Windows Server 2016 — Dual Scan Configuration Pulls Unapproved Internet Updates — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Servers configured for WSUS still query Microsoft Update directly, causing unapproved patch drift.

Environment & Reproduction

Occurs when deferral policies and WSUS policies are combined incorrectly.

gpresult /h C:Tempgp-186.html
Get-ItemProperty HKLM:SoftwarePoliciesMicrosoftWindowsWindowsUpdate

Root Cause Analysis

Policy precedence enables dual-scan logic that bypasses intended source control.

Quick Triage

Confirm effective policies for WUServer, AUOptions, and DoNotConnectToWindowsUpdateInternetLocations.

reg query HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdate
reg query HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdateAU

Step-by-Step Diagnosis

Review WindowsUpdateClient log source endpoints and service IDs.

Get-WindowsUpdateLog -LogPath C:Tempwu-186.log
findstr /i /c:"ServiceId" C:Tempwu-186.log

Solution — Primary Fix

Disable internet update connections for managed hosts and enforce WSUS service endpoints.

reg add HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f
gpupdate /force

Solution — Alternative Approaches

Use separate OUs/rings for internet-serviced hosts and keep WSUS-managed estate isolated.

Get-ADComputer -Filter * -SearchBase "OU=Servers,DC=contoso,DC=local"

Verification & Acceptance Criteria

Client scans only against WSUS and approved patch set aligns with policy.

Get-WindowsUpdateLog -LogPath C:Tempwu-186-after.log
wuauclt /detectnow

Rollback Plan

Revert registry policy if emergency out-of-band internet updates are temporarily required.

reg delete HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /f

Prevention & Hardening

Document patch source architecture and lint GPO combinations before production link.

Get-GPO -All | Select DisplayName,Id

Related Errors & Cross-Refs

Related: unmanaged preview updates, ring drift, compliance report mismatches.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Windows Update for Business and WSUS coexistence guidance from Microsoft.