Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a developer who is in the fortunate position of having access to 5 newly booted virtual servers for use as our corporate Web Servers. In the past the Web Servers haven't been anyone's direct responsibility and so they have suffered no patching, no framework updates and no real maintenance.

To stop this from happening again I'm trying to step up and take some of the responsibility. Before I go to our services team and ask them I was hoping someone could give me some idea as to what it is I should be asking for.

I had in my head the idea of an active directory policy/group to which the 5 Web Servers could all be added that would reboot them once a night. I think I wanted them to reboot so that they could install any updates that windows so this was the underlying reason which I'm now not sure a simple reboot would handle.

So can you please suggest what policy I should ask to be created for the new web servers?

I don't have rights to create policies myself, I'm not even sure how they work (I seem to remember long lists of checkboxes) so can't do that much research which is why I came here, thanks in advance

share|improve this question
up vote 3 down vote accepted

This is a very common task.

You can simply use Group Policy to schedule Automatic Updates or even look into building a WSUS server if you require fine-grain control over updates.

share|improve this answer
I'm reading these links now, cheers – David A Gibson Jul 27 '10 at 13:37
@MrBrutal: Keep in mind that what jscott has pointed you to highlights "Local" Group Policies. In my mind, you lose the benefit of managing computers via GPOs unless you're doing it centrally from Active Directory... – GregD Jul 27 '10 at 13:41
@GregD: The article linked notes 3 methods: Local Policy, AD GP, and registry-direct. I do not have info on @MrBrutal's network to specify which to use. His "services team" could read the docs and make the call. – jscott Jul 27 '10 at 13:44

I don't normally recommend this on production servers, which you indicate these AREN'T, but if you're only concerned about Microsoft updates, just set these to grab the updates automatically and apply them...

The automatic updates will take care of rebooting the server if it needs it.

Edited to add: You indicated that you were a developer and didn't have access to create policies (I'm assuming in your domain). I wouldn't recommend you create (or suggest to your services team) that they create LOCAL GPOs for each of these 5 servers, if your intent is to make wider use of GPOs eventually (although how you're not already making use of them is beyond me...but I digress). You'll want to make use of Group Policy manager and deploy these via AD, which can be complicated and time consuming but WAY WORTH THE EFFORT in the long run.

OR if you want really fine grained control over Windows Updates specifically, as jscott indicated in his answer, you could install a WSUS server OR something like System Centers Essentials to manage updates.

Having said all of this, I did make a couple of assumptions about your environment, and that was that you had admin rights to your dev servers and that your services team really didn't care about these dev servers. If this is true, you could leave your services folks out of the loop and simply set these dev servers to grab automatic updates via the GUI and not having to create local policies on each server.

share|improve this answer
Hi GregD - yeah I have written that it's our development environment but I have being using that term to mean the whole set-up we use - as in internal software development. My mistake sorry, we're not a very large company and these concepts aren't approached in the right way at all which is why I'm trying to do my bit, change from below if you know what I mean, cheers – David A Gibson Jul 27 '10 at 13:25
Will you be needing to manage any other aspect of these servers via GPs? I wouldn't make this overly complicated by using GPOs if this is all you needed it to do. – GregD Jul 27 '10 at 13:27
@GregD: With just over a dozen mouse clicks [I counted] you can build a GPO [from scratch] to schedule Windows Updates to install nightly. Not sure that counts as overly complicated. :) And using GP should ensure consistency in the configuration across the five servers. – jscott Jul 27 '10 at 13:33
I see what your saying GregD but yes I expect to manage other aspects eventually - and try to spread the use of group policies in this way to other teams/purposes, @jscott: consistency is EXACTLY what we want - I should have probably put that in the question, which isn't worded very well sorry again about that GregD! :) – David A Gibson Jul 27 '10 at 13:36
@GregD: +1 to you. I would strongly suggest that his Services Team utilize a Domain GPs whenever possible. You clarified this in your answer, while I barely even alluded to it across my answer and comments. Cheers. – jscott Jul 27 '10 at 14:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.