Windows Updates - Install and prompt for restart - Local Admin users

[Thomas]

Hi All

I am using WSUS 3.0SP1 to push updates to my clients.
Lately, I have received quite alot of complains from the users that all the
approved updates are being installed when they shut down their laptop. This
installation might take some time and if the user is in a hurry, it is
annoying to wait for the patches to install before they can pack up their pc
and go.

Is it possible to have approved updates being installed once they reach the
pc (usually in the morning when the user starts up/logs in to their pc)
rather than during shutdown, but without automatic restart? A lot of my
users are local Admin on their laptops.

My group policy is configured with the following options:
Automatic Update: 4- Auto download and schedule the install
Schedule install day: 0 - Every day
Schedule intall time: 03:00
No auto-restart with logged on users: Enabled

Thanks a lot.

/Thomas

[Harry Johnston [MVP]]

Thomas wrote:

> I am using WSUS 3.0SP1 to push updates to my clients.
> Lately, I have received quite alot of complains from the users that all the
> approved updates are being installed when they shut down their laptop.

This is optional. When they shut down the computer they just have to choose
"Shut down without updating" (or something to that effect).

You can also disable this in Windows Update group policy, or change it so that
it is not the default option.

Harry.

[Thomas]

Hi Harry

Well, the thing is that of course I want the updates to be installed to
everybody's machines. I was just hoping it was possible to have them
automatically installed as soon as the updates where ready for installation,
not that they would wait for installation until the user shuts down their
pc.
A similar behavior to that occuring if a user is not logged in or a
non-administrator is logged in.

/Thomas

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message
news:O1bs4GZz...@TK2MSFTNGP04.phx.gbl...

[Harry Johnston [MVP]]

Thomas wrote:

> Well, the thing is that of course I want the updates to be installed to
> everybody's machines. I was just hoping it was possible to have them
> automatically installed as soon as the updates where ready for installation,
> not that they would wait for installation until the user shuts down their
> pc.
> A similar behavior to that occuring if a user is not logged in or a
> non-administrator is logged in.

The installation behaviour is essentially the same whether a user is logged in
or not, and whether or not the logged on user is an administrator. The updates
will be installed at the time specified in the group policy, 3am in this case.

You could change the install time to, say, 3pm, and approve the updates in the
evening after everyone has already shut down. Or you could approve them first
thing in the morning if you shorten the detection interval accordingly.

Or you could disable the "install and shut down" option or make it non-default,
in which case the install will occur at 3am if the machine was left on, or the
next time it is turned on if it was off at 3am.

Harry.

[Thomas]

So do I understand you correct if I shorten the detection interval to, let's
say 6 hours or shorter, I should be able to have the clients both download
and install the updates during the day and should not be prompted to install
during shutdown?

I have about 150 clients reporting in to two different servers. I assume
that even if I shorten the detection interval to 6 hours or so, it should
not impact a lot on these two server's performance?

/Thomas

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message

news:%23K$AnI1zI...@TK2MSFTNGP06.phx.gbl...

[Hank Arnold (MVP)]

Why not just set a deadline of yesterday for the updates? That will
force an update as soon as they log on....

--

Regards,
Hank Arnold
Microsoft MVP

[Harry Johnston [MVP]]

Hank Arnold (MVP) wrote:

> Why not just set a deadline of yesterday for the updates? That will
> force an update as soon as they log on....

It will also force a reboot (regardless of any other settings) which is
undesirable in this (and IMO most) scenarios.

Harry.

[Harry Johnston [MVP]]

Thomas wrote:

> So do I understand you correct if I shorten the detection interval to, let's
> say 6 hours or shorter, I should be able to have the clients both download
> and install the updates during the day and should not be prompted to install
> during shutdown?

Provided there's at least 6 hours, plus enough time for the downloads to
complete, between when you approve the updates and when the user chooses to shut
down, yes. (I wouldn't try distributing service packs this way!)

You might want to approve the updates to a dummy group ahead of time, so that
the download to the WSUS server is already done. You'll still need to allow for
the download to the clients.

> I have about 150 clients reporting in to two different servers. I assume
> that even if I shorten the detection interval to 6 hours or so, it should
> not impact a lot on these two server's performance?

Check the deployment guide for load guidelines, remembering that they are based
on a 24 hour detection cycle and load increases in inverse proportion to the
detection cycle length. Or you could look at the existing load to make sure you
don't have a problem with it quadrupling.

If these servers aren't doing anything else, you certainly won't have a problem
unless they're very very old. :-)

Let me reiterate that given the criteria you've specified, the best solution
would be to use group policy to change the default shutdown option to shut down
without installing updates. The updates will still install automatically the
following day.

Harry.

[Thomas]

Hi Harry

This is great feedback.
After doing some more reading and considering your feedback, I absolutely
agree that I should disable "Install on shutdown" in GPO.
Looking at the deployment guide regarding HW specifications, I should have
plenty of power for my 150 clients. My two servers are not doing much
besides WSUS.
I configured detect frequency to be 6 hours so we'll see if this is loading
my servers too much, but I doubt it very much.

Thanks again Harry.

/Thomas

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message

news:uTIySz%23zIH...@TK2MSFTNGP04.phx.gbl...