GRitchie Posted May 21, 2015 Posted May 21, 2015 So, we have WSUS configured and working to deploy Windows updates. The problem lies with the end user not restarting... So, how do you do it? How do you ensure your staff restart their machine at least once a week. Ours complain 'it takes too long' 'I've not got time' and some don't restart in months! How do you make them restart without enforcing a strict restart GPO?
Domino Posted May 21, 2015 Posted May 21, 2015 How do you make them do it without making them do it? That's a tough one. Could you not enforce the restart over the weekend?
Steve21 Posted May 21, 2015 Posted May 21, 2015 Currently we don't but as we got same problems we're going to implement a once a month forced restart (daily obviously if no-one is logged on as BAT tests for that), so at least you know they will go down even if slowly Steve
GRitchie Posted May 21, 2015 Author Posted May 21, 2015 Currently we don't but as we got same problems we're going to implement a once a month forced restart (daily obviously if no-one is logged on as BAT tests for that), so at least you know they will go down even if slowly Steve Not a bad idea!! - BUT, the issue is they will always be logged on... :/ Unfortunately we can't send out restarts over the weekend because they take their laptops home and would no doubt be working on them!
smithson83 Posted May 21, 2015 Posted May 21, 2015 (edited) Could you not remotely reboot them over the weekend (or over night), when not in use. Inform them that this is going to happen and any data they lose from not logging off etc is their fault ###EDIT### Can still schedule a reboot, just needs to be a local Scheduled Task Edited May 21, 2015 by smithson83
fiza Posted May 21, 2015 Posted May 21, 2015 How much electric does it use for machines to stay on 24/7 ? With schools financing getting squeezed this could be forced through by SLT if you show them how much money would be saved just by switching off machines over night.
Steve21 Posted May 21, 2015 Posted May 21, 2015 Not a bad idea!! - BUT, the issue is they will always be logged on... :/ Unfortunately we can't send out restarts over the weekend because they take their laptops home and would no doubt be working on them! The BAT file is a local schedule task that hits during early mornings (forced wise), so that's their own fault if working at 3am haha Steve
LeMarchand Posted May 21, 2015 Posted May 21, 2015 Scheduled task for 0300/if idle/with retries/whether logged in or not/wake computer?
smithson83 Posted May 21, 2015 Posted May 21, 2015 (edited) Also, this should be classes as a security risk, not installing security fixes is a serious issue, and I would be tempted to disable Comp & User Accounts for machines that aren't at least updated once a month. See how much time they have then "If you never TAKE time, how can you ever HAVE time" - merovingian Edited May 21, 2015 by smithson83
GRitchie Posted May 21, 2015 Author Posted May 21, 2015 'Fiza' problem is, there's probably not that much electricity going to be saved because they're laptops and they'd charge them at home! The desktops ARE turned off! 'Steve21' that's a good idea, but once again some staff do work at 3am (don't ask...) and then if they're logged on regardless of using it, it wouldn't restart
Steve21 Posted May 21, 2015 Posted May 21, 2015 'Fiza' problem is, there's probably not that much electricity going to be saved because they're laptops and they'd charge them at home! The desktops ARE turned off! 'Steve21' that's a good idea, but once again some staff do work at 3am (don't ask...) and then if they're logged on regardless of using it, it wouldn't restart But if it's once a month forced they can just be told that day (e.g. last Friday in month) they have to have a restart. It's not daily, so not really an excuse from their part that they need to work daily like that. No different to anything else, if it's a lock down/security deployment they need to do it sometime. Steve
GRitchie Posted May 21, 2015 Author Posted May 21, 2015 But if it's once a month forced they can just be told that day (e.g. last Friday in month) they have to have a restart. It's not daily, so not really an excuse from their part that they need to work daily like that. No different to anything else, if it's a lock down/security deployment they need to do it sometime. Steve Okay, I suppose that could work and we could ensure it happens through SLT. In an ideal world I'd have them restart every week, if not every day, but I'll keep dreaming! So how could a task schedule be configured to understand the last Friday of every week?
fiza Posted May 21, 2015 Posted May 21, 2015 'Fiza' problem is, there's probably not that much electricity going to be saved because they're laptops and they'd charge them at home! The desktops ARE turned off! 'Steve21' that's a good idea, but once again some staff do work at 3am (don't ask...) and then if they're logged on regardless of using it, it wouldn't restart ahh. Didn't realise you were talking about laptops.
