How to manage Windows updates in a better way?

[san_narula]

We have windows 8.1 installed on most of our 50 laptops and 150 desktops. I have a WSUS server setup to handle the updates coming from MS. The problem is it is sometimes too disruptive to staff and students. Due to roaming profiles, I have advised everyone to try to use the same computer whenever they go to a lab so some of the computers do not get used much. Due to this, when someone logs into one of those computers, it downloads all those pending updates and next time it takes forever to boot as it is applying updates. Also, the wireless tends to slow down when all the laptops start downloading the updates at the same time. I am wondering how others apply updates and patches in a school environment. Am I missing something or doing something wrong. Should I turn it off during school days and only turn it on during term breaks to update them. But this will use up most of my time which I use for deployments and server maintenance.

I have been thinking of setting up FOG for a while to see if it is more flexible as WSUS is very basic in what I can do. Will it make things any better.

[seawolf]

FOG is a fantastic and very capable tool, but it isn't going to assist you with your scheduled Windows updates unless your intention is to use if for regular re-imaging in places of updates?

 

WSUS has quite a bit of flexibility and you can set updates to occur automatically at scheduled times. We have ours set to automatically download new (approved) updates and apply them at 4pm every day, after all classes have finished. The computers will reboot as necessary to apply the updates. This eliminates the problems that you are having with updates applying during the day or "building up" over time for the computers that are rarely used. It sounds like you don't have your GPO settings configured correctly to accommodate this. I've attached a couple of screenshots showing our WSUS configurations for our PC Labs.

[san_narula]

Hi Seawolf,

 

Thanks for the response.

 

I thought FOG also does updates but I might be confusing it with something else.

 

I have setup the GP in a very similar way but I will double check it. I think I have set it to install at 3:00PM as they are turned off at 3:20 when school finishes. Do you leave your computers on after school? All the updates have different requirements, some will install/configure while turning off and others do it when the computers are turned on. So how is this handled?

 

On a different note, I really like how you have put a comment for every GP you have configured. I wish I had enough time on hand to do the same. Is there any chance I can get some of your other GPs in HTML/CSV or another format? I will really appreciate as this will save me a lot of time typing and I will have a better idea what other school admins are doing.

[seawolf]

FOG was recently updated, but we haven't tested or deployed the new version yet so you made me wonder about the updates capability. Based on what I see on the FOG Wiki, there is still nothing related to updates (other than updating of the FOG agent), so must have been some other product you were thinking of.

 

We use the "Green FOG Service" to shutdown all computers at 8pm. We don't turn them off until then to provide time for all updates to apply and also in case we need to remote into any systems after school ends to do any work. If they all shut down at 3:20pm then we would often have to go around turning things on. All of our computers turn back on at 8am so any updates applied at startup will be completed before students ever arrive at school.

 

We don't comment on every GPO that we create, but for those where we think anyone might question why something is configured in a certain way in the future (or we might forget ourselves), we do add them in. I could probably pull out some information on our GPOs with the comments, but we're pretty busy right atm so it might take me a some time to get this to you.

[san_narula]

I also checked and FOG does not do Windows updates so it might have been something else I came across.

 

So I think the key here is to leave them on after school. I was trying to save some power but I think I have to adopt a similar strategy like put notices in the computer rooms to leave computers on after school on 'update Wednesday'.

 

There is no urgency so you can send the GPOs whenever you get a chance. You can email them to me.

[mrbios]

SCCM.

 

The functionality it adds to a standard WSUS server is insanely helpful. I hate WSUS on its own, within SCCM though it's very customisable. Takes a while to learn, and if you've never used SCCM before it's worth a training course + spending time on windows-noob.com looking through the extensive SCCM guides. Obviously it does a hell of a lot more than just WSUS too, but you don't have to use every part of it if you don't want to.

[free780]

We have windows 8.1 installed on most of our 50 laptops and 150 desktops. I have a WSUS server setup to handle the updates coming from MS. The problem is it is sometimes too disruptive to staff and students. Due to roaming profiles, I have advised everyone to try to use the same computer whenever they go to a lab so some of the computers do not get used much. Due to this, when someone logs into one of those computers, it downloads all those pending updates and next time it takes forever to boot as it is applying updates. Also, the wireless tends to slow down when all the laptops start downloading the updates at the same time. I am wondering how others apply updates and patches in a school environment. Am I missing something or doing something wrong. Should I turn it off during school days and only turn it on during term breaks to update them. But this will use up most of my time which I use for deployments and server maintenance.

