How do I make Windows/Microsoft Update really honestly automatic?

I have a very small business with three pcs running Windows 2000 and XP
Home and a home with five pcs running XP Pro and XP Home. The work pcs
run 24 hours but the home pcs run only when needed. They are all
connected to reliable broadband. I use a hardware firewall only. Virus
checker is Etrust Antivirus. I have no server version of Windows nor any
budget for this. My users cannot be trusted to have admin rights nor to
reliably update anything. Just lately I seem to be spending my life
running round from pc to pc checking and running updates - the pc shuffle.

The problem is that no setting of Windows or Microsoft Update seems to
work without some sort of user intervention. I have set them all to
"Automatic recommended" settings but no dice. I understand the updates
come out on a "Tuesday" (whenever wherever) but by Friday midday
(Australia Eastern) none of the PCs has upgraded. The pcs run as users
and when I log in as admin I find that the upgrades have not been
completed. Sometimes I see they have been downloaded but won't install
until the user chooses an install upgrade and reboot option. Sometimes
nothing has been done at all. In each case Start/Microsoft Update runs
fine and completes the updates perfectly - just as long as I am there
clicking away. So round the circuit of all eight pcs I go again.

My questions:

1. Exactly what date and time and time zone do the updates appear on
"Tuesday"? If I am to do the pc shuffle I would like to know just when
to start.

2. Is there a foolproof way to set Windows 2000 and XP to guarantee that
the updates will download and install and reboot if necessary without
any user intervention at all and preferably email me to say it has been
done?

3. Will we ever see a version of Windows that can install stuff without
having to reboot?


A

Anon wrote:
> I have a very small business with three pcs running Windows 2000 and
> XP Home and a home with five pcs running XP Pro and XP Home. The work
> pcs run 24 hours but the home pcs run only when needed. They are all
> connected to reliable broadband. I use a hardware firewall only. Virus
> checker is Etrust Antivirus. I have no server version of Windows nor
> any budget for this. My users cannot be trusted to have admin rights
> nor to reliably update anything. Just lately I seem to be spending my
> life running round from pc to pc checking and running updates - the
> pc shuffle.
> The problem is that no setting of Windows or Microsoft Update seems to
> work without some sort of user intervention. I have set them all to
> "Automatic recommended" settings but no dice. I understand the updates
> come out on a "Tuesday" (whenever wherever) but by Friday midday
> (Australia Eastern) none of the PCs has upgraded. The pcs run as users
> and when I log in as admin I find that the upgrades have not been
> completed. Sometimes I see they have been downloaded but won't install
> until the user chooses an install upgrade and reboot option. Sometimes
> nothing has been done at all. In each case Start/Microsoft Update runs
> fine and completes the updates perfectly - just as long as I am there
> clicking away. So round the circuit of all eight pcs I go again.

If the users are not admins and you choose the "Automatically download and
install" - then the only choice they should get is to reboot.

> My questions:
>
> 1. Exactly what date and time and time zone do the updates appear on
> "Tuesday"? If I am to do the pc shuffle I would like to know just when
> to start.

Do the updates Daily. Do them at 4PM.

> 2. Is there a foolproof way to set Windows 2000 and XP to guarantee
> that the updates will download and install and reboot if necessary
> without any user intervention at all and preferably email me to say it
> has
> been done?

See above for XP - I think with 2000 - well, upgrade.

> 3. Will we ever see a version of Windows that can install stuff
> without having to reboot?

No.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Shenan Stanley wrote:

Snip

> If the users are not admins and you choose the "Automatically download and
> install" - then the only choice they should get is to reboot.

Thanks for your reply Shenan.

In fact they get other choices such as logoff which is what they
normally do at work so the computers run logged off overnight for
backups etc. So my users are not forced to reboot, don't notice the
option to do so and the update doesn't happen.

I really don't want to rely on my users to make the update happen. Can I
force an immediate reboot after the update somehow?

>
>
>>My questions:
>>
>>1. Exactly what date and time and time zone do the updates appear on
>>"Tuesday"? If I am to do the pc shuffle I would like to know just when
>>to start.

Does anyone know the answer to this?

>
>
> Do the updates Daily. Do them at 4PM.

Why is this better than the recommended 3AM?

Would it force a reboot at 4 PM local time? If so my users and their
clients would be very very unhappy.