GRitchie Posted May 21, 2015 Author Posted May 21, 2015 No bother! Laptops are the burden of my career!
LeMarchand Posted May 21, 2015 Posted May 21, 2015 IIRC the calling shutdown from a scheduled task does give them warning. I spent a lot of time trying to make a honking big "no excuse for not seeing it" box, but never got it to work properly.
Steve21 Posted May 21, 2015 Posted May 21, 2015 Okay, I suppose that could work and we could ensure it happens through SLT. In an ideal world I'd have them restart every week, if not every day, but I'll keep dreaming! So how could a task schedule be configured to understand the last Friday of every week? There's advanced options for dates when you deploy the task schedule. See: So just setup your task and what you want it to do, e.g. shutdown forced blahblah, and set time/date Steve 1
gaz350b Posted May 21, 2015 Posted May 21, 2015 (edited) 1st of all get your machines into groups in wsus if you haven't. Go through updates each month and set deadlines for each update. I always set the deadline 30 mins or so before the end of the day. avoid important school events. Avoiding servers obviously after each patch Tuesday send out an email outlining the benefits of patching, why you do it and the easy steps they need to follow(suggest they do the same at home) Suggest that they press shutdown when they leave at the end of the today or tomorrow to do the update. Tell them that on xxxx date the deadline will pass for this months patches and their machine will forcefully install and restart their machine. Give them at least 10 working days and make sure the deadline happens at least 30 mins before the end of the day to make it an inconviemace they can't ignore in future. If anyone moans explain to them you have them plenty of notice and the policy isn't changing. By the 2nd and 3rd months 90% of your machines will be patched by the 1st weekend. Edited May 21, 2015 by gaz350b 1
GRitchie Posted May 22, 2015 Author Posted May 22, 2015 I like the sound of this 'gaz350b' - if we can get this approved this would work really well, as I agree eventually they'd get annoyed into doing it right! So to confirm, role updates every Tuesday as normal, TELL staff to restart weekly, if they don't, force a restart?
gaz350b Posted May 22, 2015 Posted May 22, 2015 The key part is setting the deadline within each update on wsus. Select updates right click approve for the group of commuters you want to roll it out to this then gives the option of right clicking and setting a deadline.
kennysarmy Posted May 22, 2015 Posted May 22, 2015 Reminds me I should do some WSUS maintenance - ! Is there no way that PC's that have been deleted from A.D. can be auto - deleted from WSUS?
markwilfan Posted May 23, 2015 Posted May 23, 2015 (edited) We have a powershell script that gets deployed twice a day to laptops via sccm. Looks at last reboot time and poos a message up if longer than 2 days, then logs this in a csv Edited May 23, 2015 by markwilfan
ITGURU Posted May 23, 2015 Posted May 23, 2015 Several Solutions to this: - I run a script every evening which shuts down all PCs - also saves on electricity when 200 are left on every night -worked out the cost of this and staff were surprised. - I set updates to auto-install at 3pm every day of which by the time the updates have downloaded and prompted for a restart it will be time for the staff to go home so will finish off updates as it shuts down. - I've disabled the option to auto restart - change the GPO option so that whenever they go to shutdown the computer it only has the option to 'install updates and shutdown' so it has to be done. same policy applies to staff laptops, so if they don't bring it in for 2 months and it sees the network and they do a shutdown it'll do the 20 updates if there is 20 so they'll have to wait!
GRitchie Posted June 1, 2015 Author Posted June 1, 2015 So I'm now taking on board the forced restart with a batch script but how do I test when the computer was last shutdown in a batch script?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now