Every day at about the same time, several of my servers appear to start running a scan for Windows updates, and it appears that the source is from SolarWinds. A number of these servers are single proc boxes, and the WU scan pegs the processor at 100%. We manage our server updates via Shavlik, and the scans were not coinciding with our regular weekly schedule.
As I dug into this phenomenon, I could see with Sysinternals' Procmon that the scans were being triggered by SolarWinds, using the WMI account that we had configured for scanning and such. Using cscript.exe, it kicks off the chain of processes to create "GetPendingUpdates.vbs" in the WMI user's temp folder, and starts the scan.
We did not purchase or install Solarwinds' Patch Manager, and as I said, we use Shavlik for server updates. I looked in the SolarWinds logs, and am not seeing what is kicking this off. I am trying to look through the application monitors, as well as the pollers, and cannot figure out how to control this scan better. I am assuming this is coming from the SAM, but I am at a loss any further.
thanks