And do you mean 4PM Redmond USA time or 4PM local time?

>
>
>>2. Is there a foolproof way to set Windows 2000 and XP to guarantee
>>that the updates will download and install and reboot if necessary
>>without any user intervention at all and preferably email me to say it
>>has
>>been done?
>
>
> See above for XP - I think with 2000 - well, upgrade.

Can't because my application's database is not happy with XP and the
vendor does not want to upgrade so I'm stuck. In this case regarding
updates XP is no better alas.

>
>
>>3. Will we ever see a version of Windows that can install stuff
>>without having to reboot?
>
>
> No.
>

Pity.

Anon wrote:
> I have a very small business with three pcs running Windows 2000 and XP
> Home and a home with five pcs running XP Pro and XP Home. The work pcs
> run 24 hours but the home pcs run only when needed. They are all
> connected to reliable broadband. I use a hardware firewall only. Virus
> checker is Etrust Antivirus. I have no server version of Windows nor any
> budget for this. My users cannot be trusted to have admin rights nor to
> reliably update anything. Just lately I seem to be spending my life
> running round from pc to pc checking and running updates - the pc shuffle.
>
> The problem is that no setting of Windows or Microsoft Update seems to
> work without some sort of user intervention. I have set them all to
> "Automatic recommended" settings but no dice. I understand the updates
> come out on a "Tuesday" (whenever wherever) but by Friday midday
> (Australia Eastern) none of the PCs has upgraded. The pcs run as users
> and when I log in as admin I find that the upgrades have not been
> completed. Sometimes I see they have been downloaded but won't install
> until the user chooses an install upgrade and reboot option. Sometimes
> nothing has been done at all. In each case Start/Microsoft Update runs
> fine and completes the updates perfectly - just as long as I am there
> clicking away. So round the circuit of all eight pcs I go again.
>
> My questions:
>
> 1. Exactly what date and time and time zone do the updates
> appear on "Tuesday"? If I am to do the pc shuffle I would like
> to know just when to start.

About 10 AM Redmond USA time, but note that if needed, Microsoft will
release security updates outside the second Tuesday every month, so
you should configure the computers to download and install every day
(at a time that suits you and the users)


> 2. Is there a foolproof way to set Windows 2000 and XP to
> guarantee that the updates will download and install and reboot
> if necessary without any user intervention at all and preferably
> email me to say it has been done?

You will need to set the correct settings for this to happen (not
including the e-mail part as there is nothing built-in that can make
that happen automatically).

1.
How do you configure the settings now? Are you using Control
Panel --> Automatic Updates?

2.
On one of the computers that doesn't behave as you thought it should,
could you please export to a file the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU
and post the content of the file here?


> 3. Will we ever see a version of Windows that can install stuff
> without having to reboot?

Microsoft is working on some technology that will reduce the need for
reboots in many cases, and hopefully we will at least see some
improvements in Vista (Longhorn).



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Given the current state of Microsoft affairs the only workable solution for
you is to pay someone a low wage to do the client pc sitting jobs for you,
then send you and email to confirm completion.

Given the current state of update issues your lucky to get the site working
in the first place.

perhaps you could employ burn't out programmers from the Redmond area as i
understand they require only a dribble towel and monkey nuts.

"Anon" wrote:

> Shenan Stanley wrote:
>
> Snip
>
> > If the users are not admins and you choose the "Automatically download and
> > install" - then the only choice they should get is to reboot.
>
> Thanks for your reply Shenan.
>
> In fact they get other choices such as logoff which is what they
> normally do at work so the computers run logged off overnight for
> backups etc. So my users are not forced to reboot, don't notice the
> option to do so and the update doesn't happen.
>
> I really don't want to rely on my users to make the update happen. Can I
> force an immediate reboot after the update somehow?
>
> >
> >
> >>My questions:
> >>
> >>1. Exactly what date and time and time zone do the updates appear on
> >>"Tuesday"? If I am to do the pc shuffle I would like to know just when
> >>to start.
>
> Does anyone know the answer to this?
>
> >
> >
> > Do the updates Daily. Do them at 4PM.
>
> Why is this better than the recommended 3AM?
>
> Would it force a reboot at 4 PM local time? If so my users and their
> clients would be very very unhappy.
>
> And do you mean 4PM Redmond USA time or 4PM local time?
>
> >
> >
> >>2. Is there a foolproof way to set Windows 2000 and XP to guarantee
> >>that the updates will download and install and reboot if necessary
> >>without any user intervention at all and preferably email me to say it
> >>has
> >>been done?
> >
> >
> > See above for XP - I think with 2000 - well, upgrade.
>
> Can't because my application's database is not happy with XP and the
> vendor does not want to upgrade so I'm stuck. In this case regarding
> updates XP is no better alas.
>
> >
> >
> >>3. Will we ever see a version of Windows that can install stuff
> >>without having to reboot?
> >
> >
> > No.
> >
>
> Pity.
>
>
>
>

