Restart Now/Later Prompt

Is there any way to get this prompt to only display once? I have 100+
servers that some of which only get rebooted 1-2 times a year, and I am
constantly battling this. I really don't want to shut off Automatic Updates
because it is very useful to use WSUS to run reports as to which servers need
the most work. Is there any way to bypass this contantly popping up? Thanks
in advance!

ctowndu33 <> wrote:

> Is there any way to get this prompt to only display once? I have 100+
> servers that some of which only get rebooted 1-2 times a year, and I
> am constantly battling this.

You should allow the servers to reboot themselves after they have
automatically installed their updates. If you configure the auto-update
time to be at a time of day when no people are using the servers, then
no-one will notice. Is rebooting once a month a serious problem?

--
Robin Walker [MVP Networking]

I am going to respectfully disagree - most network admins set their WSUS
server GPOs to only download updates, then the network admin has to initiate
the installation and restart manually (or by script). This is because of
the various issues surrounding the 'unexpected reboot' problem that many
people seem to have - in addition to allowing the admins to have complete
granular control of when their servers restart.

I would recommend reading the deployment documentation for WSUS as well as
the many FAQ's that are out there.

You can check out mine as well:
http://www.vbshf.com/vbshf/wsus/wsus_faq.htm - most notably the GPO settings
overview section.

Also, for future notice, post all future WSUS related questions in the
microsoft.public.windows.server.update_services newsgroup.

Best regards,
Rob Dunn
WSUS MVP


"Robin Walker" <> wrote in message
news:...
> ctowndu33 <> wrote:
>
>> Is there any way to get this prompt to only display once? I have 100+
>> servers that some of which only get rebooted 1-2 times a year, and I
>> am constantly battling this.
>
> You should allow the servers to reboot themselves after they have
> automatically installed their updates. If you configure the auto-update
> time to be at a time of day when no people are using the servers, then
> no-one will notice. Is rebooting once a month a serious problem?
>
> --
> Robin Walker [MVP Networking]
>
>

The problem is that I work for three hospitals and the main clinical systems
are not only used 24 hours a day, but it is extremely hard to coordinate
between all three facilities and all the doctors when to do it. I would love
to have once a month downtimes, trust me!

"Robin Walker" wrote:

> ctowndu33 <> wrote:
>
> > Is there any way to get this prompt to only display once? I have 100+
> > servers that some of which only get rebooted 1-2 times a year, and I
> > am constantly battling this.
>
> You should allow the servers to reboot themselves after they have
> automatically installed their updates. If you configure the auto-update
> time to be at a time of day when no people are using the servers, then
> no-one will notice. Is rebooting once a month a serious problem?
>
> --
> Robin Walker [MVP Networking]
>
>
>
>

I really don't see how this is a WSUS issue. This is an automatic update
question, regardless of if the updates are supplied from an internal or
external source.

"maximillianx" wrote:

> I am going to respectfully disagree - most network admins set their WSUS
> server GPOs to only download updates, then the network admin has to initiate
> the installation and restart manually (or by script). This is because of
> the various issues surrounding the 'unexpected reboot' problem that many
> people seem to have - in addition to allowing the admins to have complete
> granular control of when their servers restart.
>
> I would recommend reading the deployment documentation for WSUS as well as
> the many FAQ's that are out there.
>
> You can check out mine as well:
> http://www.vbshf.com/vbshf/wsus/wsus_faq.htm - most notably the GPO settings
> overview section.
>
> Also, for future notice, post all future WSUS related questions in the
> microsoft.public.windows.server.update_services newsgroup.
>
> Best regards,
> Rob Dunn
> WSUS MVP
>
>
> "Robin Walker" <> wrote in message
> news:...
> > ctowndu33 <> wrote:
> >
> >> Is there any way to get this prompt to only display once? I have 100+
> >> servers that some of which only get rebooted 1-2 times a year, and I
> >> am constantly battling this.
> >
> > You should allow the servers to reboot themselves after they have
> > automatically installed their updates. If you configure the auto-update
> > time to be at a time of day when no people are using the servers, then
> > no-one will notice. Is rebooting once a month a serious problem?
> >
> > --
> > Robin Walker [MVP Networking]
> >
> >
>
>
>

You are forgetting that the Automatic Updates service has been enlisted by
WSUS, and is no longer being used in a more 'consumer-like' role. When you
redirect it to your WSUS server, you are given a series of granular controls
to adjust and manipulate the behavior of your WSUS clients. It's no longer
'install and reboot' now.

