SOLVED Group policy settings were overwritten by a higher authority

[Vikrant Verma]

Failed to Add Update Source for WUAgent of type (2) and id ({2D7E4434-E9B1-4F80-9B0B-856BAC134685}). Error = 0x87d00692.

 

[Vikrant Verma]

I have few devices which are failing to get the Windows update from SCCM. WUAhandler shows the error like

Unable to read existing WUA resultant policy. Error = 0x80070002.
Group policy settings were overwritten by a higher authority (Domain Controller) to: Server and Policy NOT CONFIGURED
Failed to Add Update Source for WUAgent of type (2) and id ({2D7E4434-E9B1-4F80-9B0B-856BAC134685}). Error = 0x87d00692.
Its a WSUS Update Source type ({2D7E4434-E9B1-4F80-9B0B-856BAC134685}), adding it.

 

[Youssef Saad]

Hi Vikrant Verma,

Try the following:

1. Stop SMS Agent Host service.
2. Rename the registry.pol file located in C:\Windows\System32\GroupPolicy\Machine to registry.pol.old
3. Start SMS Agent Host service.
4. From the Control Panel > Configuration Manager, Actions, run the Software Updates Scan Cycle, then monitor WUAhandler.log.

 

[Vikrant Verma]

Hello , i have already tried tht but this is not fixing the issue. Moreover i have checked CIdownloader.log and able to see the below error:

CCIDownloader:arseDtsMessage - Dts failed with error code: 0x80070002. CI Downloader will retry.
CIDownloaderJob({260300D8-A3A3-4565-BB7A-F40C9DA8F4AE}): Received Dts failure message during CI download.

 

[Youssef Saad]

Do you have any GPO set to configure Windows Update source location?

 

[Vikrant Verma]

No, it is setup by SCCM client as local policies.

 

[Youssef Saad]

Can we try this time removing C:\windows\system32\grouppolicy\gpt.ini file and re-run the software update scan cycle?

 

[Vikrant Verma]

this has already been done but it is still the same. the exciting part is , this is happening to devices with Windows 11 Randomly. Windows 10 devices dont have any issue.

While we have same Client setting, similar gpo setting applied.

 

[Garth]

What exactly does gpresult show? Have you reviewed the reg setting for WU?

 

[Vikrant Verma]

Hello @Garth , Yes i have revied the gpresult there is not setting for WU. all the setting for WU is getting set by SCCM client and marked as local policies in GPedit.msc.

Could you please what would be the setting for delivery optimization. As we have a gpo to se it to below. We are expecting that it might have some impact on Windows 11 Devices.

Our SCCM is on version 2303 and setting for Delta Download is configured as "No" under SCCM client settings.
Another exciting things, the registry entry "UpdateServiceUrlAlternate" under "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" is disappearing for few machines time to time and comes back automatically.

 

[Garth]

Try this guide to see if it helps.

Troubleshooting Clients with Unknown Update State in Configuration Manager (SCCM)

patchmypc.com

 

[Vikrant Verma]

Hello @Garth

The Policies for "Specify intranet Microsoft update service location" is setup by SCCM client. PFA.

 

[vitorpds]

Hello @Vikrant Verma

Were you able to fix this issue? I'm currently experiencing the same "Settings overwritten by a higher authority" error on a DMZ server.