972575 - 2008 bare metal provisioning base task sequence contacting WSUS to download and install approved updates

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[Mark Cornmesser [:markco] OOO 2024/04/15]

There are few separate parts in making this work. Because there is a preexisting w64 target group already set up on our WSUS instance the updates for 2008 was little bit easier. For other builds new groups will need to be set up and updates approved on the WSUS instance. 

The other parts that was needed:

customsettings.ini needed the following line:
WSUSServer=http://kms1.ad.mozilla.com (this will eventually change to WSUS1 instead of kms1) This line sets the server the machine will look for updates overriding reaching out to Microsoft for updates. 

Also requires a few registry changes to setup target group and enabling the local machine to be in a target group: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"TargetGroup"="w64"
"TargetGroupEnabled"=dword:00000001

Some additional registry items needs to be enabled: 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAUShutdownOption"=dword:00000001
"EnableFeaturedSoftware"=dword:00000000
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"UseWUServer"=dword:00000001
"NoAutoUpdate"=dword:00000001

Lastly the in task sequences added a a command line step to run ZTIWindowsUpdate.wsf. This is a built in script in MDT.