[SOLVED] windows update management

Questions about WAPT Packaging / Requests and help regarding Wapt packages.
Forum Rules
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
Locked
JPBUTT
Messages: 8
Registration: March 1, 2021 - 3:36 PM

August 30, 2021 - 2:27 PM

Hello
, I have noticed that KBs are being installed on workstations in our network even though we have not yet authorized them.

If below the file wapt-get.ini

[global]
repo_url=https://carbone.utt.fr/wapt
send_usage_report=1
use_hostpackages=1
wapt_server=https://carbone.utt.fr
use_kerberos=0
check_certificates_validity=1
verify_cert=C:\Program Files (x86)\wapt\\ssl\server\carbone.utt.fr.crt
use_repo_rules=0
max_gpo_script_wait=180
pre_shutdown_timeout=180
hiberboot_enabled=0
waptaudit_task_period=120m
[wapt-templates]
repo_url=https://store.wapt.fr/wapt
verify_cert=1
[waptwua]
default_allow=False
install_at_shutdown=true
enabled = true
allowed_severities = Critical,Important
download_scheduling = 7d
Attachments
kk-pending.PNG
kk-en-attente.PNG (45.29 KB) Viewed 5975 times
kb-authorize.PNG
kb-authorize.PNG (80.7 KB) Viewed 5975 times
User avatar
Gaetan
Messages: 169
Registration: August 8, 2019 - 10:16
Location: Toulouse

August 30, 2021 - 2:51 PM

Good morning :

Code: Select all

allowed_severities = Critical,Important
This installs critical KBs like the one mentioned
JPBUTT
Messages: 8
Registration: March 1, 2021 - 3:36 PM

August 31, 2021 - 08:33

Hello.
So this doesn't take into account the KBs that we allow or refuse?
User avatar
Gaetan
Messages: 169
Registration: August 8, 2019 - 10:16
Location: Toulouse

August 31, 2021 - 08:51

Hello,
yes, but only if they are not critical.

This allows for more flexibility with updates and avoids the need to worry about critical updates.
JPBUTT
Messages: 8
Registration: March 1, 2021 - 3:36 PM

August 31, 2021 - 11:00

We specifically want the updates to be validated before installation across the entire network.
Do I need to remove the line

`allowed_severities = Critical,Important`

from my configuration?
User avatar
Gaetan
Messages: 169
Registration: August 8, 2019 - 10:16
Location: Toulouse

August 31, 2021 - 11:02

Absolutely.
You can do it via a package: https://wapt.tranquil.it/store/tis-wapt-conf-policy
JPBUTT
Messages: 8
Registration: March 1, 2021 - 3:36 PM

October 6, 2021 - 5:04 PM

Hello,
sorry for the late reply.
We have updated our deployment configuration, but our clients are still installing Windows updates without our authorization.
They are even installing updates that we have refused.
User avatar
Gaetan
Messages: 169
Registration: August 8, 2019 - 10:16
Location: Toulouse

October 7, 2021 - 10:41

Hello,
if wapt-get.ini is up to date and the service has been restarted, there shouldn't be any more problems.

What updates were installed?
Locked