Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We want to prevent our servers from rebooting after an update is automatically applied, as this has happened in the past and one server sat on a "press F1 to continue" screen.

I think if we create an OU that has our server computers, and apply a GPO to that OU, we can prevent the servers from taking updates and also prevent rebooting. Please advise.

share|improve this question
You still should fix why the server needed F1 to continue. – xeon Mar 14 '12 at 17:44
This is all readily available in documentation, is google broken? – SpacemanSpiff Mar 14 '12 at 17:46
Are you already using WSUS? Have you already reviewed the Microsoft Support article How to configure automatic updates by using Group Policy or registry settings? – jscott Mar 14 '12 at 17:47
Thank you JScott for the useful link. – BabakBani Mar 14 '12 at 17:51
thanks Xeon, yes we fixed the f1 error. I've made a note to fix that fresh out of the box going forward for new systems we receive ;-) – BabakBani Mar 14 '12 at 18:23
up vote 3 down vote accepted

You can put both servers in an OU and apply a GPO to that OU that prevents automatic installation of updates (and the subsequent reboot) or, alternatively, you can leave the servers where they are in the AD, create a security group and make the server computers members, then apply a GPO at the root of the domain filtered by the security group you created such that only the members of that group can apply the policy.

Either way will work. I generally have all my server computers below a single OU (with the exception of Domain Controller computers) and just have a "Member Servers and Domain Controllers" GPO that includes this kind of setting linked at both the "Domain Controllers" OU and the top-level OU of the hierarchy of OUs that contain the member server computers. (I almost never allow server computers to apply updates and reboot on their own.)

share|improve this answer
Thanks Evan for clarrifying for me which is better to use. I was confused on which option to take, the security group or the OU. I've applied a GPO at the OU level. I've moved our computers into two OUs: Computers - Workstations; Computers - Servers . Now we have a seperate WSUS GPO targetting each differently. – BabakBani Mar 15 '12 at 13:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.