Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

we have a number of servers in our office, as a small hosting company, and these servers are critical to business, ... web server, mail server, db server, etc.

On a semi-regular basis, when the machines get automatic updates, they just automagically reboot themselves in the middle of the night. A number of them have software which must be running on the console session (bad practice, I know, but out of my control). When they reboot themselves, these programs obviously shut down, leaving customers upset and services interrupted.

How do you set a Windows Server 2003 R2 machine to NEVER automagically reboot itself after updates? And perhaps, if possible, to instead email someone so that they are aware it needs a pending reboot and can schedule it for the best time?

Thanks in advance!

share|improve this question

8 Answers 8

up vote 8 down vote accepted

In group policy for the server, navigate to:

Computer Configuration->Administrative Templates->Windows Components->Windows Update->No auto-restart for scheduled Automatic Update installation

You can get to this by running "gpedit.msc"

Reboot to apply changes.

share|improve this answer
    
Does running GPEDIT on the PDC actually edit the domain group policy? Because it says in the gpedit.msc console "Local Computer Policy". –  eidylon Sep 9 '09 at 15:59
    
To deploy this to all of your servers, you will need to edit on PDC (or a PC on the domain) and apply that group policy to your servers. The directions I mentioned only edit local group policy - but I am not group policy expert! –  Dave Drager Sep 9 '09 at 16:12
1  
Don't forget though that you will remain vulnerable to whatever the patch fixed until you do the reboot. –  EBGreen Sep 9 '09 at 19:28
2  
"Reboot to apply changes." - sigh ;-) –  Matthias Sep 30 '13 at 16:54

You can accomplish this, and leaving updates installed waiting for a reboot does not leave the server in an inconsistent state. Updates that require a reboot are not applied until the reboot occurs. The settings to manage automatic updates are too numerous to list here, but you can manage them in a domain via Group Policy, or on stand-alone machines using Local Policy. Go to Computer Configuration>Administrative Templates>Windows Components>Windows Update.

share|improve this answer

The best solution that I am aware of is to turn off automatic updates. Then you schedule maintenance windows with your customers and apply the updates manually and do the reboot then make sure everything that you need is running after the reboot.

Just stopping the reboots is a bad idea because that gives the impression that you are fully updated when you really aren't since updates that need reboots to complete...well...you know...need reboots to complete.

share|improve this answer
    
Well, for that same reason I'd rather not turn them off, just to keep things updated for sure, but get a notification to an email address that would notify several people so we are sure to be aware. Something like the operator notifications in Sql Server. –  eidylon Sep 9 '09 at 15:02
1  
+1 for manual updates on production systems. Nothing worse than having an MS update auto applied, hose up your production SQL/Exchange/file/etc. server –  Dayton Brown Sep 9 '09 at 15:02
    
But - lets be realistic. For most situations any kind of automatic update is not going to impact an installed program. If you do have software that ties in so closely with the Windows files, then you should turn it off. But for 90% of the situations out there, users will receive more security benefit from the automatic updates than the risk it will impact running software. –  Dave Drager Sep 9 '09 at 15:06

If you can't (or don't want to) reboot a server, you should postpone update installation to when you can safely reboot it.

You should never install updates that require reboots without actually rebooting the machine; this leaves the system in an inconsistent state, and you can have any kind of troubles until a reboot is finally done.

share|improve this answer

I would suggest to keep the auto updates running, BUT have the servers only download the updates and not install them.

Have you thought about a WSUS server for easier patch maintenance?

share|improve this answer

The short answer is, you can't. The only options are to let them download and sit and wait until you can install manually and reboot, or just turn off AU and download/install in a maintenance window.

share|improve this answer

I personally prefer the download updates but don't install option. That way the server lets you know that it has downloads that are ready, although you have to log on interactively to see the notice, and you don't have to wait for them to download when you have a maintenance window for an installation and reboot.

share|improve this answer

If you're running an application on an active console session, as stated, you can set the option to prevent reboots while users are logged into the server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.