Hello, I am going through an MCTS Study Guide for Microsoft Windows 7 Configuration, in preparation for exam 70:680, though I am not with a college. I find the book good, but unfortunately for 3 of its Review Questions, the explanation provided is not quite as specific as I need. I cannot find what I need within the book nor on the Internet. Please could you let me know, for each of the 3 questions below, which specific LGPO option (policy) is configured to achieve these 3 senarios, and its path within the LGPO. I would like to know this to have a better understanding of these scenarios: 1) Question: You are setting up a machine for a home user who does not know much about computers. You do not want to make the user a local administrator but you do want to give this user the right to change Windows Updates manually. How can you configure this? Answer: Modify the LGPO for Windows Update to allow the user to make changes manually. Explanation: You do not want this user to have any administrator rights. To allow this user to change Windows Update manually, you must set this in a LGPO. (Review Questions, Q.2. P.374, P.380.) 2) Question: You have a Windows 7 machine that multiple users access. All users have the rights to use USB removable devices but you need to deny one user from using USB removable devices. How do you accomplish this? Answer: Create a removable storage access policy through an LGPO. Explanation: LGPOs are policies that you can set on a local Windows 7 machine to limit hardware and user usage. You also have the ability to control individual users within the Local Group Policy. (Review Questions: Q.4. P.375, P.380.) 3) Question: Your organization has decided to install a Windows Server Update Service (WSUS). You have a Windows 7 machine that needs to have the updates done from the WSUS server instead of directly from Microsoft’s website. How do you accomplish this? Answer: Modify the Local Group Policy for the Windows Update to receive updates from the WSUS server. Explanation: Within Windows Update, you cannot specify a WSUS server. You need to specify the WSUS server through the use of a Local Group Policy. (Review Questions: Q.9. P.376, P.380.) I hope to hear from you. Regards, Robert339

Hello Leo HuangLijun, Many thanks for your reply. Regarding number 1), am I correct in understanding this as follows: “Let all users install Windows Updates”, and “configure automatic updates” are both configured by an administrator within the “Windows Update” utility. But for: “Allow non-administrators to receive update notifications” this would have to be set at: Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update. In the right pane, open "Allow non-administrators to receive update notifications," and set its property to Enabled. But having made that setting, in Windows 7 when Standard Users want to: Hide/Restore updates, and Cancel an install, the Standard Users will still always see an Account Control window and require elevated permissions, to do either of these tasks. (http://answers.microsoft.com/en-us/windows/forum/windows_other-windows_update/permit-limited-user-to-runinstall-windows-updates/8433dd8f-116b-4f40-b5ba-eba8fe4957a7) Is my understanding (as set out above), correct? Many thanks for also answering 2) and 3). This provides me with the extra detail that I feel the book’s “Explanation” ought really to provide, even though this may not strictly be necessary for the exam. I hope to hear from you. Regards, Robert339

Hi Robert, I have already tested these on my machine, I have tested these Windows Update GPOs one by one, but finally failed to let standard users to modify Windows Update settings. It must be need administration permission. So I suspect that’s impossible to let standard users to change Windows Update settings via GPO. Thank you for your understanding. Regards, Leo Huang Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hello Leo HuangLijun, Many thanks for your reply. Thank you for examining the 1) question, in the exact manner needed. The wording of the 1) question seems only to be capable of being understood as seeking to allow a Standard User to change “Windows Update(s)” settings, by configuring the LGPO. As this is not possible, it leads me to wonder why they would put such a question in the text book; but then not everything is perfect. (This being so, then the link I provided in my previous message about whether it is possible to allow Standard Users to install updates, is not relevant.) With regard to 2) in my original message: I understand that your answer for this would block access for ALL Standard users, whereas the question requires blocking just one user from using USB removable devices, while still allowing the other Standard users access. Please could you advise where this is carried out in the LGPO. Regards, Robert339

Hello Leo HuangLijun, I made a change to my previous message and hope to hear from you about the 2) query . Regards, Robert339

Hello Leo HuangLijun, I refer to your response of August 15, 2011, 2:17 am. I would like to ask if I understand the following correctly. Can an LGPO in fact be used to restrict a special user from using the USB device, within an LGPO which has been Added for a specific user account? (That is, when Adding the LGPO from the "Add or Remove Snap-ins" dialog box, at the "Select Group Policy Object" dialog box, click its "Browse..." button, to add a user at the "Browse for a Group Policy Object": "Users" tab.) This LGPO would be configured as in your previous message with: Local Computer Policy\Computer Configuration\Administrative Templates\System\Removable storage access, enable Removable Disks: Deny execute access, Removable Disks: Deny read access, Removable Disks: Deny write access. However, because this LGPO was added for a specific user account, does it now only apply to that user? Please confirm if this would work to restrict a special user from using the USB device, while not restricting the other users (as indicated in the text book's Review Question 4 - see my first message). Regards, Robert339