Kaseya Community

Windows 10 icon reappeared

  • KB3035583 appeared to be installed on of our clients machines although its blocked by kaseya Patch management.

    How come? any thoughts? The update installed last thursday and can only be seen by Kaseya Patch Status page.

  • Possibly KB3139929


  • ,

    It's also possible the patch was introduced outside of Kaseya.  The WindowsUpdate.log file may provide some information regarding the patch installation (if the patch installed via the Windows Update Agent).  It's a good starting point in trying to troubleshoot.  The Event Logs may also provide some information.  It's possible an end user manually installed the patch, whether intentionally or inadvertently.

    If the patch was installed by Kaseya, then there is a reason:  an admin installed the patch outside of policy (via Machine Update or Patch Update); a version of the patch is approved in a patch policy; the patch was approved, began the install, and was later denied, the endpoint is not part of a patch policy - these are a few potential reasons Kaseya would install a patch believe to be denied.  Configuration Changes Log, Agent Procedure Log, and System Log, and potentially the local WindowsUpdate.log file can provide the details you're looking for.  Support can help guide you through the logs if you're not sure how to interpret them.  I recommend you open a ticket with Support at helpdesk.kaseya.com for some assistance as they will be able to provide information based directly on what's present in the various logs.

  • Looks like MS added code to another update..


  • Brande,

    We have the Desktop Management policy applied on all workstations to disable Windows Update form the managed machines. so that eliminates that a user installed manually (they have no admin rights to change it). Also this is installed on the computer on the network.

  • Is there a way to find who has that update through kaseya.

  • Create a new view.

    In the View Definitions pop-up, scroll down to Patch Management.

    Check "Machines with installed patch (use KB Article ID - digits only)" and enter the KB number.

  • Thanks Mike - How do we remove it. I tried few scripts but had no luck.

  • Script attached.

    The one buggy thing I've just discovered about the view is that it's results aren't updating even after running an audit. 

    I'm sure that's been covered before.  Can some remind me what needs to be done to get a fresh list of agents that meet the view conditions?

    Procedure NOC_Microsoft KB Article Remove - KB3035583.xml

  • We disable GWX in the registry via agent procedure on our win7 machines, after a reboot it removes the icon completely.

    Windows Registry Editor Version 5.00








    Works like a charm. I would attach the agent procedure we use but this thread does not appear to let me upload any files.

  • Click the "Use rich formatting" link at the bottom of the comment box, then click the Insert Media button on the toolbar.

  • Here is the agent procedure we use mentioned in my last email to disable GWX all together.Procedure Get Windows 10 App (Disable).xml

    correct spelling
    [edited by: timypcr at 10:14 AM (GMT -8) on Mar 11, 2016]
  • here is the agent procedure we use to disable GWX

    1563.Procedure Get Windows 10 App (Disable).xml

  •  The script ran with no issue - but the icon still appears -even after reboot.

  • 3441.Procedure Windows 10 Upgrade (Disable).xml

    How about this procedure? It's a bit simple but should do the job if the registry keys have not been set before.

    fixed procedure, AllowOSUpgrade & ReservationsAllowed were wrong
    [edited by: neuvoja at 11:12 AM (GMT -7) on Mar 14, 2016]