Automatic Update interfaces directly with WSUS if you've configured it
(which you stated you have). The WSUS GPO's that you have defined will
directly impact the restart behavior of your servers. AU on the client side
is driven by the Windows Update Agent, and will restart (if set up to
install updates automatically) any computer after an update is installed
regardless if a person is logged onto the computer or not if you are _not_
using WSUS.

If you _are_ using WSUS, the Windows Update Agent will not restart your
computer after an update is installed if an administrative user is logged
into the computer (or if elevate non-admins is enabled and a user is logged
in). If no user is logged in, then the computer will restart.

I would again recommend that you take a look at the documentation to gain a
better understanding of WSUS, this will help you out immensely in
understanding the architecture and behavior a bit more.

Hope this helps,
Rob
WSUS MVP



"ctowndu33" <> wrote in message
news1923A7A-A308-4211-91DF-...
>I really don't see how this is a WSUS issue. This is an automatic update
> question, regardless of if the updates are supplied from an internal or
> external source.
>

I think we've gotten off course. I understand how WSUS works. I just
figured that since it wasn't something to do with the internal workings of
the application, that it was more of an update issue. Sorry, my bad.
Regardless though, nobody really answered my question. I just wanted to know
if there is some sort of reg edit or something to completely disable the
popup. Sure, right now we have it set to the max at 1440. This still
requires someone to click reboot later everyday, possibly for months and
months. I sort of figured that there wasn't any solution, but thought maybe
there was something that isn't necessarily advertised through GP. If there
isn't, then that's cool, we'll just have to deal with it.

"maximillianx" wrote:

> You are forgetting that the Automatic Updates service has been enlisted by
> WSUS, and is no longer being used in a more 'consumer-like' role. When you
> redirect it to your WSUS server, you are given a series of granular controls
> to adjust and manipulate the behavior of your WSUS clients. It's no longer
> 'install and reboot' now.
>
> Automatic Update interfaces directly with WSUS if you've configured it
> (which you stated you have). The WSUS GPO's that you have defined will
> directly impact the restart behavior of your servers. AU on the client side
> is driven by the Windows Update Agent, and will restart (if set up to
> install updates automatically) any computer after an update is installed
> regardless if a person is logged onto the computer or not if you are _not_
> using WSUS.
>
> If you _are_ using WSUS, the Windows Update Agent will not restart your
> computer after an update is installed if an administrative user is logged
> into the computer (or if elevate non-admins is enabled and a user is logged
> in). If no user is logged in, then the computer will restart.
>
> I would again recommend that you take a look at the documentation to gain a
> better understanding of WSUS, this will help you out immensely in
> understanding the architecture and behavior a bit more.
>
> Hope this helps,
> Rob
> WSUS MVP
>
>
>
> "ctowndu33" <> wrote in message
> news1923A7A-A308-4211-91DF-...
> >I really don't see how this is a WSUS issue. This is an automatic update
> > question, regardless of if the updates are supplied from an internal or
> > external source.
> >
>
>
>

You are correct, reboots are controlled by the WUA and the metadata that is
posted along with the particular update, not the update only (the metadata
tells the WUA that a reboot might be needed). Some conditionals are put
into the picture when WSUS is involved (don't restart if a user is logged
on, etc.).

Again, a VAST majority of network admins will not let AU automatically
restart their servers, and opt for the "download now, I'll install and
restart at that time" approach. The reason being is that they require this
granular control for keeping their production servers up as much as
possible.

If you follow this philosophy, you won't get the 'restart later' prompt.
Optimally, you will have rebooted your server way before the time window for
the first restart prompt has elapsed.