Torgeir Bakken (MVP) wrote:

Snip

>
>
> About 10 AM Redmond USA time, but note that if needed, Microsoft will
> release security updates outside the second Tuesday every month, so
> you should configure the computers to download and install every day
> (at a time that suits you and the users)

Thanks for your help Torgeir

Snip

> You will need to set the correct settings for this to happen (not
> including the e-mail part as there is nothing built-in that can make
> that happen automatically).
>
> 1.
> How do you configure the settings now? Are you using Control
> Panel --> Automatic Updates?

Yes, while logged in as administrator

>
> 2.
> On one of the computers that doesn't behave as you thought it should,
> could you please export to a file the registry key
> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU
> and post the content of the file here?

I have looked for this key and it is not there -
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows has no
\windowsupdate at all. I searched for windowsupdate and no dice either.

Does it matter that I have upgraded to Microsoft Update?

Could we find the information using the policy snapin thingie?

>
>
>> 3. Will we ever see a version of Windows that can install stuff
>> without having to reboot?
>
>
> Microsoft is working on some technology that will reduce the need for
> reboots in many cases, and hopefully we will at least see some
> improvements in Vista (Longhorn).
>
>
>

I hope so.

Anon wrote:

> Torgeir Bakken (MVP) wrote:
>
>> (snip)
>> 1.
>> How do you configure the settings now? Are you using Control
>> Panel --> Automatic Updates?
>
> Yes, while logged in as administrator
>
>>
>> 2.
>> On one of the computers that doesn't behave as you thought it should,
>> could you please export to a file the registry key
>> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU
>> and post the content of the file here?
>
>
> I have looked for this key and it is not there -
> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows has no
> \windowsupdate at all. I searched for windowsupdate and no dice either.
>
> Does it matter that I have upgraded to Microsoft Update?
>
> Could we find the information using the policy snapin thingie?
Hi,

Lets try this:

To be sure to have the latest Windows Update Agent installed, run
WindowsUpdateAgent20-x86.exe (use a user account that have local
admin rights).

Download location for WindowsUpdateAgent20-x86.exe
http://go.microsoft.com/fwlink/?LinkId=43264


Then put the following text in a registry file (.reg) and import it
by double-clicking on it in Explorer.

--------------------8<----------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000003
"RescheduleWaitTimeEnabled"=dword:00000001
"RescheduleWaitTime"=dword:00000001
"NoAutoUpdate"=dword:00000000
"NoAutoRebootWithLoggedOnUsers"=dword:00000000

--------------------8<----------------------
(be sure to have a blank line at the end of the registry file)

Then reboot.


The registry file above will configure Automatic Updates (AU) to
install updates automatically at 3 AM (or if the computer was not
running at 3 AM, 1 minute after next computer startup).

If an installation needs a reboot, AU will notify the user that the
computer will automatically restart in 5 minutes to complete the
installation, with no option to postpone the reboot.

If you on a computer still experience that it doesn't install updates
automatically, there is something wrong, and you will need to look at
some log files to see if you can get some clues about what is wrong:

%windir%\WindowsUpdate.log
and
%windir%\SoftwareDistribution\ReportingEvents.log

(%windir% is typically C:\Windows or C:\Winnt)

Note that the text goes pretty far out to the right on the latter file,
turn off any line wrapping in your text editor.


and:

