Group policy for new clients

[Kevin79]

I want to use a GPO to point new domain clients to an internal WSUS server so that they don't download updates from Microsoft (in case they haven't been tested and approved by us). When I do this, SCCM updates don't work because the GPO preferences take precedence. How do I set it up so that new clients don't install updates before SCCM SUP is set up?

[Peter van der Woude]

Don't really get the question.. are you still busy the SUP?

[Kevin79]

Sorry. Lets see if this clears it up.

 

I use MDT to create new computers. After the computer is created/joined to the domain there is a period of time when the SCCM client isn't installed and the computer goes to Microsoft for updates. During this time, I would like to use Group Policy to have the computer go to my internal WSUS server so that it doesn't try to install all of the updates Microsoft lists. How do I do this? I've tried creating a GPO but when I do, the SCCM client logs says the update source is overwritten by Group Policy and doesn't work. Make sense?

[Peter van der Woude]

Then I think I would rather do something like deploying the client via a GPO

[Peter33]

I don't see the point why you are using MDT to actually deploy your Clients. I mean i am using MDT to create my Images, but there is no benefit in deploying your clients with it.

Anyways, MDT has an update step in the tasksequence which can be configured in the customsettings.ini .

You just have to additionally tweak the schedule settings in the registry at the end of the task sequence and your client will use the WSUS Server as long the SCCM client is not insatlled together with a proper update policy. SCCM will overwrite this local policy as soon as you activate SUP.

[Kevin79]

Ok. I'll look at doing that one.