1

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to produce this result, and yet, it keeps changing from "Download but let me install" to "Automatically install and reboot," roughly speaking.

I have a strong hunch that somebody may be changing this setting back without realizing the potential damage it can cause, but I've no way to prove it.

Is there any way to determine who changed Automatic Updates settings and/or when they were changed?

HopelessN00b
  • 53,795
  • 33
  • 135
  • 209
tacos_tacos_tacos
  • 3,250
  • 18
  • 63
  • 100

1 Answers1

1

Probably a little late but I also had a reason to want to know this. An event is logged when the setting is changed but it's a little vague and the user is just logged as SYSTEM but you may be able to tell when it was changed. Create a custom view in event viewer and limit it to events from source WindowsUpdateClient. When the settings are changed an information event is created stating "There has been a change in the health of Windows Update."

Jim
  • 11
  • 1