote: This policy applies only when
Automatic Updates is configured to perform scheduled installations of
updates. If the "Configure Automatic Updates" policy is disabled, this policy
has no effect."

; These string below are used by Online Help



ADM_TITLE="Group Policy settings for Automatic Updates"
USER="User Configuration"
COMPUTER="Computer Configuration"
cOMPUTER_EXPLAIN="Contains settings that may only be used to configure
Computers."
USER_EXPLAIN="Contains settings that may only be used to configure Users."
SUPPORTEDON="Requirements:"

[Herb Jabs]

Last note to end my contributions for this thread.

With the helpful contributions from all, I elected to pursue this via
registry modifications and developed an SMS package to push registry changes
and start the Windows Update service. I also added a string value in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce which points to
C:\wau\DetectNow.bat file I created. The .bat files purpose is to run the
command C:\WINNT\system32\wuauclt.exe /detectnow on reboot. While
unnecessary, it does allow me to see the computer faster in the admin
console. The SMS package takes care of dropping the batch file into the wau
directory.

I need to investigate the best way to push out a silent installation of XP
SP2 prior to pushing out this package because of WSUS dependency’s on XP2 vs
installing the windows update client separately for SP1 systems.