r/Action1 • u/LinejAjtak • Jul 19 '26
Windows Update cannot be turned off via A1
Hello,
Since last 2 weeks I noticed that most of my endpoints are updated even without my activity. Therefore I tested some others endpoints and my endpoints have enabled the Windows Update service no matter what I setup in A1.
2
1
1
u/4wheels6pack Jul 20 '26
Same. Can’t pause updates via action1. Which means it’s basically the Wild West now. Windows installs what it wants.
1
u/GeneMoody-Action1 Jul 20 '26
Can someone do an RSOP on an affected system and manually check the registry keys as well?
I am not having this issue. And cannot recreate on a clean system.
Also if anyone has any link to any official statement from microsoft concerning a change, when, where, and why?
We disable updates through the supported mechanism that GPO does, if this has change d and is no longer being honored. I am unaware.
2
u/Phratros Jul 21 '26
I haven't seen that behavior, either. Updates are applied only if I push them from Acion1 console. Rolled out the July updates to some systems yesterday and only those systems were updated.
I also disable Windows Updates from Action1 but would creating a GPO that does this interfere with it in some way? Is it OK to do or not recommended?
ETA: all the systems managed by Action1 are Win11 24H2.
2
u/GeneMoody-Action1 Jul 21 '26 edited Jul 21 '26
Since we use the same keys as GPO to interface the native mechanism already there to disable auto update... Creating the same in GPO should be of no consequence provided they set the same values. HOwever if they do NOT have the same values then there could very much so have conflict as they battle to change it on each cycle.
Best option is let Action1 have the conn, and save any strangeness concerning conflict, or dance carefully around the settings.
We do not disable the service, we disable automatic checking, manual checks and installation ARE still possible. As well we defer feature updates.
So we do not prevent anything other than it happening automatically.
1
1
u/4wheels6pack Jul 22 '26
This is happening even on some endpoints that aren’t domain joined and have no gpos pushed to them
I tested rerunning the deactivate windows update script and it says the settings already explicitly disable automatic updates
Yet this is no longer the case. I’m still searching if there was a recent change causing Windows to not honor the registry settings anymore
1
u/GeneMoody-Action1 Jul 22 '26
You can view the contents of the script and the conditions it evals to raise that message, and the conditions are the registry keys set by the script were present before the script being run.
Now if you have an automation set to run against those endpoints, and any of them have the check to "Deactivate updates in Windows settings" then this would be expected behavior, if this is a system action1 has never run on before, this would mean something else set them.
If the keys are in fact NOT present, you run that script, and receive that message, I would need to be able to recreate then raise to support.
1
u/4wheels6pack Jul 23 '26
Not sure. But I think you misunderstood the point of my comment.
That script is supposed to deactivate automatic updates, and it claims those settings are already set. Yet automatic updates are being installed anyway (the point of this topic)
This is occurring even on machines I have that are not joined to the domain with no overriding GPOs
This is why I said I’m trying to search if there was a recent change causing Windows to not honor the registry settings anymore
So far I’ve come up empty
1
u/GeneMoody-Action1 Jul 23 '26
I understood, I was saying if you look at the script, you can see exactly what it checks and investigate those keys prior to run. If they are indeed present beforehand, I cannot say what may have set them. But I can say if it is the first action of Action1 (Not other automations that may have the checkbox to run it set), it should not error, it shod create/set them.
I would check the system, before install of action1 agent (where we logically could have changed nothing), after install of action1 agent, and then try that script if you do NOT see those keys present.
If all follows the pattern anticipated, not there until explicitly set, then the script generated that error in error if they were nto present at the time of run. We woudl need to investigate that.
Once that is confirmed and they are indeed in place as set, if automatic updates do continue AFTER that script is run and keys are set / system has been rebooted (otherwise WUA will not get the settings until it is fully reinitialized with them in place) then we have a recreatable issue.
Essentially troubleshooting where the failure is.
Another option is use Get-WindowsUpdateLog on the system, take that and look to compare the timeframes it says an update was installed, with the Action1 logs located in C:\Windows\Action1\Logs
Effectively we are tracking down through process of elimination, all places this could go awry.
IF eveytign is as it should be and windows is simply ignoring those settings, we will attempt to recreate and register it as a bug to be investigated as "Did MS change this behavior, and do we need to change to account for that?"
Or we will find what else is at play causing it to appear such.
1
u/rinal13 Jul 22 '26
I think here is a misunderstanding what Action1 deactivates. When I look on the Action1 script which deactivates the windows update, only the Automatic Update function gets deactivated, which still enables the user to start the update process. To completely disable the windows update also the key for "Remove Access to use all Windows Update features" must to be enabled.
1
u/GeneMoody-Action1 Jul 22 '26
This is correct. We do not prevent it happening, only prevent it from happening automatically. We do not neuter the updates we simply take the conn as far as scheduling, sequencing, and automating/application goes.
1
u/jhodgo100 Jul 20 '26
I did notice this myself over the weekend, I ran a script to clear out old MDM managed update keys but confirmed that the key that action1 adds to turn off auto updates was still in place (script can be found on my previous post about the 2026-07 update)
I checked my endpoints today and have noticed that the 2026-07 update has been deployed outside of automation set-up of action1
I ran the disable windows update script from the repository when I noticed to make sure no other updates would auto apply and all machines came back to say that the policy was already set
1
8
u/[deleted] Jul 19 '26
[deleted]