SCCM and Windows Update Client Configuration

Question

Hello,
I am in the process of migrating SCCM 2007 client over to a new SCCM 2012 R2 site.
I deleted the AD site from 2007 and added it to 2012 and the client is pushed via Client Push. The client upgrades fine and things go well but
I run into a little problem after the client is installed.
Basically it seems to be an issue with how SCCM interacts with and controls Windows Update settings on the SCCM client.  I ran into a somewhat of a major issue that caused
all (or many) of the newly upgraded clients to go the internet to download updates from Microsoft shortly after the move from the 2007 site and client upgrade to 2012. This was because the client (or at least the ones I checked) had their WU settings to “Always
download and install” (or something similar). Obviously, expected  behavior with this setting, but the question is how did it get this way?
Does SCCM control any of these settings?  I know it take over the WSUS settings, etc, but I didn’t think it does anything with the WU client itself.
From my understanding the WU client settings are done via GPO (local or domain) or WU setting and SCCM does not control these settings.
I’m not looking for you to solve the problem, because it’s quite tedious, I’m just hoping that someone can lead me in the right direction to find out what if any WU settings
are controlled or changed by SCCM 2007 or 2012.
Thanks
Angelo
Angelo

Answer 1

Thanks for the extra info, Idan.  I should probably admit that I am an AD admin and SCCM is handled by someone else in my department.  My main issue with the LocalGPO is the Event 1096 corruption that causes all admin template settings to revert
to defaults - currently happening on over 100 workstations in our environment.  100% of these problems are caused by LocalGPO corruption and nothing else.  And we will pursue resolution of this issue with Microsoft because we agree that resolving
this problem is the primary goal.
But for the sake of understanding:  We don't have any non-domain members that need to be managed by SCCM.  If we had a policy stating "no SCCM client configurations resulting in a LocalGPO file are to be implemented in production - all are
to be done via Domain Group Policy," is it possible to eliminate the LocalGPO entirely?  Or will there always be a LocalGPO file regardless of whether or not there are settings visible from it in a gpresult report?  We would not need to match
SCCM configurations in Domain Group Policy because we would not make any changes to the SCCM client resulting in a LocalGPO file at all.  The slow link detection is not of concern to us because none of these settings that would not apply in this case
are SCCM-managed via LocalGPO (as far as I know): 
http://blogs.technet.com/b/musings_of_a_technical_tam/archive/2012/02/27/gpos-and-slow-link-detection.aspx
Another reason why I would prefer to do these settings in Domain Group Policy is that we have Advanced Group Policy Management installed in our environment, which is subject to our Change/Release process.  We can track the changes being made to clients
much more easily when they are done via AGPM.  Any changes that we want to make via SCCM client could be tested first to see how LocalGPO is effected, and then those changes could be made via Domain Group Policy instead in production.
Given this info, I'm still struggling to understand why it is recommended to implement anything via SCCM client configurations resulting in a LocalGPO file.  So far, the only compelling reason is that management of non-domain members is not possible
via Domain Group Policy, but that doesn't apply to our environment.  Is it recommended mostly for ease of administration, so that an SCCM admin doesn't need to work with another tool (Domain Group Policy)?  Any extra reasoning for this recommendation
that anyone can provide is much appreciated!