Windows Server 2016 — Dual-scan behaviour causes clients to bypass WSUS for feature updates — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Some Windows Server 2016 systems pull updates from Windows Update directly instead of approved WSUS feeds, breaking compliance reporting.

Environment & Reproduction

Reproduces when both WSUS and Windows Update for Business policies are applied, triggering legacy dual-scan logic.

Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate'

Root Cause Analysis

Dual-scan is deprecated; mixing WSUS and WUfB policies leads clients to fall back to Windows Update for feature updates.

Quick Triage

Identify GPOs that set both WSUS server and WUfB deferral policies.

gpresult /h C:report.html
Select-String C:report.html -Pattern 'WindowsUpdate|DeferFeatureUpdates'

Step-by-Step Diagnosis

Confirm dual-scan registry markers on affected hosts.

Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate' | Select DisableDualScan,WUServer

Solution — Primary Fix

Set DisableDualScan to 1 and remove conflicting WUfB feature update deferrals from WSUS-managed hosts.

Set-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate' DisableDualScan 1 -Type DWord
gpupdate /force

Solution — Alternative Approaches

Migrate fully to Windows Update for Business and decommission WSUS where feasible.

# Remove WSUS GPO link, deploy WUfB rings

Verification & Acceptance Criteria

Clients scan only against WSUS and feature update offers no longer appear without approval.

Get-WUHistory -Last 5

Rollback Plan

Remove the DisableDualScan setting if a transition plan requires temporary dual-scan behaviour.

Remove-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate' DisableDualScan

Prevention & Hardening

Run a single update authority and avoid mixing WSUS with WUfB feature update policies.

# GPO audit: alert when WUServer and DeferFeatureUpdates both set

Related Errors & Cross-Refs

Related: feature update offered unexpectedly, WSUS approval bypass, and Configuration Manager co-management drift.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn documentation on dual-scan deprecation and DisableDualScan policy.