overdorf Absent Member.
Absent Member.
1874 views

ZCM GPO inconsistent enforcement on Windows 10

Thanks for reading this post!

Environment:
Windows 10 version 1151 and 1607
ZCM 11.4.2 running on 3 SLES 11.3 Server
Non-Domain OES Client Login
WSUS on Windows Server 2012 R2

GP=Group Policy
Situation:
I am having issues with Windows GP from ZCM being enforced on our network systems consistently. This is causing system that have no GP enforced to go out to MS updates and download the anniversary update and installing that update. I have not released that update through WSUS because of some older software that requires .Net Framework 3.5 installed and when the update installs it does not install that feature. The issue is showing up in an inconsistent manner. Sometimes I will see in event viewer that GP processing is taking place and sometimes it will not. There seems to be no pattern of why it will not enforce GP. I looked at the zcd-message.log file, but did not see anything. Better minds might! If I run a zac cc and then a zac ref the GP will enforce but after the user logs off, it is only hoping that the GP will still stay enforced. I looked at docs for GP troubleshooting in ZCM 11.4 and tried the registry setting [HKLM\Software\Novell\ZCM\GroupPolicy]
"ReApplyPolicyatDeviceStartup"="12", but that worked once and really does not solve my issue. Does 11.4.3 have an better GP processing? Anything I missed?

Any help will be appreciated.

Tim Overdorf
Labels (2)
0 Likes
3 Replies
Micro Focus Expert
Micro Focus Expert

Re: ZCM GPO inconsistent enforcement on Windows 10

WSUS should never be configured via GPO using ZCM.
http://www.novell.com/support/kb/doc.php?id=7009252

I would recommend pushing a key to set it to disabled and/or to have no schedule.
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: ZCM GPO inconsistent enforcement on Windows 10

Actually since you have a WSUS Server, you would want to simply push the configuration settings via a Bundle -
https://msdn.microsoft.com/en-us/library/dd939844(v=ws.10).aspx

The issue with a GPO is any WSUS settings you push are removed at device shutdown and not in place at device startup until Windows gets around to re-applying things.
During this TIME, Windows Updates will be operating with different settings.
0 Likes
overdorf Absent Member.
Absent Member.

Re: ZCM GPO inconsistent enforcement on Windows 10

Thanks Craig for the info. I had seen that before but with the age of the TID and newer revisions of ZCM, I thought maybe there was a better way. Thanks again!

Tim Overdorf
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.