执行gpupdate /force后Windows Update服务自动停止原因排查

配置了用于客户端使用WSUS的GPO后，执行gpupdate /force后Windows Update服务会在2至10分钟内停止；手动启动服务后，再次执行gpupdate时服务仍会停止。此外，服务还会在计划更新时间前2分钟或后10分钟自动关闭。

相关Windows Update日志如下：

2023/04/04 01:00:05.7207476 1372  8080  DataStore       JetEnableMultiInstance succeeded - applicable param count: 5, applied param count: 5
2023/04/04 01:00:05.9690425 1372  8080  Shared          UpdateNetworkState Ipv6, cNetworkInterfaces = 0.
2023/04/04 01:00:05.9690732 1372  8080  Shared          UpdateNetworkState Ipv4, cNetworkInterfaces = 1.
2023/04/04 01:00:05.9696558 1372  8080  Shared          Network state: Connected
2023/04/04 01:00:06.0393137 1372  8080  Misc            *FAILED* [8024000C] LoadHistoryEventFromRegistry completed
2023/04/04 01:00:06.0399616 1372  8080  Shared          UpdateNetworkState Ipv6, cNetworkInterfaces = 0.
2023/04/04 01:00:06.0399832 1372  8080  Shared          UpdateNetworkState Ipv4, cNetworkInterfaces = 1.
2023/04/04 01:00:06.0399955 1372  8080  Shared          Power status changed
2023/04/04 01:00:06.0429056 1372  8080  Agent           Initializing global settings cache
2023/04/04 01:00:06.0429076 1372  8080  Agent           WSUS server: http://wsus.addemo.com:8530
2023/04/04 01:00:06.0429088 1372  8080  Agent           WSUS status server: http://wsus.addemo.com:8530
2023/04/04 01:00:06.0429195 1372  8080  Agent           Alternate Download Server: (null)
2023/04/04 01:00:06.0429211 1372  8080  Agent           Fill Empty Content Urls: No
2023/04/04 01:00:06.0429221 1372  8080  Agent           Target group: Non-prod
2023/04/04 01:00:06.0429231 1372  8080  Agent           Windows Update access disabled: No
2023/04/04 01:00:06.0429242 1372  8080  Agent           Do not connect to Windows Update Internet locations: No
2023/04/04 01:00:06.0434393 1372  8080  Agent               Timer: 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2023-04-05 11:38:06, not idle-only, not network-only
2023/04/04 01:00:06.0484831 1372  8080  Agent           Initializing Windows Update Agent
2023/04/04 01:00:06.0485851 1372  8080  DownloadManager Download manager restoring 0 downloads
2023/04/04 01:00:06.0486723 1372  8080  Agent           CPersistentTimeoutScheduler | GetTimer, returned hr = 0x00000000
2023/04/04 01:00:06.0493503 1372  8080  IdleTimer       IdleTimer::NetworkStateChanged. Network connected? Yes
2023/04/04 01:00:06.0598440 1372  4464  DownloadManager Received power state change notification: Old: <unknown>; New: AC.
2023/04/04 01:00:06.0598462 1372  4464  DownloadManager Power state changed from <unknown> to AC.
2023/04/04 01:06:09.0554997 1372  8080  Agent           Refreshing global settings cache
2023/04/04 01:06:09.0555021 1372  8080  Agent           WSUS server: http://wsus.addemo.com:8530 (Unchanged)
2023/04/04 01:06:09.0555036 1372  8080  Agent           WSUS status server: http://wsus.addemo.com:8530 (Unchanged)
2023/04/04 01:06:09.0555050 1372  8080  Agent           Alternate Download Server: (null) (Changed)
2023/04/04 01:06:09.0555507 1372  8080  Agent           Fill Empty Content Urls: No (Unchanged)
2023/04/04 01:06:09.0555562 1372  8080  Agent           Target group: Non-prod (Unchanged)
2023/04/04 01:06:09.0555576 1372  8080  Agent           Windows Update access disabled: No (Unchanged)
2023/04/04 01:06:09.0555590 1372  8080  Agent           Do not connect to Windows Update Internet locations: No (Unchanged)
2023/04/04 01:10:05.7269236 1372  1496  Agent           Earliest future timer found:
2023/04/04 01:10:05.7269356 1372  1496  Agent               Timer: 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2023-04-05 11:38:06, not idle-only, not network-only
2023/04/04 01:10:06.7362603 1372  8080  Shared          UninitializeSUS
2023/04/04 01:10:06.7362630 1372  8080  Misc            CSusClientGlobal::DoServicePreShutdown
2023/04/04 01:10:06.7383258 1372  8080  IdleTimer       Idle timer disabled in preparation for service shutdown
2023/04/04 01:10:06.7383374 1372  8080  Misc            WUTaskManager uninit
2023/04/04 01:10:06.7383427 1372  8080  Agent           Earliest future timer found:
2023/04/04 01:10:06.7383515 1372  8080  Agent               Timer: 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2023-04-05 11:38:06, not idle-only, not network-only
2023/04/04 01:10:06.7416966 1372  8080  Misc            CreateSessionStateChangeTrigger, TYPE:2, Enable:No
2023/04/04 01:10:06.7417027 1372  8080  Misc            CreateSessionStateChangeTrigger, TYPE:4, Enable:No
2023/04/04 01:10:06.7451753 1372  8080  Misc            Agent uninit
2023/04/04 01:10:06.7464528 1372  8080  Misc            Reporter uninit
2023/04/04 01:10:06.7465485 1372  8080  Misc            network cost manager uninit
2023/04/04 01:10:06.7465912 1372  8080  Misc            Eventer uninit
2023/04/04 01:10:06.7467112 1372  8080  Misc            ServiceManager uninit
2023/04/04 01:10:06.7467258 1372  8080  Misc            PersistentTimeoutScheduler uninit
2023/04/04 01:10:06.7467276 1372  8080  Misc            datastore uninit
2023/04/04 01:10:07.3533122 1372  8080  Misc            setting cache uninit
2023/04/04 01:10:07.3533156 1372  8080  Misc            security checker uninit
2023/04/04 01:10:07.3533194 1372  8080  Misc            Test Hook uninit
2023/04/04 01:10:07.3533204 1372  8080  Misc            IdleTimer uninit
2023/04/04 01:10:07.3536142 1372  8080  Shared          * END * Service exit Exit code = 0x240001

