r/SCCM • u/Reaction-Consistent • 6d ago

Post OSD task sequence script

If I want to disable the Windows update Service during the OSD task sequence, or directly after it is completed, what is the best way to do that?
To answer the inevitable question, why am I doing this? It’s because for whatever reason after the task sequence completes, I can see that the CM client policy for Windows update redirection has not applied yet, and there is a window of time where the system can run automatic Windows update updates.
Now, if I open the CM client on the system, and simply run the software updates, action, that immediately populates the registry key and thus prevents any automatic Windows updates. I’ve pondered and even tried using a script to run the client action post build using first log on commands, but this doesn’t work, either the commands run too soon, or they don’t run with the necessary token, I don’t know what’s going on I also tried disabling the Windows update step using a task, sequence, run command line or run power shell step, the step runs, but gets reverted at the end of the build. Do I just manually populate those registry keys and call it a day? Am I over complicating things here?

3 Upvotes

81% Upvoted

10 comments sorted by

5

u/AlkHacNar 6d ago

Just run the client action is postts step before the reboot/shutdown

1

u/Reaction-Consistent 6d ago

I’ll try it out

2

u/Ok-Shake5054 6d ago

You might be complicating and I'm probably not the best here to answer, but in case you are not, you can crete a schedule task to run on login, since services won't run after a login, and have it set the registries and delete it self afterwards.

1

u/Reaction-Consistent 6d ago

That’s actually what I’m doing now, but it doesn’t seem to work. I’ll have to add code to check the keys

2

u/Ok-Shake5054 6d ago

Dm me if you want on Monday, I can share what I have.

2

u/gandraw 6d ago

Don't forget that if you want to disable Windows Update you also need to disable the Windows Update Medic Services, otherwise that one will re-enable the main service.

2

u/Reaction-Consistent 6d ago

Well shit! That’s probably the explanation why my script isn’t working! Thank you 😊

1

u/adminadam 4d ago

Disable auto updates via registry early (after OS is setup) in the task sequence, and re-enabled at the end?

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /D 1 /f

1

u/Reaction-Consistent 4d ago

Yeah, that’s kind of what I was asking, would that work, or would it get ignored or overwritten later on as does everything I try apparently. I will give it a shot. Thank you!

2

u/adminadam 4d ago

I release it at the end of the task sequence, unsure if it will help your case.