GCumming

DirkW Hi Dirk. There's a registry tweak you can do on your KSC server. Upshot is that user machines can check windows update manually as well as take pushes from the console but the check online hyperlink in windows update does take a while (hours to days) to show. The store and all the other features start working pretty much immediately though. Instructions - Run on KSC server and it'll stop deploying that reg update to client machines. 1) Stop KSC11 server service 2) Open registry editor "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags" 3) Create server flag KLWUS_WUA_DISABLE_CONN_TO_INET = 0 4) Start KSC11 server service

I've done a lot of trouble shooting with this (when i found the Store, Windows updates and direct downloads (i.e. the auto download / install of .net 3.5 or RSAT tools installation via command line) and discovered the Netagent 11 policy that enables WSUS was the cause. When it's enabled it updates the registry keys in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate with wsus info but it also adds the DoNotConnectToWindowsUpdateInternetLocations key. I believe it's this key that's stopping the devices from manual windows updates check ins and all the other features not connecting. Is it possible to use the kaspersky WSUS feature but without this one key being added? From what i can see this only happens with netagent 11 (11.0.0.1131) and users who still have netagent 10 (from previous KSC server) get the wsus updates but not the DoNotConnect...... key. You can't manually update the key because any changes are immediately reverted to the pushed settings. Pictures added for clarification.