Computer staged from a SysPrepped image doesn't receive WSUS updates

Applies to: Windows 10, version 1607Windows 10, version 1511Windows Server 2016

Symptoms


When a SysPrepped image from Windows 10 1511, Windows 10 1607, or Windows Server 2016 is used to stage a new computer, the new computer doesn't receive updates from WSUS.

Cause


During the SysPrep /generalize process, SysPrep can't delete the following registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate 

This occurs because SysPrep doesn't have permissions to the following key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\InstallAtShutdown 

Therefore, the operation fails silently.

Resolution


This issue is fixed in the following hotfix rollup of Windows 10 and Windows Server 2016:

Workaround


To work around this issue, follow these steps on the newly staged system:

  1. If it's running, stop the Update Orchestrator Service for Windows Update (UsoSvc) service.
  2. If it's running, stop the Windows Update (wuauserv) service.
  3. Take ownership of the following registry key, and then grant Administrators Full Control:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\InstallAtShutdown
  4. Delete the following registry key:
     
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
  5. Start the Windows Update service.

More Information


An update is planned to address this issue, but it will only resolve the issue for newly SysPrepped images that already have the update applied. If a master image has been created that was affected by this issue, any systems that are staged from this image must have the steps in the "Resolution" section applied.