How to utilize LANDESK to Disable/Enable Windows Automatic Updates

Issue

Need to disable Windows Updates

Need to enable Windows Updates

Resolution

Downloading Updates

A pre-requisite for the following instructions are to download the Security Threat updates.

1. Click the Download Updates icon.
2. Go to the updates tab.
3. Expand the tree to go to Windows -> Security -> Microsoft Windows Security Threats
4. Click "Download Now".

Note you may want to add the Microsoft Windows Security Threats to your list of regularly downloaded content.

The settings for Windows Automatic Updates can be changed using the custom definition settings in LANDESK Security Suite.  The steps below show the steps required to Disable Windows Automatic Updates.

1. Download the Security Threat definitions by going to the
2. From a LANDESK Console go to Security and Compliance | Patch and Compliance
3. Select "Security Threats" from the "Type" drop down menu located on the toolbar.
   
4. Right click on "Custom Groups" and select the option to create a new group.  Give the new group a name such as "Security Threats" and save it.
   
5. In the left-hand pane click Security Threats (all items)
6. In the right hand pane under Find enter "ST00003" and hit Enter
7. Double-click on the ST000003 definition to open the properties.
   
8. Click on the "Custom Variables" tab.  Click on the "Value" drop down menu and select the desired option.  For this example choose the "Turn Off" option. Click "Apply".

6. Highlight the "ST000003" vulnerability from the list of vulnerabilities in the scan folder and drag it to the custom group that was created in step 3.

7. Create a new Distribution and Patch setting and give it a name such as  "Security Threats".

8. In the left-hand pane go to Patch-only settings | Scan options and where it says "Scan for" select the radio button for Group and then select the group created in Step 3.

9. Select the option to "Immediately repair all detected items".

10. Make any other modifications Distribution and Patch settings and click the Save button.

11. Right-click the Custom group created in step 3 and choose Repair

12. Select the Repair settings you would like to use.

13. Under Agent Settings in the left-hand pane select the Distribution and Patch setting that was created in step 7 from the Distribution and Patch Settings drop down menu. Click the Save button to create the task.

14. Drag the clients you want to run this machine into the task and select a start time.

Please note that that there are multiple methods that one could use to disable the Windows Automatic Updates with LANDESK.  The method provided in this article will create a task that scan specifically for the ST000003 vulnerability instead of scanning for all of the security threat vulnerabilities that are located in the Security Suite Scan folder. This will result in a faster scan and repair.