Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Weird issue with unapproved patches installing

I have a fresh 2008 Server running PM 1.85.  Registered all the downstream servers, set up the approvals on the latest round of updates.  Everything's working pretty great (minus a ticket open for some reporting issues from custom generated reports), until I start gettign calls that a 3rd party update is installing and it shouldn't be based on our approvals.

We have multiple groups based on spcific needs (Adobe group, Apple group, Java Approved group, Java Not Approved group, etc).  The Java Not Approved has, you guessed it, Java 7u25 Not Approved (Inherited) and Java Approved set to Approved for Install.  This is shown on the Patch manager server as well as the downstream server that reports to it.  However, pc's are getting the Java update.  In the windowsupdate.log it show's it's coming in from WSUS.

Any ideas or need more info?  This is boggling my mind.

Labels (1)
0 Kudos
2 Replies
Level 17

If the Java Not Approved group has the update package set to Not Approved (Inherited), and the Java Approved group has the update package set to Approved for Install, and some computers in the Java Not Approved group are getting the update anyway, the logical inference is that those computers have been accidentally assigned to both groups.

Pick one of those computers that received the update that should not have, find the computer in the All Computers group of the upstream server, select the computer, click on "Change Group Membership" in the Actions Pane, and observe the actual group(s) configured for that computer.

Also potentially relevant is whether these groups are peer-groups, or parent-child groups, because inheritance of approvals is the default behavior. (e.g. a "Not for approval" group should never be a subgroup of another group where the update would be approved.)

Group approval looked good for the test pc.  However, got to thinking about this overnight before your reply and remembered, I had an issue with auto approvals and this update had been initially auto approved (all of them did to be exact, but only Java is one we segregate into Approved/Not Approved based on groups) due to auto approvals set on my WSUS server.  So I manually set Java to Not Approved rather than inherited, so far i'm not seeing new instances.

Thanks sir for giving me somethign else to check as well.

0 Kudos