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093




--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

> Hi,
>
> Lets try this:
>
> To be sure to have the latest Windows Update Agent installed, run
> WindowsUpdateAgent20-x86.exe (use a user account that have local
> admin rights).
>
> Download location for WindowsUpdateAgent20-x86.exe
> http://go.microsoft.com/fwlink/?LinkId=43264
>
>
> Then put the following text in a registry file (.reg) and import it
> by double-clicking on it in Explorer.
>
> --------------------8<----------------------
> REGEDIT4
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
> "AUOptions"=dword:00000004
> "ScheduledInstallDay"=dword:00000000
> "ScheduledInstallTime"=dword:00000003
> "RescheduleWaitTimeEnabled"=dword:00000001
> "RescheduleWaitTime"=dword:00000001
> "NoAutoUpdate"=dword:00000000
> "NoAutoRebootWithLoggedOnUsers"=dword:00000000
>
> --------------------8<----------------------
> (be sure to have a blank line at the end of the registry file)
>
> Then reboot.
>
>
> The registry file above will configure Automatic Updates (AU) to
> install updates automatically at 3 AM (or if the computer was not
> running at 3 AM, 1 minute after next computer startup).
>
> If an installation needs a reboot, AU will notify the user that the
> computer will automatically restart in 5 minutes to complete the
> installation, with no option to postpone the reboot.
>
> If you on a computer still experience that it doesn't install updates
> automatically, there is something wrong, and you will need to look at
> some log files to see if you can get some clues about what is wrong:
>
> %windir%\WindowsUpdate.log
> and
> %windir%\SoftwareDistribution\ReportingEvents.log
>
> (%windir% is typically C:\Windows or C:\Winnt)
>
> Note that the text goes pretty far out to the right on the latter file,
> turn off any line wrapping in your text editor.
>
>
> and:
>
> How to read the Windowsupdate.log file
> http://support.microsoft.com/kb/902093
>
>
>
>

Thanks for another very helpful reply Torgeir. I looked at the logs on
the XP Home machines and they are huge and not pretty. When I have time
I'll try and work out what they are doing.

Right now my Windows 2000 SP4 machine is constantly trying to install
the same KB823353 update for Outhouse Express which I don't use. As soon
as it runs the tray icon pops up ready to do it again. So I searched
this group and have spent the last hour trying to fix the problem.
Trouble is the fix on the MS website is laborious and just doesn't work
- when I try to reinstall 823353 downloaded from the link it refuses to
run saying it needs OE SP1 and when I run the command line workaround to
make it run it fails saying the directory does not exist. Pathetic.

So I am thoroughly fed up with MS and their thoroughly faulty work. I'm
turning updates off and getting back to earning a living. Maybe one day
MS will make an update for this issue that works.

---

A

Anon wrote:

> Thanks for another very helpful reply Torgeir. I looked at the logs on
> the XP Home machines and they are huge and not pretty. When I have time
> I'll try and work out what they are doing.

I suggest you stop the Automatic Updates service, and then rename the
log files, and then start the Automatic Updates service again. You
will then get new log files with only "fresh" information.

To trigger a detection cycle instantly, please run this command from
Start/Run:

wuauclt.exe /detectnow


> Right now my Windows 2000 SP4 machine is constantly trying to install
> the same KB823353 update for Outhouse Express which I don't use. As soon
> as it runs the tray icon pops up ready to do it again. So I searched
> this group and have spent the last hour trying to fix the problem.
> Trouble is the fix on the MS website is laborious and just doesn't work
> - when I try to reinstall 823353 downloaded from the link it refuses to
> run saying it needs OE SP1 and when I run the command line workaround to
> make it run it fails saying the directory does not exist. Pathetic.


If you have the security update KB897715 (MS05-030) installed,
it could be caused by that.

Temporarily uninstall KB897715 (from Add/Remove Programs), and see if
KB823353 (MS04-018) installs successfully. Then install KB897715 again.


More info/workarounds here as well:

http://support.microsoft.com/kb/555398



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

> If you have the security update KB897715 (MS05-030) installed,
> it could be caused by that.
>
> Temporarily uninstall KB897715 (from Add/Remove Programs), and see if
> KB823353 (MS04-018) installs successfully. Then install KB897715 again.
>
>
> More info/workarounds here as well:
>
> http://support.microsoft.com/kb/555398
>
>
>

Yup, that's the procedure that wasted me an hour and still didn't work.
I removed 897715 and followed the procedure - every ugly step.

But running IE6.0sp1-KB823353-x86-ENU.exe /T:"C:\Updates\823353" /C
returned an error message about missing directory at which point I lost
patience with the idiots who made this stinking mess.

---

A