6

I have set up WSUS 2.0 (on 2008 R2). All client side machines are running Windows 8.1.

At the request of the users, i have been running with the below GP configuration so WSUS is less intrusive, and wont shut down their machines automatically etc. My understanding was that by disabling 'Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box' it would behave as the description states:

If you disable or do not configure this policy setting, the 'Install Updates and Shut Down' option will be available in the Shut Down Windows dialog box if updates are available when the user selects the Shut Down option in the Start menu.

I have also disabled the "Do not adjust option to'Install Updates and Shut Down' option in Shut Down Windows dialog box'" which i thought would mean the default option at shut down would be to install updates and shutdown. As per its description:

If you disable or do not configure this policy setting, the 'Install Updates and Shut Down' option will be the default option in the Shut Down Windows dialog box if updates are available for installation at the time the user selects the Shut Down option in the Start menu.

I have a few test Win7 VM's and this is working as i would expect. However, the Win8.1 users do not get this option on shutdown. They are still required to open Windows Update and manually click 'Instal;l Updates'.... not ideal from my perspective, as you could imagine, some users are not installing them at all.

Is there a way to make this option available on Win8.1 OS, or is the only option to change 'Configure Automatic Updates' to option 4 and set a schedule to install them. I want to avoid this if at all possible.

My current GPO set up is as per below. Has anyone got any ideas?

Do not display install updates and shut down option.... : Disabled
Do not adjust option to install and shut down......     : Disabled
Enabling Windows Update Power Mgt to automatically Wake up system : Enabled
Configure Automatic Updates : option 3 : Enabled
Specify intranet MS update location : Enabled
Automatic Updates frequency : Enabled
Allow Automatic Updates immediate installation : Enabled

All the rest are set to 'not configured'

Improve this question
7
  • Can I ask why you want to avoid scheduling automatic installation? By setting a schedule, you ensure critical updates and security patches, etc. are automatically installed in a timely manner. With a manual scenario, if you have a user that's out for a few days, or a system that's otherwise vacant most of the time, it gets neglected when new updates are available.
    – tfrederick74656
    Commented Nov 26, 2014 at 8:08
  • Also, another question: Is there a reason why you're using WSUS 2.0? WSUS 3.0 is the latest version available for installation on Server 2008. I'd highly recommend moving to 3.0 unless you have a specific reason to still be using an older version. It's significantly faster on both front and back end.
    – tfrederick74656
    Commented Nov 26, 2014 at 8:18
  • Hi fred. I personally would love to automate the update schedule. However, my recommendation for this was not taken on board, hence i am stuck with things how they are now. With that said, is there a solution other than scheduling updates and shutdowns. If not i will take the steps to push that forward. Using v2 as that was the version on the server image we are using. Thanks for the information though, i will look into v3.
    – user238651
    Commented Nov 26, 2014 at 23:23
  • So i am assuming that the answer is a no, Win8.1 will not work as the GP settings state?
    – user238651
    Commented Nov 27, 2014 at 22:04
  • I don't know of any way to get the shut down and install working the way you expect it to, but maybe you don't completely understand how a schedule would work - you don't have to schedule shutdowns, you just schedule installation. You can adjust a few group policy settings and disable automatic shutdown after installation, so that the next batch of updates simply waits until the computer is manually rebooted. In this manner, updates get installed automatically, you don't have to worry about unexpected reboots, and your users don't have to worry about interacting with updates.
    – tfrederick74656
    Commented Nov 27, 2014 at 22:13

2 Answers 2

Reset to default
3

There are two main settings you'll want to configure:

Configured Policy Items

First, you'll want to enable No auto-restart with logged on users for schedules automatic updates installations. This setting will ensure that the computer will never automatically restart for update installation if a user is logged on, effectively preventing anyone getting interrupted in the middle of doing work.

Second, you need to enable and configure the Configure Automatic Updates policy. You'll need to choose option 4 and set a schedule for when you would like updates to install. If this schedule overlaps with when computers are being used, they'll simply be installed in the background and wait for the user to either manually reboot or log off.

Configure Automatic Updates

The net result of these two settings is that updates always install at the scheduled time. If the computer is idle (no user logged on/present), the reboot is automatic. If there is a user logged on, reboot is delayed until the user either manually reboots, or the next scheduled install period when the computer is idle.

In addition to those two settings, I would also recommend enabling Re-prompt for restart with scheduled installations and setting a long timeout. This setting allows you to prevent the recurring "Restart or Postpone" dialog box from coming up repeatedly. In my environment, I have this set to 1440 minutes, or 24 hours. We have a policy for users to restart at the end of their shifts regardless, so this reminder isn't necessary.

Improve this answer
2
  • You have "Scheduled install on 00 am daily" enabled, also you have "allow install immediately" enabled. which one wins?
    – Root Loop
    Commented May 29, 2017 at 19:02
  • "Allow immediate install" does, but only under certain circumstances. That option only applies to updates that don't require a reboot or restarting any system services. It's good for deploying things like Windows Defender definition updates right away. Essentially if it's non-disruptive it'll be installed immediately, while any other updates will wait until the specified time.
    – tfrederick74656
    Commented May 29, 2017 at 19:06
0

As per this forum, in windows 8 and 8.1 this functionality is removed. Users get "install updates and restart" instead "install updates and shutdown"

https://social.technet.microsoft.com/Forums/en-US/b074b410-f7b2-4903-9594-c1cab0e35f4e/wsus-windows-8-will-not-install-updates-on-shutdown?forum=winserverwsus

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .