openkey [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
set "WUServer"="http://mse-sus1.mse-berg.int"
set "WUStatusServer"="http://mse-sus1.mse-berg.int"
set "ElevateNonAdmins"=reg_dword:00000001
set "TargetGroupEnabled"=reg_dword:00000000

openkey [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
set "NoAUShutdownOption"=reg_dword:00000000
set "NoAUAsDefaultShutdownOption"=reg_dword:00000000
set "AUPowerManagement"=reg_dword:00000000
set "NoAutoUpdate"=reg_dword:00000000
set "AUOptions"=reg_dword:00000003
set "ScheduledInstallDay"=reg_dword:00000000
set "ScheduledInstallTime"=reg_dword:10
set "UseWUServer"=reg_dword:00000001
set "DetectionFrequencyEnabled"=reg_dword:00000001
set "DetectionFrequency"=reg_dword:00000001
set "EnableFeaturedSoftware"=reg_dword:00000000
set "AutoInstallMinorUpdates"=reg_dword:00000000
set "IncludeRecommendedUpdates"=reg_dword:00000001
set "NoAutoRebootWithLoggedOnUsers"=reg_dword:00000001
set "RebootRelaunchTimeoutEnabled"=reg_dword:00000000
set "RebootWarningTimeoutEnabled"=reg_dword:00000001
set "RebootWarningTimeout"=reg_dword:30
set "RescheduleWaitTimeEnabled"=reg_dword:00000001
set "RescheduleWaitTime"=reg_dword:00000001
 

2011-02-23	10:30:25:861	1120	e94	Agent	  * Found 45 updates and 62 categories in search; evaluated appl. rules of 1003 out of 1536 deployed entities
2011-02-23	10:30:25:869	1120	e94	Agent	*********
2011-02-23	10:30:25:869	1120	e94	Agent	**  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2011-02-23	10:30:25:869	1120	e94	Agent	*************
2011-02-23	10:30:25:875	1120	e94	Report	REPORT EVENT: {A85BD02E-C788-4631-8F4D-923274310484}	2011-02-23 10:30:25:862+0100	1	147	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Software Synchronization	Windows Update Client successfully detected 45 updates.
2011-02-23	10:30:25:875	1120	e94	Report	REPORT EVENT: {00F76700-1D06-4E92-9BFD-AF5520DC8F90}	2011-02-23 10:30:25:863+0100	1	156	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Pre-Deployment Check	Reporting client status.
2011-02-23	10:30:25:875	1120	1ec0	AU	>>##  RESUMED  ## AU: Search for updates [CallId = {948BA8D4-4B61-409B-BEB7-3A6FC3F3FCC2}]
2011-02-23	10:30:25:875	1120	1ec0	AU	  # 45 updates detected
2011-02-23	10:30:25:876	1120	e94	Report	CWERReporter finishing event handling. (00000000)
2011-02-23	10:30:25:876	1120	e94	Report	CWERReporter finishing event handling. (00000000)
2011-02-23	10:30:25:877	1120	e94	Report	CWERReporter finishing event handling. (00000000)
2011-02-23	10:30:25:877	1120	e94	Report	CWERReporter finishing event handling. (00000000)
2011-02-23	10:30:25:878	1120	1ec0	AU	#########
2011-02-23	10:30:25:878	1120	1ec0	AU	##  END  ##  AU: Search for updates [CallId = {948BA8D4-4B61-409B-BEB7-3A6FC3F3FCC2}]
2011-02-23	10:30:25:878	1120	1ec0	AU	#############
2011-02-23	10:30:25:878	1120	1ec0	AU	Successfully wrote event for AU health state:0
2011-02-23	10:30:25:878	1120	1ec0	AU	Featured notifications is disabled.
2011-02-23	10:30:25:878	1120	1ec0	AU	AU setting next detection timeout to 2011-02-23 10:28:54
2011-02-23	10:30:25:879	1120	1ec0	AU	Successfully wrote event for AU health state:0
2011-02-23	10:30:25:881	1120	1ec0	AU	Successfully wrote event for AU health state:0
2011-02-23	10:30:25:881	1120	e94	Report	CWERReporter finishing event handling. (00000000)
2011-02-23	10:38:43:996	1120	e94	Report	Uploading 2 events using cached cookie, reporting URL = http://mse-sus1.mse-berg.int/ReportingWebService/ReportingWebService.asmx
2011-02-23	10:38:44:014	1120	e94	Report	Reporter successfully uploaded 2 events.
2011-02-23	10:51:46:613	1120	12e8	AU	Windows Update is disabled by policy for user
2011-02-23	10:51:46:613	1120	12e8	AU	WARNING: AU found no suitable session to launch client in
 

2011-03-11	14:00:03:771	 920	e3c	AU	>>##  RESUMED  ## AU: Search for updates [CallId = {5DDF4353-5000-4622-8CBF-CC3B6A711EE5}]
2011-03-11	14:00:03:771	 920	e3c	AU	  # 70 updates detected
2011-03-11	14:00:03:771	 920	e3c	AU	#########
2011-03-11	14:00:03:771	 920	e3c	AU	##  END  ##  AU: Search for updates [CallId = {5DDF4353-5000-4622-8CBF-CC3B6A711EE5}]
2011-03-11	14:00:03:771	 920	e3c	AU	#############
2011-03-11	14:00:03:771	 920	e3c	AU	Successfully wrote event for AU health state:0
2011-03-11	14:00:03:771	 920	e3c	AU	Featured notifications is disabled.
2011-03-11	14:00:03:771	 920	e3c	AU	AU setting next detection timeout to 2011-03-11 13:57:42
2011-03-11	14:00:03:771	 920	e3c	AU	Successfully wrote event for AU health state:0
2011-03-11	14:00:03:771	 920	e3c	AU	Successfully wrote event for AU health state:0
2011-03-11	14:00:03:818	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	REPORT EVENT: {C81E594C-FF78-41FC-925A-78B98C578DAC}	2011-03-11 14:00:03:756+0100	1	147	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Software Synchronization	Windows Update Client successfully detected 70 updates.
2011-03-11	14:00:03:834	 920	d7c	Report	REPORT EVENT: {07F03E77-9C06-49B1-9035-24CBC832DA12}	2011-03-11 14:00:03:756+0100	1	156	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Pre-Deployment Check	Reporting client status.
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:03:834	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:00:08:779	 920	c38	AU	Windows Update is disabled by policy for user
2011-03-11	14:00:08:779	 920	c38	AU	WARNING: AU found no suitable session to launch client in
2011-03-11	14:00:08:779	 920	d7c	Report	CWERReporter finishing event handling. (00000000)
2011-03-11	14:05:02:150	 920	c38	AU	AU received policy change subscription event
2011-03-11	14:05:29:123	 920	c38	AU	AU received policy change subscription event
2011-03-11	14:05:51:984	 920	c38	Shutdwn	user approved update at shutdown
2011-03-11	14:05:51:984	 920	c38	AU	Windows Update is disabled by policy for user
2011-03-11	14:05:51:984	 920	c38	Shutdwn	WARNING: InstallAtShutdown failed to get updates to install with error 0x80240025.
2011-03-11	14:05:51:984	 920	c38	AU	AU initiates service shutdown