SCCM Client PC's failing to download/install Windows Updates

Question

Hi,
Last month I noticed that our client PC's, shortly after they had built (using SCCM Task Sequence)  were downloading and installing Windows Updates using the usual Windows Update process. What I mean is, I had Software Centre showing Updates as installing,
but also had the Windows Update agent installing various updates. It was also showing in the start menu (Yellow icon saying Shut down and install updates). Now my understanding is, that that shouldn't of been happening, and only SCCM/Software Centre should
be showing Windows Updates as installing.
I noticed that we had some GPO's set for Windows Updates, which I have disabled, as I believed these were not necessary. Also, I like to control my Updates via SCCM Software Update groups after testing them, and not just allow clients to grab any updates
that are required and approved.
My problem now is, none of the clients are getting/installing any updates. I'm getting the following errors in the WUAHandler.log:
Unable to read existing WUA resultant policy. Error = 0x80070002.
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
Group policy settings were overwritten by a higher authority (Domain Controller) to: Server  and Policy NOT CONFIGURED
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
Failed to Add Update Source for WUAgent of type (2) and id ({FC358571-80C5-4EAA-8A33-F79AD4C14785}). Error = 0x87d00692.
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
So, I've checked in:
HKLM\Software\Policies\Microsoft\Windowa\WindowsUpdate\ & HKLM\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate 
and neither have a WSUS server set. I'm assuming this is correct?
RSOP shows all policies in \\Computer Configuration\Administrative Templates\Windows Components\Windows Update as
DISABLED
GPEDIT shows \\Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location as
Enabled and as our server (https://XXX.XXX:8531) - I'm assuming this is what SCCM client sets as if I changed this setting and then restart the setting comes back. If it was a Group Policy conflict then I
would expect to see it in RSOP.
Does anyone have any suggestions? I'm puzzled as to what to look at next. Is my first assumption of having 0 group policies configured for WSUS correct? Am I also correct in assuming Windows Updates shouldn't show in Control panel, or at the Start > Shutdown
prompt, and only show in Software Centre?
Thanks, and sorry for the long winded post!

Answer 1

Hey Jason,
Thanks for replying and explaining the WUA stuff. That made sense to be but my mind was being clouded by the issue all of the PC's/Clients onsite were, and are still getting. I cleared out the Group Policy cache as detailed on the link.
- Cleared C:\Program Data\Microsoft\Group Policy\History\*.*
- Ran a gpupdate /force
- Restarted PC
Issue still remains. Here is the output from the WUAHandler.log
CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3;
for bundles 
WUAHandler 13/04/2015 16:14:34 2508 (0x09CC)
Its a WSUS Update Source type ({FC358571-80C5-4EAA-8A33-F79AD4C14785}), adding it. WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Unable to read existing resultant WUA policy. Error = 0x80070002. WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Enabling WUA Managed server policy to use server: https://(Name.domain of our SCCM SUP):8531 WUAHandler 13/04/2015 16:15:02 2488
(0x09B8)
Waiting for 2 mins for Group Policy to notify of WUA policy change... WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Unable to read existing WUA resultant policy. Error = 0x80070002. WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)
Group policy settings were overwritten by a higher authority (Domain Controller) to: Server  and Policy NOT CONFIGURED WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)
Failed to Add Update Source for WUAgent of type (2) and id ({FC358571-80C5-4EAA-8A33-F79AD4C14785}). Error = 0x87d00692. WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)