WSUS ideal settings ('install later' greyed out)

[OverWorked]

I'm new to WSUS and have only just got it working. Now, I want to install updates on computers as silently as possible. I don't want users to be inconvenienced by it.

My GP settings are at the moment:-

* Configure automatic updates: enabled, 4 - auto d/l and schedule, every day, 13:00
* specify intranet: enabled (our wsus server)
* enable client-side targetting: enabled, test
* reschedule AU scheduled installations: not configured
* no auto-restart for scheduled AU installations: enabled
* AU detection frequency: not configured
* Allow AU immediate installation: enabled
* Delay Restart for scheduled installations: enabled - 30 mins
* Re-prompt for restart with scheduled installations: enabled 180 mins
* Allow non-admins to receive update notifications: enabled

The trouble is: they get the "automatic Updates dialog box at the scheduled installation time, but "restart later" is still greyed out. I've read that enabling "allow non-admins ..." would allow them to restart later, but it doesn't!

Does anyone else have this problem? What are your GPO settings?

What would be the effect of setting the scheduled installation time to midnight when they all should be switched off? Would they still get the updates installed automatically?

Please reply before I get another lynch mob looking for me at 13:00 tomorrow.

Thanks.

[Geoff]

remember there are also Wsus settings in the User section of the GPO that need to be set too. I think this would solve your 'allow non-admins' setting problem.

[Lord_Edam]

The trouble is: they get the "automatic Updates dialog box at the scheduled installation time, but "restart later" is still greyed out. I've read that enabling "allow non-admins ..." would allow them to restart later, but it doesn't!

Does anyone else have this problem? What are your GPO settings?

Had the same problem when we started with this. solved it eventually, see the attached image. I can't remember which setting cured the problem, though.

What would be the effect of setting the scheduled installation time to midnight when they all should be switched off? Would they still get the updates installed automatically?

not unless you configure the option to re-schedule scheduled installations. if that is enabled, WU will automatically launch the installation x minutes after the PC is turned on if there's any outstanding updates to install.

the user-side settings are just the same as machine-side settings for "don't display "install now and shutdown" options, you can do without them if they're configured on the machine-side

[OverWorked]

Thanks, Geoff.

The additional users settings are in system.adm. I only had wuau.adm installed, so couldn't see them. I've looked at them now but don't see how they're useful to me. They just hide the windows update options from the user.

I'll keep looking.

[OverWorked]

@Lord_Edam

Thanks for the screen shot. I'd already got mine pretty much like yours, but still not working. I've now included the setting from system.adm (the top two of your listing), but I don't see how they'll help. The crucial one is supposed to be "Allow non-administrators to receive update notifications", but I've always had that enabled.

I've also read that having any of the update with a deadline set will produce the same behaviour (i.e. not allowing them to delay a restart). How do I check for deadlines? :?:

This is the first time I've run WSUS for this client (I keep RIS-ing it to test the settings). So the first updates include the WSUS updates. Maybe these force a reboot, and don't allow the user to delay them - I'll keep looking. :?

[OverWorked]

Nope. It's still not allowing them to 'restart later' despite setting my GPO the same as Lord_Edam's. I've checked for deadlines and haven't got any set, so it's not that either. :banghead:

Our school ICT guy came out today about something else. He said the only way round it is to make the users local admins. I really don't want to to do that.

[john]

Ours pops up saying Restart Now but you can just ignore it thats what we do and our staff do. I am sure I have managed to get mine set to not prompt the user though they just don't restart, do yours have access to the Control Panel as ours don't and I wonder if that has some effect on it?

[OverWorked]

Thanks.

We don't allow access to to the control panel either, but I'm not sure if that would affect it. I'll try it when I get time.

Users can just ignore the message, but of course they don't. They just click 'restart now' then wonder why its restarting.

I've just scheduled the installations for the middle of lunch, when they're not used as much. IE7 is going in today, along with a load of security updates. I think I'll need to leave the building just before 13:00.

[Lord_Edam]

I've been digging through old emails to find how I fixed it, and came across http://msmvps.com/blogs/athif/archiv.../06/65550.aspx

so I don' think I ever fixed the problem myself, we just found a configuration that stopped people complaining!

either that or SP1 actually fixes the problem - but if you've only just installed WSUS you should have downloaded the latest version, so that won't be it.

We're holding off on IE7 as long as we can - we just now we'll be bombarded with "where's my favourites/search/home/weatherwatcher toolbar"

[Ric_]

Users don't have to be local admins or anything else stoopid like that. Mine works... I'll get back with the settings.

OK....

Windows Components/Windows Updatehide
Policy Setting 
Allow Automatic Updates immediate installation Enabled 
Allow non-administrators to receive update notifications Enabled 
Automatic Updates detection frequency Enabled 
Check for updates at the following 
interval (hours):  1 
 
Policy Setting 
Configure Automatic Updates Enabled 
Configure automatic updating: 4 - Auto download and schedule the install 
The following settings are only required 
and applicable if 4 is selected. 
Scheduled install day:  0 - Every day 
Scheduled install time: 03:00 
 
Policy Setting 
Delay Restart for scheduled installations Disabled 
No auto-restart for scheduled Automatic Updates installations Enabled 
Re-prompt for restart with scheduled installations Enabled 
Wait the following period before 
prompting again with a scheduled 
restart (minutes):  30 
 
Policy Setting 
Reschedule Automatic Updates scheduled installations Enabled 
Wait after system 
startup (minutes):  5 
 
Policy Setting 
Specify intranet Microsoft update service location Enabled 
Set the intranet update service for detecting updates: http://svr3 
Set the intranet statistics server: http://svr3 
(example: http://IntranetUpd01)

Hope that makes sense.

[OverWorked]

Thanks to you both. You're right about them not having to be local administrators. My admin office staff are local admins of their computers, and they still can't 'restart later'. (I realised that just last night).

However... My 'technician' account (not a member of local admins) and the domain administrator accounts are not affected by the problem, despite all the machines having the same GPO Automatic Apdates settings. It must be some other *user* GPO setting that's doing it. I'll keep looking.

I'll look into your suggestions later and let you know how I get on.