配置截图：

计划时间截图：

从日志末尾的退出代码0x240001可以确认，Windows Update服务是正常的空闲状态退出，但结合gpupdate触发的现象，问题根源在于GPO配置冲突：

可能的原因 #

1. 服务启动类型配置错误
   如果GPO中将Windows Update服务（wuauserv）的启动类型设置为手动，gpupdate会强制应用该设置。Windows Update服务本身设计为在完成任务后自动退出，手动启动类型下，服务不会自动重启，就会出现执行gpupdate后服务停止的情况。

2. 空闲超时参数被GPO强制设置
   GPO中可能配置了过短的Windows Update服务空闲超时时间，导致服务在gpupdate应用配置后，很快触发空闲退出逻辑。

3. 计划更新任务的触发逻辑冲突
   从计划时间截图来看，服务在计划更新前后关闭，是因为GPO配置的自动更新计划任务在执行前后会停止Windows Update服务，以完成配置同步或更新安装操作。

排查与修复步骤 #

• 生成组策略报告检查配置
  执行命令gpresult /h gpreport.html，打开报告后查看计算机配置>策略>Windows设置>服务中wuauserv的启动类型，确认是否被设置为自动（延迟启动）（系统默认值）。若为手动或禁用，修改GPO对应配置为自动（延迟启动）。

• 检查注册表验证参数
  打开注册表编辑器，定位到HKLM\System\CurrentControlSet\Services\wuauserv，确认Start值为2（对应自动延迟启动）；再查看HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate下的超时相关参数，确保没有被GPO强制设置为过短的值。

• 查看系统事件日志
  在事件查看器的系统日志中，搜索源为Service Control Manager、事件ID为7036的事件，查看Windows Update服务停止的详细描述，确认停止原因是否为GPO应用或服务自身空闲退出。

内容的提问来源于stack exchange，提问作者Robert