I have been thinking of setting up FOG for a while to see if it is more flexible as WSUS is very basic in what I can do. Will it make things any better.

 

What's the spec of these laptops? Is the WiFi 802.11g or better?

[san_narula]

SCCM.

 

The functionality it adds to a standard WSUS server is insanely helpful. I hate WSUS on its own, within SCCM though it's very customisable. Takes a while to learn, and if you've never used SCCM before it's worth a training course + spending time on windows-noob.com looking through the extensive SCCM guides. Obviously it does a hell of a lot more than just WSUS too, but you don't have to use every part of it if you don't want to.

 

It is another thing on my list of things to do. Everyone tells me that it is not easy to setup so I want to make sure I spend enough time on learning and testing it before installing it in production environment. Hopefully will try it soon.

[san_narula]

What's the spec of these laptops? Is the WiFi 802.11g or better?

 

Laptops are 802.11N but our wireless isn't great. Looking at upgrading it which should make things better in future.

[san_narula]

@seawolf

 

Do you also have any laptops in your school and how do you manage updates on them. I am sure there is no way to turn them on remotely like desktops so do you leave them on all the time?

[Dos_Box]

I'll move this to the Windows 8 forum. Ideally I'd like to know what server version you are using as it really belongs in there.

[cpjitservices]

WSUS, with MDT to deploy the updates when Imaging. Thats how we handle it. and then it's down to GPO and WSUS afterwards.

[san_narula]

I'll move this to the Windows 8 forum. Ideally I'd like to know what server version you are using as it really belongs in there.

 

It's Windows Server 2012 R2

[Dos_Box]

It's Windows Server 2012 R2

 

Moving to Server 2012

[Duke5A]

We use Deep Freeze here and have it setup to wake the computers up at 1am; which is 1 hour prior to the schedule setup in GPO for Windows Update to download updates from WSUS and install them. Really, all you're missing is the component that can wake up machines on a schedule through WOL. There has got to be something out there that can parse DHCP logs and send out WOL when fired as a scheduled task.

[localzuk]

I think this issue isn't really a technical one to be honest - you have your options for deploying updates, the problem is an organisational one - the process of deploying updates interferes with the day to day running of the school.

 

So, I think what you should be looking at is a change of working practices instead. Look at weekend or out of hours work for example, or if that isn't possible, work with the timetable to apply updates during IT lab downtime.

 

We had the same issue here, and the only solution we were able to end up applying was to deploy the updates every half term break. Ok, this means potentially waiting a short period after some updates are released to deploy them, but it is the only practical way for us to do it at present.

[Blue_Cookeh]

We use SCCM here with maintenance windows. It means that all desktop/server machines wake up (using WOL), do their thing with updates etc, then shutdown at random times during 2am and 5am. With our staff/student laptops I simply set the same maintenance windows but if they're missed updates will still install and then keep prompting the users to reboot every few hours, up to a maximum of one week.

 

If they have to wait 10 minutes for updates to finish installing (which is rare now, since people can choose to install them or not) then tough poop!

[TechMonkey]

@Blue_Cookeh how do you set the reboot on servers? I've got most of SCCM setup how I want it but reboots after updates is still a bit shonky on servers.

[Blue_Cookeh]

@Blue_Cookeh how do you set the reboot on servers? I've got most of SCCM setup how I want it but reboots after updates is still a bit shonky on servers.

 

With our servers I do the reboots manually. I usually log in to all of them at least once a month and I'll get the usual SCCM updates popup asking me to reboot so I usually do it then since most of them have redundancy. If it's a sole server, I'll just schedule a reboot manually using the shutdown /s /t time-in-seconds command for that evening.

 

I trust SCCM to reboot our workstations, which aren't necessarily critical... I wouldn't trust it to do our servers, all it would take is for it to bring down both DCs at the same time or something and a lot of services would suddenly break.