SCCM Patching: Error in WUAHandler.log: Group policy settings were overwritten by a higher authority

The symptom is that in C:\Windows\CCM\Logs\WUAHandler.log entries similar to the following are recorded when executing a “Software Updates Scan Cycle” form the Control Panel Configuration Manager Actions pane:

 

Unable to read existing WUA resultant policy. Error = 0x80070002.           WUAHandler     10/26/2017 4:45:09 PM 4752 (0x1290)

Group policy settings were overwritten by a higher authority (Domain Controller) to: Server  and Policy NOT CONFIGURED   WUAHandler     10/26/2017 4:45:09 PM 4752 (0x1290)

Failed to Add Update Source for WUAgent of type (2) and id ({63744FD0-7F66-4324-BD04-3E601F50387B}). Error = 0x87d00692.      WUAHandler     10/26/2017 4:45:09 PM 4752 (0x1290)

 

The Cause

A Domain policy was found to contain a corrupted entry which can only be found using PowerShell.

The GPO Management GUI does not display any entries for Windows Updates, however there was a single legacy stub entry.

 

PS C:\Windows\system32> Get-GPRegistryValue -Name "POLICYName" -Key "HKLM\software\Policies\Microsoft\Windows\WindowsUpdate\AU"

KeyPath     : software\Policies\Microsoft\Windows\WindowsUpdate\AU

FullKeyPath : HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate\AU

Hive        : LocalMachine

PolicyState : Delete

Value       :

Type        : Unknown

ValueName   :

HasValue    : False

 

The Solution

Is that this entry can be removed, again using PowerShell using the command:

PS C:\Windows\system32> Remove-GPRegistryValue -Name "POLICYName" -Key "HKLM\software\Policies\Microsoft\Windows\WindowsUpdate\AU"

 The correct end goal is that there should be no WSUS setting applied in any domain GPO for SCCM to work.