Is there a way to report on Windows 10 paused updates

[Gillian]

Hi,

With Windows 10 now providing a pause updates as part of the update advanced options we would like to know out of the Windows 10 machines we have which have been set into a paused state. Some of our developers at times put their machine into paused state during deployment or crucial working but as a Network team we would like to be able to identify these machines and arrange with the individuals the best time to update.

I have a report set up already for detecting when Wuauserv has stopped but not sure if it's just this one or a combination of services or a registry entry that would be more specific.

This is the report currently but is returning machines (mine for example) which I know the service is running (Manual triggered)

elect Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tsysOS.OSname As OS,
tblAssets.SP,
tblAssets.Lastseen,
tblAssets.Lasttried,
tblServicesUni.Name As ServiceName,
tblServicesUni.Caption As ServiceDisplayName,
tblServices.Started
From tblServices
Inner Join tblAssets On tblServices.AssetID = tblAssets.AssetID
Inner Join tblServicesUni On tblServices.ServiceuniqueID =
tblServicesUni.ServiceuniqueID
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Left Join tsysOS On tblAssets.OScode = tsysOS.OScode
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblState On tblState.State = tblAssetCustom.State
Where tblServicesUni.Name = N'wuauserv' And tblServices.Started = 'False' And
tblState.Statename = 'Active'
Order By tblAssets.Domain,
tblAssets.AssetName

Thank you

[Gillian]

Brilliant, Thank you for pointing in the right direction. It took us a little time to find the correct Registry keys to use to allow us to report on the machines with updates paused and the resume date. This ended up being a bit of a mashup between 3 different reports. The registry keys used are highlighted below and have been added to Registry scanning.


Select Top 1000000 tblAssets.AssetName,
tblAssets.Domain,
tblADusers.Firstname,
tblADusers.Lastname,
FirstKey.PatchState,
SecondKey.DeferredStart
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Left Join (Select tblRegistry.AssetID,
tblRegistry.Regkey,
tblRegistry.Value As DeferredStart
From tblRegistry
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings') SecondKey
On SecondKey.AssetID = tblAssets.AssetID
Left Join (Select tblRegistry.AssetID,
tblRegistry.Regkey,
tblRegistry.Value As PatchState
From tblRegistry
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings')
FirstKey On FirstKey.AssetID = tblAssets.AssetID
Left Join tblADusers On tblADusers.Username = tblAssets.Username And
tblADusers.Userdomain = tblAssets.Userdomain
Where FirstKey.PatchState = '1' And tsysAssetTypes.AssetTypename = 'Windows'
Order By tblAssets.AssetUnique


The Registry key values are:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Value: PausedFeatureStatus

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings
Value: PausedFeatureUpdatesEndTime

I am now trying to make a chart which shows per date the number of assets which have been deferred to. However the date pulled through for the registry keys is a date/time stamp which means effectively for each date only one asset to a date/time unless they were paused at exactly the same time.

example: 2018-06-28T15:04:01Z


I hope the above report code helps others, but can anyone help with making a chart only ready the date and not the time.

[Esben_D]

I think this might help: https://docs.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb

In short, you should be able to check if Feature Updates are paused by checking the registry key PausedFeatureStatus under HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings

You can scan this registry key and value with Lansweeper and then add it to your report. You can find more information on how to scan the registry key here: https://www.lansweeper.com/kb/18/report-based-on-registry-keys.html