WSUS Server settings and Migrating SCCM 2007 Clients to SCCM 2012 R2

Question

I am in the process of migrating a site from SCCM 2007 to SCCM 2012 R2.
Whilst doing this I came across the following issue:
The first issue is the workstations are woefully out of date, patch and update-wise, some have never had a patch applied as the branch IT staff are building them from the original disk. The policy is set in the SCCM 2007 client to point the machines at
the 2007 WSUS server, which is not set to deliver any updates to 2007 clients and hasn't been for a while. So as soon as the client is installed they lose the ability to get updates from Microsoft and don't get them from the 2007 WSUS server either.
Issue number 2 is the machines are a mixture of hand-built machines to SCCM 2007 delivered images, the SCCM image is patch using offline patching so they are somewhat up-to-date, but the hand-built machines are not and as there is no standardization on
the Microsoft Update client settings, the IT person on-site sets it to whatever he/she feels like, as it makes no difference once the client is installed and the policy applied.
So, when I come to update the client from 2007 to 2012, the following occurs
The Client uninstalls, and the GPO policy settings for Windows Update are removed.
Depending on the setup of the client initially, some machines are then going to Microsoft for their updates (literally 100s) and although the new client is installed the policy update does not fire to update the Windows Update Policy settings, sometimes
for hours after the install finishes. My thoughts are that it just can't run the policy as it is bogged down by patches updating and, in some cases, rebooting and then updating some more.
As a workaround I have had to go in an physically disable Microsoft Update on these machines, which stops the downloading and eventually allows the policy to apply, after which the machine then begins to receive patches from WSUS in a controlled method during
maintenance windows.
I have tried a number of approaches, even setting the Global Group Policy for Windows Update, but the install still removes the keys and basically sets Windows updates back to whatever it was set before the policy was applied and stays that way until the
new client is installed and the Machine policy reapplied. This can be speeded up by initiating it on the client obviously, but that would mean going to each client or using right-click tools on each machine, which is not an option.
What I would like to know is if there is something I am missing from my methods or is it just that I have never been on a site with such out of date workstations built in such different ways.
Any help would be appreciated.

Answer 1

First note that clients do *not* get updates from WSUS in ConfigMgr. The Windows Update Agent (WUA) must point to the WSUS integrated into ConfigMgr (by virtue of having the SUP installed on it) but this is only to make the update catalog/metadata available
to it. Approving updates in WSUS is unsupported for ConfigMgr.
What you've described above is all working as designed although these clients are falling into a gap between the 2007 and 2012 configuration and thus they are reaching out to Windows Update during this gap and installing updates. To prevent this, you
need to disable automatic updates via a domain group policy. This will prevent all automated WUA activity including installing updates from any source automatically. This will not interfere with ConfigMgr Software Updates in any way though.
Jason | http://blog.configmgrftw.com | @jasonsandys