Okay, I made one change and it got rid of all but one of those. I enabled the GP Do not connect to any Windows Update Internet locations.
Here is what I cannot figure out. In GP where is hows all the settings for a group policy, at the very end it says…
Extra Registry Settings
Software\Policies\Microsoft\Windows\WindowsUpdate\DeferUpgrade 0
So the DeferUpgrade is still showing in regedit. I cannot figure out why the above setting is there or how to get rid of it.
I just went in and remade the WSUS GP and it got rid of that “Extra Registry Setting”. Will have to wait and see if this now works as it used to.
Is there some way to look at some log to see where a computer is checking for updates?
I haven’t tried this, so I can’t provide any experience, but here is an article on viewing update logs: https://support.microsoft.com/en-us/help/3036646/how-to-read-windows-update-logs-in-windows-10-version-1607
Also, here is a little more detailed blog on the WUfB settings impact. In there it speaks some about the logs. https://blogs.technet.microsoft.com/windowsserver/2017/01/09/why-wsus-and-sccm-managed-clients-are-reaching-out-to-microsoft-online/
You know, just when I think everything is working like I want it…
Just noticed clients all show that it has been 6 DAYS since they checked for updates. Makes no sense since I have Automatic Updates detection frequency set to 4 hours.
This all use to be so simple.