Group Policy option to allow "restart later"

In message <#> Hank Arnold
<> was claimed to have wrote:

>Laptops are always a problem. I'm not aware of any way to set it up so
>that if the WSUS server isn't available, then check in with the MU site
>(unless Lawrence can come up with one).

If you script the registry changes rather then using a group policy, you
can accomplish this goal by having your script detect the appropriate
source as needed.

There might be a better way to do this via only applying a GPO based on
network conditions, I can't say I've investigated, but short of applying
the or not based on network conditions, there's definitely nothing in
the policy itself to fallback on MU if WSUS is unavailable.

A better answer might be to expose your WSUS server to the laptops
remotely (Requiring IPSec from non-local IPs comes to mind) so that
users can patch from WSUS wherever they are, otherwise you'll lose the
ability to decline or delay patches.

I suppose that is an option however our local government wont let us have
remote access to in school servers.

The only option i really have is to make it that shut down is forced to
become install updates and shut down via local policy.

Itll just have to do i suppose. At least that way they will get updates when
they come down through wsus.

"Dave Warren" wrote:

> In message <#> Hank Arnold
> <> was claimed to have wrote:
>
> >Laptops are always a problem. I'm not aware of any way to set it up so
> >that if the WSUS server isn't available, then check in with the MU site
> >(unless Lawrence can come up with one).
>
> If you script the registry changes rather then using a group policy, you
> can accomplish this goal by having your script detect the appropriate
> source as needed.
>
> There might be a better way to do this via only applying a GPO based on
> network conditions, I can't say I've investigated, but short of applying
> the or not based on network conditions, there's definitely nothing in
> the policy itself to fallback on MU if WSUS is unavailable.
>
> A better answer might be to expose your WSUS server to the laptops
> remotely (Requiring IPSec from non-local IPs comes to mind) so that
> users can patch from WSUS wherever they are, otherwise you'll lose the
> ability to decline or delay patches.
> .
>

On Tue, 17 Nov 2009 03:19:01 -0800, Stephen Padgett
<> wrote:

>I suppose that is an option however our local government wont let us have
>remote access to in school servers.
>
>The only option i really have is to make it that shut down is forced to
>become install updates and shut down via local policy.
I don't think there is such a policy. You can suppress the option to "Install
Updates and Shutdown" but not make it the only one. The user can always choose.
The only way to force an installation is to set a deadline but that is a whole
different story.

>
>Itll just have to do i suppose. At least that way they will get updates when
>they come down through wsus.
>
>"Dave Warren" wrote:
>
>> In message <#> Hank Arnold
>> <> was claimed to have wrote:
>>
>> >Laptops are always a problem. I'm not aware of any way to set it up so
>> >that if the WSUS server isn't available, then check in with the MU site
>> >(unless Lawrence can come up with one).
>>
>> If you script the registry changes rather then using a group policy, you
>> can accomplish this goal by having your script detect the appropriate
>> source as needed.
>>
>> There might be a better way to do this via only applying a GPO based on
>> network conditions, I can't say I've investigated, but short of applying
>> the or not based on network conditions, there's definitely nothing in
>> the policy itself to fallback on MU if WSUS is unavailable.
>>
>> A better answer might be to expose your WSUS server to the laptops
>> remotely (Requiring IPSec from non-local IPs comes to mind) so that
>> users can patch from WSUS wherever they are, otherwise you'll lose the
>> ability to decline or delay patches.
>> .
>>
--
Dave Mills
There are 10 types of people, those that understand binary and those that don't.

"Dave Mills" <> wrote in message
news:...

>>The only option i really have is to make it that shut down is forced to
>>become install updates and shut down via local policy.

> I don't think there is such a policy. You can suppress the option to
> "Install
> Updates and Shutdown" but not make it the only one. The user can always
> choose.
> The only way to force an installation is to set a deadline but that is a
> whole
> different story.

Correct. The policy does not force the use of "Install Updates and Shutdown"
it merely enforces the presentation of that option as the default option.
The user always has the option to override the actual behavior and select
"Shutdown" or "Restart", or on Vista, etc. click on a different shutdown
button.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

I suppose so however staff are *that* lazy, they wont know theyll be able to
change the selection from install updates and shut down to just shut down.

I know i have a bad view of my staff but its only after 3 years im realising
how lazy some staff can be =-)

Thanks all for your help.

"Lawrence Garvin [MVP]" wrote:

> "Dave Mills" <> wrote in message
> news:...
>
> >>The only option i really have is to make it that shut down is forced to
> >>become install updates and shut down via local policy.
>
> > I don't think there is such a policy. You can suppress the option to
> > "Install
> > Updates and Shutdown" but not make it the only one. The user can always
> > choose.
> > The only way to force an installation is to set a deadline but that is a
> > whole
> > different story.
>
> Correct. The policy does not force the use of "Install Updates and Shutdown"
> it merely enforces the presentation of that option as the default option.
> The user always has the option to override the actual behavior and select
> "Shutdown" or "Restart", or on Vista, etc. click on a different shutdown
> button.
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> My Blog: http://onsitechsolutions.spaces.live.com
> Microsoft WSUS Website: http://www.microsoft.com/wsus
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>
> .
>

On Wed, 18 Nov 2009 02:40:01 -0800, Stephen Padgett
<> wrote:

>I suppose so however staff are *that* lazy, they wont know theyll be able to
>change the selection from install updates and shut down to just shut down.
>
>I know i have a bad view of my staff but its only after 3 years im realising
>how lazy some staff can be =-)
>
>Thanks all for your help.

Being in a school too I know what you mean. I have just ran into a shop stopper
though. I have implemented a programs called LanSchool and if lets the teacher
control the students. It also lets tem shutdown the classroom from the teacher
PC. Being like your teacher/staff they do this but that means the option to
install updates is never selected, I don't think it can be invoked using the
Shutdown WMI calls.
>
>"Lawrence Garvin [MVP]" wrote:
>
>> "Dave Mills" <> wrote in message
>> news:...
>>
>> >>The only option i really have is to make it that shut down is forced to
>> >>become install updates and shut down via local policy.
>>
>> > I don't think there is such a policy. You can suppress the option to
>> > "Install
>> > Updates and Shutdown" but not make it the only one. The user can always
>> > choose.
>> > The only way to force an installation is to set a deadline but that is a
>> > whole
>> > different story.
>>
>> Correct. The policy does not force the use of "Install Updates and Shutdown"
>> it merely enforces the presentation of that option as the default option.
>> The user always has the option to override the actual behavior and select
>> "Shutdown" or "Restart", or on Vista, etc. click on a different shutdown
>> button.
>>
>>
>> --
>> Lawrence Garvin, M.S., MCITP:EA, MCDBA
>> Principal/CTO, Onsite Technology Solutions, Houston, Texas
>> Microsoft MVP - Software Distribution (2005-2009)
>>
>> My Blog: http://onsitechsolutions.spaces.live.com
>> Microsoft WSUS Website: http://www.microsoft.com/wsus
>> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>>
>> .
>>
--
Dave Mills
There are 10 types of people, those that understand binary and those that don't.