We're currently attempting to find a solution to better automate our Windows updates on our IIS machines. We have an infrastructure that is hit by thousands of transactions at all hours of the day; the best window we can provide is one with less of those transactions, but killing IIS/powering off the machine during them causes cross-departmental incidents that we'd like to avoid.
As such, these transactions must complete before reboot the machine to accept updates. We currently use an F5 Load Balancer which monitors a file with a control value that we change manually to allow updates; if the server is no longer in the load balancing table, the ongoing transactions can complete, and the rest of the new ones will be sent to the other servers.
I am attempting to find a way to allow for us to remove our server from the load balancer without shutting it down or turning off IIS (allowing a grace period for pending transactions while stopping new ones). We use SCOM currently, who's controls I do not have access to and the team tells me that it is not possible to specify a script or trigger before updates with our current infrastructure.
My idea is that we could configure a scheduled task script to trigger on the event ID that a Windows Update is ready to install, to take our server out of the load balancing, and then another when the update is finished to put it back in.
However, while I know that scheduled tasks work on event ID 19 (update success), I am unsure if it is possible for one to specify a task to take place before the update actually begins. The event ID I'm currently looking at is 43, Installation Started, but I have doubts that other tasks could run while this is happening (such as stopping and starting services, changing files, etc).
Does anyone have experience writing scheduled tasks or scripts around this specific event chain, directly before and directly after an update is applied?