Server 2016 Windows Update when using Hyper-v

[AndiMarv]

Hi All,

 

I have been looking into upgrading my Hyper-v hosts from Server 2012 R2 to Server 2016.

Everything seems to be in order except for one stumbling block - Windows Updates.

 

I have installed Server 2016 with a GUI, not clustered and no WSUS, I cannot find a way of preventing Windows updates from downloading, installing, and most importantly I cannot find a way of totally preventing the server from rebooting until I manually chose to do so myself.

 

With the existing 2012 R2 setup I either shut down the VMs and perform windows update manually or migrate the VMs to a different host and perform the updates, again manually.

 

Does anyone know of a way to replicate this in Server 2016?

Surely it must be possible to turn off the automatic updates...not everyone has clustering.

I have configured this GPO setting but the Windows Update app didn't change.

 

Thanks in advance

Edited October 19, 2016 by AndiMarv
Clarification

[IanT]

I would hold off jumping ship to Windows Server 2016, its only just been released.

 

In relation to your question though, without looking at the GPO side of things just stop\disable the Windows Update Service.

[Michael]

Just like Windows 10 in that respect, WSUS is the way to go to solve this, as it overrides Microsoft Update.

 

You then have the choice of manually authorising updates or no updates at all (via WSUS) and your Windows Server should behave as expected. This applies to all newer/modern Windows Server OSes, not just 2016.

[AndiMarv]

I guess I'll calm my itchy fingers for now then, I'll stick with Server 2012 R2 for the time being that way I can control when my server restarts without having to install a whole new service.

 

Thanks guys.

[Tefters]

That GPO you set does work, it works fine on my Windows 10 and 2016 servers in play at the moment.

 

It doesn't show anything on the front updated page but when you click on advanced it shows this:-

 

 

Updates will not automatically download and/or install unless you manually press the Windows update button on the machine.

[AndiMarv]

I will give this another look, I assumed the front page would give me an indication that the setting had changed. thanks for the pointer.

[Tefters]

I will give this another look, I assumed the front page would give me an indication that the setting had changed. thanks for the pointer.

 

Nah its Microsoft and consistency is not their strong point + they want to try and force the updates down your throat no matter what.

You can also for belt and bracers simply set the Windows Update service (WUAUSERV) to manual or disabled by hand or via GPO.

 

I personally am using that GP along with SCCM client however if I wasn't using SCCM then I would set the service to manual as well as the block GP and then trigger the service manually later via PSExec or a script. Seeing as your just talking servers though a simple GPO to set the service to manual assigned to their OU will do the trick and then trigger the service manually by hand when needed. I do that for my servers even though I have SCCM as maintenance windows and servers is b*ll*x when you have an environment in use 24/7, I patch every half term for 1 day.

 

Clients... Just let them auto-update via SCCM or WSUS.

Edited October 20, 2016 by Tefters

[Explorer]

If only ours would do the same... I can't even get ours to update. It says Downloading Updates, a list of updates shows & then they all disappear, I've even left it on overnight & it's still stuck at 0%. Really weird, proxy settings are correct as I can browse the web, windows 10 has no problem downloading updates here so it's not any firewall settings or anything like that.

 

Has anyone else experienced this? I wanted to get at lest one 2016 Domain Controller up & running by half term but not if I can't update it. If I can get the initial batch of updates done successfully I'll configure WSUS for 2016 updates but I just want to get the initial thing updated first before doing anything further or introducing any other 2016 servers.

[Fazza]

If only ours would do the same... I can't even get ours to update. It says Downloading Updates, a list of updates shows & then they all disappear, I've even left it on overnight & it's still stuck at 0%. Really weird, proxy settings are correct as I can browse the web, windows 10 has no problem downloading updates here so it's not any firewall settings or anything like that.

 

Has anyone else experienced this? I wanted to get at lest one 2016 Domain Controller up & running by half term but not if I can't update it. If I can get the initial batch of updates done successfully I'll configure WSUS for 2016 updates but I just want to get the initial thing updated first before doing anything further or introducing any other 2016 servers.

 

Try logging on as a different user with admin rights and try Windows Updates again. I had that issue with 2012R2 with updates just not downloading. I logged on as a different admin user, installed the updates OK and then it worked when I did it as the original user!

