Windows Update/NAC FAQs

windows-update NAC

BYOD vs Service Zoe Comparison

A device enters the Service Zone when:
- A device is two months or more out-of-date
- Windows Defender is not installed
- Encryption is not turned on
- Firewall is not turned on
- Tenable/Nessus is not installed
It gets isolated from the Campus Network to where the device will still have access to the internet, but it will not have access to Network Drives or Shares.
It will be on VLAN 194 and have an IP Address of: XX.XXX.250.XXX
A device will leave the Service Zone when:
- It is updated to the current build number.
- Windows Defender is installed
- Encryption is turned on
- Firewall is turned on
- Tenable/Nessus is turned on

Cumulative updates are not being managed by Microsoft Online Updates. They are being managed by MECM/SCCM.
Before January 2025, one could update a device by clicking "Check for updates", "Check online for updates from Microsoft Update", or having SCCM push the update.
Since we were on an older version of SCCM we could use both methods, but it was not supposed to work that way. When SCCM was updated in January 2025, we had to make the choice of using Microsoft Online Updates or SCCM. SCCM was chosen because it was already integrated into most devices on campus.
If the device is configured correctly, it will have Software Center installed on the machine and SCCM will push out the monthly cumulative updates as scheduled.

If you suspect that SCCM is not working on a device. First, delete the Registry.pol file which gets created by Group Policy.
- Here is the path: C:\Windows\System32\GroupPolicy\Machine
- Special Note: The GroupPolicy folder in this path is a hidden folder, so make sure you can see hidden items.

Second, you can try clearing the SCCM cache by deleting the contents of this folder: C:\Windows\ccmcache

Third, you can manually run Configuration Manager actions by going to Control Panel.
- Change View By from Category to Large or Small Icons

Click on the Actions tab and run The Application Deployment Evaluation Cycle and Machine Policy Retrieval & Evaluation Cycle actions

Lastly, If that does not kick off the updates to start in SCCM then the next thing to try is a CCM Repair.
- Open Command Prompt as an administrator and change the directory to C:\Windows\CCM

There is a Registry work-around that you can perform which will allow you to momentarily use the "Check online for updates from Microsoft Update" and get the latest cumulative update.
Open the Registry and go to this path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
- Then change "SetPolicyDrivenUpdateSourceForQualityUpdates" from a 1 to a 0

Once the change is made you do not have to restart the computer. Click on "Check online for updates from Microsoft Update" and it should get the latest Cumulative update.

It will display a window that gives you the internal version number and OS build number.

Then go to the Microsoft Catalog website: https://www.catalog.update.microsoft.com/Home.aspx
- Copy and paste the KB into the search field

Find the correct version of the KB and click on the Download button and not on the hyper link.
Click on the link and it will start to download.

On Windows 11 machines you may need to do the Registry work-around before running the update manually.

BYOD stands Bring Your Own Device, but its function is to isolate non UTD devices to internet only through authentication by a captive portal.
A UTD owned device can be placed into BYOD if it does not have the secure connector agent installed.
- Here is the link to install the secure connector agent: https://fsphymgmt.utdallas.edu/sc.jsp
If a device is in BYOD, it will be on VLAN 197 and have the IP Address of: XX.XXX.252-253.XXX
If the device is up-to-date and has the secure connector installed, but is still in BYOD. Try uninstalling and reinstalling the secure connector agent.
- If that does not work then please reach out to TEI Desktop Engineering to have the device manually moved off of BYOD.

When a user works remotely for an extended period and their UTD owned device is not consistently connected to the VPN. It can cause the device to lose connection with the UTD Campus domain. When this occurs, a user can continually miss cumulative Windows updates.
A way that you can tell this happened is when a user types in an old password to sign into their UTD owned device and enters a new password to access other UTD resources online.
If they bring their UTD owned device in this broken state an attempt to connect to the wired network, that device will be placed into the Service Zone since it is missing cumulative updates.
A solution that we recommend is for the user to connect to the VPN if they are going to working from home periodically. Connecting to the VPN will allow SCCM to pass the correct cumulative updates to the device.

0 reviews

Print Article