With the goal of putting it in more production boxes, I'm testing Windows 2016 update behavior. I've run
sconfig to select "DownloadOnly" in "Windows Update Setting" and I configured "Active Hours" from 07:00 to 19:00.
It is my understandig that this setup should work as below:
- updates are automatically downloaded;
- updates are not automatically installed; rather, a sysadmin had to manually confirm updates installation;
- if server must be rebooted, a scheduled reboot outside active hours should be automatically configured;
- in off-hours (ie: after 19:00 - 07:00) the server should reboot.
Main question: is the above understanding correct?
I'm asking because when testing on a Windows 2016 Domain Controller and manually installing updates, even if a notice shows "your device is scheduled to restart outside active hours (active hours are 07:00 to 19:00)", the reboot never occours.
I noticed that in Task Manager\Library\Windows\Windows Update, a Reboot Task launcing
musnotification.exe RebootDialog was created to run at 19:20, and it runs each 30/60 mins.
Second question: how Windows 2016 behave, by default, when there are logged remote desktop users? Does it notify? Does it restart? What if the session is in disconnected state?
Note: I know the policy
No auto-restart with logged on users for scheduled automatic updates installations, however:
- It is not active/configured;
- As I am not auto-installing updates, it should have no effect:
This policy applies only when the Configure Automatic Updates policy is configured to perform scheduled installations of updates.
Granted, I fully understand that a server should be patched and rebooted only at appropriate time. However, I would really like to understand the logic behind current (Win2016) update behavior. I strongly feel I am missing something, as this should be a basic maintenance task.
I've read these informations, but I would really like to hear some first-hand Windows sysadmin experience.