Posted: 4/9/2008 12:05:54 PM EDT
|
I recently deployed a SUS server. It seems to be installing updates at 2 ways. It installs updates when a user shutdown the PC. It keeps the computer powered on until the updates and finished and it turns the PC off. I have no problem with this. The second way is uninitiated. They don't click on install updates etc. The user see a countdown timer until restart. There is now way for the user to cancel the restart. I have looked through all the settings but can't find away to keep it from restarting workstations. Any help? |
|
I believe what you are looking for is in the windows updates settings on the client (or in your domain group policy if using AD) run gpedit.msc Computer -> Administrative -> Windows -> Windows Update Probably what's enabled is Allow Automatic Updates immediate installation Disable it. That or No auto restart for scheduled Automatic Updates installations. or both. about a dozen options available in the policy -B |
Yes I am running an Active Directory. I was in the group policy on the Domain Controller, but I don't have Windows Update. Any way I can get it there? |
|
The GPO setting you want is Administrative Templates->Windows Components->Windows Update -> Configure Automatic Updates. Under 'Configure Automatic Update', you've probably got it set to a.) auto download and schedule the install, and b.) during the time the users are using their computers. You could also set 'no auto-restart for scheduled automatic updates installations' to enabled (thus preventing the computer from automatically rebooting'. Why not just deny all users to ability to shut down the computers and schedule the updates for after hours? That's best practice in my eyes. |
|
also, you're going to want to run RSOP (resultant set of policy) on the machines to see where they might be getting these settings from, if you thought you configured them right the first time. This is one possible problem with not making separate GPOs and labeling them well. I leave my default domain policy well enough alone, as I do my default domain controller policy. You shouldn't go nuts and make different policies for every single thing you want to administer (this lengthens non-cached logon time), but when you start messing with the default domain policy you'd better document changes. |