Is it possible to set a scheduled tasks to run both directly before and directly after a windows update?

Question

We're currently attempting to find a solution to better automate our Windows updates on our IIS machines. We have an infrastructure that is hit by thousands of transactions at all hours of the day; the best window we can provide is one with less of those transactions, but killing IIS/powering off the machine during them causes cross-departmental incidents that we'd like to avoid.

As such, these transactions must complete before reboot the machine to accept updates. We currently use an F5 Load Balancer which monitors a file with a control value that we change manually to allow updates; if the server is no longer in the load balancing table, the ongoing transactions can complete, and the rest of the new ones will be sent to the other servers.

I am attempting to find a way to allow for us to remove our server from the load balancer without shutting it down or turning off IIS (allowing a grace period for pending transactions while stopping new ones). We use SCOM currently, who's controls I do not have access to and the team tells me that it is not possible to specify a script or trigger before updates with our current infrastructure.

My idea is that we could configure a scheduled task script to trigger on the event ID that a Windows Update is ready to install, to take our server out of the load balancing, and then another when the update is finished to put it back in.

However, while I know that scheduled tasks work on event ID 19 (update success), I am unsure if it is possible for one to specify a task to take place before the update actually begins. The event ID I'm currently looking at is 43, Installation Started, but I have doubts that other tasks could run while this is happening (such as stopping and starting services, changing files, etc).

Does anyone have experience writing scheduled tasks or scripts around this specific event chain, directly before and directly after an update is applied?

Answer 1

Good Question!

How do you plan to patch the IIS Servers? What tool do you use? WSUS? SCCM? BigFix? Altiris? or any other?

The WAY of SCOM - Its possible to trigger a script on a specific event ID. SCOM - Run a script in response to an event detection

SCOM Script Template

You would need to define a service window to get your process automated.

Lets say you have planned to patch the IIS Servers using a service windows of 4 hours (6PM to 10PM), One server one day.

1. Remove the server from Load Balancer You can use PHP/Perl/Python/iRule to remove the server without a manual intervention.

F5 Load Balancer Programming

2. Allow a grace period for the transactions to complete. Here you can use some IIS specific scripts to monitor the sessions

3. Target the server for patch management and monitor for update download, installation and completion event id

4. Add the server back to your F5 Load Balancer

Common tool to use: Windows Powershell (since we are talking about IIS, Powershell is the best bet)

With the help of Powershell:

1. You can call a PHP function/URL that adds and removes a server from F5 load balancer.

Run a PHP script via Windows Powershell

2. Monitor IIS and Database (if required)

3. It can monitor the event id for Update Installation and finally reboot the server.

You can schedule a JOB using Windows Powershell.

Hope this helps. This is just an example.