We finally have the redundancy in place to put all of our servers on an automatic, staggered monthly reboot schedule. I also have a WSUS server and a group policy that points them to a
Servers group on it. Up to this point, we've been manually installing updates on servers.
I'm trying to implement Group Policy to automate patch management like so:
- Every Patch Tuesday, a sysadmin approves updates for the Servers group on the WSUS server that were published on the last Patch Tuesday (we want our servers to be 30 days behind on patches except for the test servers).
- The servers download and install the updates automatically, but should sit at a pending reboot state.
- When the server's scheduled reboot time rolls around, the server automatically reboots, thus completing the pending update process.
My issue is with the
Configure Automatic Updates policy. The policy has four options (curiously numbered 2-5 instead of 1-4). Option 3 automatically downloads the updates but a sysadmin has to choose to install them. Option 4 automatically downloads and installs them, but wants to reboot the server automatically as well.
Looking at the other options, I only see three other policies concerning reboots:
Always automatically restart at the scheduled time. This only affects Server 2012 and we have a bunch of 2008 R2 servers as well.
Delay restart for scheduled installations. This policy can delay a reboot, but requires you to enter a value > 0 into the box.
No auto-restart with logged on users for scheduled automatic updates installations. This only blocks reboots if a user is logged in.
So how do I direct Windows Update to automatically download AND install updates, but not reboot the server?