I feel compelled to say this:

It is HIGHLY recommended to find the time and install the update manually or
via controlled scripting - then restart your servers as _soon_ as the update
is applied, as running a server in a 'reboot pending state' for a day or
months(!) is most definitely NOT a good or safe way to operate. Your
servers are not fully patched at this point, and are open to whatever
exploits the updates are intended to fix, not to mention any instability
this may expose. Why even patch the server if this is the case? You are
creating a non-recommended run state for your server, prompting users for
restart, and creating more work-load and overhead for your system admins.
Just patch them when your admins are able to perform a restart.

My suggestion to you is to sit down and spend some time to create a
maintenance policy and semi-regularly scheduled time window so you can apply
updates and restart the servers (and perform any other work that may be
needed). Make AU work for you and your maintenance policy. Don't let it
determine your maintenance and update policies for you...

Regards,

Rob
WSUS MVP

"ctowndu33" <> wrote in message
news:637BFDAF-D6D4-4B6E-A552-...
>I think we've gotten off course. I understand how WSUS works. I just
> figured that since it wasn't something to do with the internal workings of
> the application, that it was more of an update issue. Sorry, my bad.
> Regardless though, nobody really answered my question. I just wanted to
> know
> if there is some sort of reg edit or something to completely disable the
> popup. Sure, right now we have it set to the max at 1440. This still
> requires someone to click reboot later everyday, possibly for months and
> months. I sort of figured that there wasn't any solution, but thought
> maybe
> there was something that isn't necessarily advertised through GP. If
> there
> isn't, then that's cool, we'll just have to deal with it.
>

I appreciate the advice. The reason that we install them is because
typically, it is hard to get downtime and so we leave it in a pending state
in case a server would get rebooted in the middle of the night or on a
weekend because of an application error, etc. We tend to get most of our
updates installed by reboots that were not meant to happen, hence the few
times a year. I realize that this isn't optimal and believe me, I would love
to get together a maintenance plan, but without devulging into our ridiculous
corporate politics, it is simply not that easy. Regardless, I really
appreciate the help. Maybe I can forward your post to the next person in my
yearly attempt to get a monthly downtime window. Wish me luck.

"maximillianx" wrote:

> You are correct, reboots are controlled by the WUA and the metadata that is
> posted along with the particular update, not the update only (the metadata
> tells the WUA that a reboot might be needed). Some conditionals are put
> into the picture when WSUS is involved (don't restart if a user is logged
> on, etc.).
>
> Again, a VAST majority of network admins will not let AU automatically
> restart their servers, and opt for the "download now, I'll install and
> restart at that time" approach. The reason being is that they require this
> granular control for keeping their production servers up as much as
> possible.
>
> If you follow this philosophy, you won't get the 'restart later' prompt.
> Optimally, you will have rebooted your server way before the time window for
> the first restart prompt has elapsed.
>
> I feel compelled to say this:
>
> It is HIGHLY recommended to find the time and install the update manually or
> via controlled scripting - then restart your servers as _soon_ as the update
> is applied, as running a server in a 'reboot pending state' for a day or
> months(!) is most definitely NOT a good or safe way to operate. Your
> servers are not fully patched at this point, and are open to whatever
> exploits the updates are intended to fix, not to mention any instability
> this may expose. Why even patch the server if this is the case? You are
> creating a non-recommended run state for your server, prompting users for
> restart, and creating more work-load and overhead for your system admins.
> Just patch them when your admins are able to perform a restart.
>
> My suggestion to you is to sit down and spend some time to create a
> maintenance policy and semi-regularly scheduled time window so you can apply
> updates and restart the servers (and perform any other work that may be
> needed). Make AU work for you and your maintenance policy. Don't let it
> determine your maintenance and update policies for you...
>
> Regards,
>
> Rob
> WSUS MVP
>
> "ctowndu33" <> wrote in message
> news:637BFDAF-D6D4-4B6E-A552-...
> >I think we've gotten off course. I understand how WSUS works. I just
> > figured that since it wasn't something to do with the internal workings of
> > the application, that it was more of an update issue. Sorry, my bad.
> > Regardless though, nobody really answered my question. I just wanted to
> > know
> > if there is some sort of reg edit or something to completely disable the
> > popup. Sure, right now we have it set to the max at 1440. This still
> > requires someone to click reboot later everyday, possibly for months and
> > months. I sort of figured that there wasn't any solution, but thought
> > maybe
> > there was something that isn't necessarily advertised through GP. If
> > there
> > isn't, then that's cool, we'll just have to deal with it.
> >
>
>
>

Heheh - good luck, I'm sure you will find a lot of posts like mine in the
Google newsgroup archives!



Best regards,
Rob


"ctowndu33" <> wrote in message
news:FD88384D-2EFF-4B8B-9325-...
>I appreciate the advice. The reason that we install them is because
> typically, it is hard to get downtime and so we leave it in a pending
> state
> in case a server would get rebooted in the middle of the night or on a
> weekend because of an application error, etc. We tend to get most of our
> updates installed by reboots that were not meant to happen, hence the few
> times a year. I realize that this isn't optimal and believe me, I would
> love
> to get together a maintenance plan, but without devulging into our
> ridiculous
> corporate politics, it is simply not that easy. Regardless, I really
> appreciate the help. Maybe I can forward your post to the next person in
> my
> yearly attempt to get a monthly downtime window. Wish me luck.
>
> "maximillianx" wrote:
>
>> You are correct, reboots are controlled by the WUA and the metadata that
>> is
>> posted along with the particular update, not the update only (the
>> metadata
>> tells the WUA that a reboot might be needed). Some conditionals are put
>> into the picture when WSUS is involved (don't restart if a user is logged
>> on, etc.).
>>
>> Again, a VAST majority of network admins will not let AU automatically
>> restart their servers, and opt for the "download now, I'll install and
>> restart at that time" approach. The reason being is that they require
>> this
>> granular control for keeping their production servers up as much as
>> possible.
>>
>> If you follow this philosophy, you won't get the 'restart later' prompt.
>> Optimally, you will have rebooted your server way before the time window
>> for
>> the first restart prompt has elapsed.
>>
>> I feel compelled to say this:
>>
>> It is HIGHLY recommended to find the time and install the update manually
>> or
>> via controlled scripting - then restart your servers as _soon_ as the
>> update
>> is applied, as running a server in a 'reboot pending state' for a day or
>> months(!) is most definitely NOT a good or safe way to operate. Your
>> servers are not fully patched at this point, and are open to whatever
>> exploits the updates are intended to fix, not to mention any instability
>> this may expose. Why even patch the server if this is the case? You are
>> creating a non-recommended run state for your server, prompting users for
>> restart, and creating more work-load and overhead for your system admins.
>> Just patch them when your admins are able to perform a restart.
>>
>> My suggestion to you is to sit down and spend some time to create a
>> maintenance policy and semi-regularly scheduled time window so you can
>> apply
>> updates and restart the servers (and perform any other work that may be
>> needed). Make AU work for you and your maintenance policy. Don't let it
>> determine your maintenance and update policies for you...
>>
>> Regards,
>>
>> Rob
>> WSUS MVP
>>
>> "ctowndu33" <> wrote in message
>> news:637BFDAF-D6D4-4B6E-A552-...
>> >I think we've gotten off course. I understand how WSUS works. I just
>> > figured that since it wasn't something to do with the internal workings
>> > of
>> > the application, that it was more of an update issue. Sorry, my bad.
>> > Regardless though, nobody really answered my question. I just wanted
>> > to
>> > know
>> > if there is some sort of reg edit or something to completely disable
>> > the
>> > popup. Sure, right now we have it set to the max at 1440. This still
>> > requires someone to click reboot later everyday, possibly for months
>> > and
>> > months. I sort of figured that there wasn't any solution, but thought
>> > maybe
>> > there was something that isn't necessarily advertised through GP. If
>> > there
>> > isn't, then that's cool, we'll just have to deal with it.
>> >
>>
>>
>>