Server 2022 Windows disabled (wsus) update service enables by itself

[Jens Strohschnitter1709152492]

We're running Server 2022 in a test environment. Everything seems to be ok, unless the Windws Update Service enables itself.

We've disabled the service as best practice on the golden master imager. The VDAs (MCS) starting also with disabled service,

but after a while, the service goes to "manualy" and starts itself.

 

We checked out any GPO setting, but there is nothing. Also the productive VDAs with Server 2019 and same GPOs have still disabled
WSUS service.

 

In eventlogs in system we've seen entries which says in periodicaly times, that service is enabled and started (sorry only in german
available:

 

Is there anyone facing same issue ?

[Baptiste Potiron1709160479]

I have the same issue, and I follow this article by changing the account that can run the service : https://www.thewindowsclub.com/windows-10-update-enables-even-turning-off

 

It's not clean but as a workaroud.

[Jens Strohschnitter1709152492]

After reinstalling server without december patches (2022-12 cumulative update KB5021249), service stays disabled after reboot. 

Seems to be a feature/bug in the december patch KB5021249

[Rene Gerles]

I have exactly the same phenomenon.
However, I cannot uninstall KB5021249. I have now waited for the February Microsoft patches, but brought nothing. I ran the Citrix Optimizer again, but that didn't work either.
I am really desperate, because the PVS image with self-activating Windows updates is totally unusable. Must be more people with the problem here?

[Jens Strohschnitter1709152492]

We've opened a case @Citrix - but they told me to open a case @MS. They told me it's best practise and a feature in the last WSUS patches. If we do not want it, we have to open a case @Citrix again. 

 

I don't like ping/pong playing ?

[pacerra644]

Anyone resolve this issue yet? I am experiencing this same issue with Windows 10 22H2 December 2022 updates.  No matter how I force disable Windows update service it always re-enables.  This must be a new feature of Windows 10 to force windows updates. This is really frustrating when you have a non-persistent image.  I may have to roll back the updates until there is a fix. 

[Jens Strohschnitter1709152492]

No solution yet. Citrix dropped the case and says it is an issue by MS. MS says it's an feature of them and will not be disabled.

So Server 2022 is no option for us. Hoping Server 2019 will not be affected in future updates.

[Jens Strohschnitter1709152492]

Set logon-account .\Guest via GPO works for us. Excluded the golden master imager ?