Windows Update/NAC FAQs

Details information about troubleshooting why a computer is not performing Windows updates and how that correlates with the NAC.

Table of Contents

• BYOD vs Service Zoe Comparison 
• What is the Service Zone?
• The Computer Says It Is Up-To-Date, so Why Is It Blocked From the Network?
• What if SCCM/Software Center Is Not Working on the Device?
• What if I Need to Update the Device Now and Fix Sccm Later?
• How Do I Check a Windows Device for Its Current Build Number and Manually Install the Update?
• The Device Is Up-To-Date, but Still Being Blocked. Is This BYOD? If So, What Is BYOD?
• A User Brought Their UTD Owned Device From Home to Campus and They Are Not Able to Connect to Comet Net. Also, Comet Net Never Authenticates on Ethernet. Is This a Service Zone or BYOD Issue?

BYOD vs Service Zoe Comparison 

What is the Service Zone?

• A device enters the Service Zone when:
  • A device is two months or more out-of-date
  • Windows Defender is not installed
  • Encryption is not turned on
  • Firewall is not turned on
  • Tenable/Nessus is not installed
• It gets isolated from the Campus Network to where the device will still have access to the internet, but it will not have access to Network Drives or Shares.
• It will be on VLAN 194 and have an IP Address of: XX.XXX.250.XXX
• A device will leave the Service Zone when:
  • It is updated to the current build number.
  • Windows Defender is installed
  • Encryption is turned on
  • Firewall is turned on
  • Tenable/Nessus is turned on

The Computer Says It Is Up-To-Date, so Why Is It Blocked From the Network?

• Cumulative updates are not being managed by Microsoft Online Updates. They are being managed by MECM/SCCM.
• Before January 2025, one could update a device by clicking "Check for updates", "Check online for updates from Microsoft Update", or having SCCM push the update.
• Since we were on an older version of SCCM we could use both methods, but it was not supposed to work that way. When SCCM was updated in January 2025, we had to make the choice of using Microsoft Online Updates or SCCM. SCCM was chosen because it was already integrated into most devices on campus.
• If the device is configured correctly, it will have Software Center installed on the machine and SCCM will push out the monthly cumulative updates as scheduled.

What if SCCM/Software Center Is Not Working on the Device?

• If you suspect that SCCM is not working on a device. First, delete the Registry.pol file which gets created by Group Policy.
  • Here is the path: C:\Windows\System32\GroupPolicy\Machine
  • Special Note: The GroupPolicy folder in this path is a hidden folder, so make sure you can see hidden items.

• Second, you can try clearing the SCCM cache by deleting the contents of this folder: C:\Windows\ccmcache

• Third, you can manually run Configuration Manager actions by going to Control Panel.
  • Change View By from Category to Large or Small Icons

• Click on Configuration Manager

• Click on the Actions tab and run The Application Deployment Evaluation Cycle and Machine Policy Retrieval & Evaluation Cycle actions

• Lastly, If that does not kick off the updates to start in SCCM then the next thing to try is a CCM Repair.
  • Open Command Prompt as an administrator and change the directory to C:\Windows\CCM

• Type ccmrepair.exe and press Enter

• It will take a couple of minutes for it to complete

What if I Need to Update the Device Now and Fix Sccm Later?

• There is a Registry work-around that you can perform which will allow you to momentarily use the "Check online for updates from Microsoft Update" and get the latest cumulative update.
• Open the Registry and go to this path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
  • Then change "SetPolicyDrivenUpdateSourceForQualityUpdates" from a 1 to a 0

• Once the change is made you do not have to restart the computer. Click on "Check online for updates from Microsoft Update" and it should get the latest Cumulative update.

How Do I Check a Windows Device for Its Current Build Number and Manually Install the Update?

• On the device, open command prompt and type: winver

• It will display a window that gives you the internal version number and OS build number.

• There are two Microsoft websites that you can use to check the Windows build you just obtained and see what KB is associated with it.
  • This is for Windows 11: https://support.microsoft.com/en-us/topic/windows-11-version-23h2-update-history-59875222-b990-4bd9-932f-91a5954de434
  • This is for Windows 10: https://support.microsoft.com/en-us/topic/january-9-2024-kb5034122-os-builds-19044-3930-and-19045-3930-7656c6a4-0b06-4424-86a9-d0719f4ac252
• Once on the site, you can see the version and KB

• Then go to the Microsoft Catalog website: https://www.catalog.update.microsoft.com/Home.aspx
  • Copy and paste the KB into the search field

• Find the correct version of the KB and click on the Download button and not on the hyper link.
• Click on the link and it will start to download.

• On Windows 11 machines you may need to do the Registry work-around before running the update manually.

The Device Is Up-To-Date, but Still Being Blocked. Is This BYOD? If So, What Is BYOD?

• BYOD stands Bring Your Own Device, but its function is to isolate non UTD devices to internet only through authentication by a captive portal.
• A UTD owned device can be placed into BYOD if it does not have the secure connector agent installed.
  • Here is the link to install the secure connector agent: https://fsphymgmt.utdallas.edu/sc.jsp
• If a device is in BYOD, it will be on VLAN 197 and have the IP Address of: XX.XXX.252-253.XXX
• If the device is up-to-date and has the secure connector installed, but is still in BYOD. Try uninstalling and reinstalling the secure connector agent.
  • If that does not work then please reach out to TEI Desktop Engineering to have the device manually moved off of BYOD.

A User Brought Their UTD Owned Device From Home to Campus and They Are Not Able to Connect to Comet Net. Also, Comet Net Never Authenticates on Ethernet. Is This a Service Zone or BYOD Issue?

• When a user works remotely for an extended period and their UTD owned device is not consistently connected to the VPN. It can cause the device to lose connection with the UTD Campus domain. When this occurs, a user can continually miss cumulative Windows updates.
• A way that you can tell this happened is when a user types in an old password to sign into their UTD owned device and enters a new password to access other UTD resources online.
• If they bring their UTD owned device in this broken state an attempt to connect to the wired network, that device will be placed into the Service Zone since it is missing cumulative updates.
• A solution that we recommend is for the user to connect to the VPN if they are going to working from home periodically. Connecting to the VPN will allow SCCM to pass the correct cumulative updates to the device.