[AndiMarv]

It seems I have missed something somewhere, I have set the GPO as detailed above and checked using rsop that it is being applied by the server, there are no other GPOs overriding this one, I have even changed the same setting to disabled on the local policy for the server but nothing changes.

 

I do not get the orange text saying 'some settings are managed by your organisation'

 

I am tempted to simply disable the windows update service but this doesn't feel like the proper way of doing it.

[Fazza]

The way we manage Windows Updates on the servers is to use WSUS (actually we use SCCM which used WSUS to be technical) and tell the servers to get updates from that and then not push out any updates at all so when the servers check WSUS/SCCM for updates, there arent any so none get installed! I would guess this would work the same in 2016?? We (mainly me) then run Windows Updates manually on the servers during half-terms.

[Tefters]

It seems I have missed something somewhere, I have set the GPO as detailed above and checked using rsop that it is being applied by the server, there are no other GPOs overriding this one, I have even changed the same setting to disabled on the local policy for the server but nothing changes.

 

I do not get the orange text saying 'some settings are managed by your organisation'

 

I am tempted to simply disable the windows update service but this doesn't feel like the proper way of doing it.

 

Have you restarted the server? Sorry forgot to say you have to restart the server after the GPO has applied due to it being the new immersive control panel.

[AndiMarv]

Have you restarted the server? Sorry forgot to say you have to restart the server after the GPO has applied due to it being the new immersive control panel.

 

I have, multiple times (which is a pain in itself as it takes so long...I'm sure I read somewhere that we would be getting restarts which don't involve rebooting the hardware also)

There are a few Technet forum posts with people looking to do the same thing as me and encountering the same thing where the GPO is seemingly being ignored, I'm watching them closely.

 

I'm totally stumped, it seems like it should be a simple thing but I've spend days on this now.

[Tefters]

I'd just set the service to manual and stop it, wouldn't disable it as this is then a pain to enable and the start.

[Michael]

I have, multiple times (which is a pain in itself as it takes so long...I'm sure I read somewhere that we would be getting restarts which don't involve rebooting the hardware also)

There are a few Technet forum posts with people looking to do the same thing as me and encountering the same thing where the GPO is seemingly being ignored, I'm watching them closely.

 

I'm totally stumped, it seems like it should be a simple thing but I've spend days on this now.

 

I presume you've just created a WSUS Server GPO and linked it under the Domain Controllers GPO?

 

For member servers, I create a sub OU (under Domain Controllers), so they also can be dragged in here and pick up the same policies, otherwise they just sit in Computers which is useless!

[AndiMarv]

I presume you've just created a WSUS Server GPO and linked it under the Domain Controllers GPO?

 

For member servers, I create a sub OU (under Domain Controllers), so they also can be dragged in here and pick up the same policies, otherwise they just sit in Computers which is useless!

 

I have created the GPO with one policy object defined, to disable Windows Update, linked it to the OU where my server sits, and made sure in RSOP that the policy is applying.

So far as I can tell everything is setup correctly.

[Michael]

I have created the GPO with one policy object defined, to disable Windows Update, linked it to the OU where my server sits, and made sure in RSOP that the policy is applying.

So far as I can tell everything is setup correctly.

 

Sounds it. I have a 2016 VM on my notebook that I'm playing with. Will have a go now and see if it applies or not.

[Michael]

I think you're right, it doesn't work. I've copied settings like for like with an existing setup and some more.

 

I even adjusted active hours and this is ignored too.

 

I tried linking the WSUS Test GPO next to the Default Domain policy, as well as the Domain Controllers, same problem. I have also downloaded/installed the October 2016 fix already, so not sure if this has any bearing?

 

In summary, not good Microsoft have missed this!

[Michael]

Disabling the Windows Update service via GPO, then running gpupdate does work!

 

It clearly looks like a bug, yet I can't find anything performing a Google Search either. Hmm...

[AndiMarv]

I have seen some online forum posts relating to Windows 10 with the Anniversary update installed stating that the same thing is happening to them, but interestingly they are reporting that the actual behaviour of the Widows update matches the GPO setting just that the GUI shows no changes and even indicates that automatic downloads and installs will take place.

 

I will have to monitor this for a while as there are no automatic updates left for me to install right now.

[Michael]

Will try again when I get home, but logically Windows Server will try and download definition updates (for Windows Defender) if it isn't working.

 

If it doesn't you could be right it's a GUI problem, but then again, active hours didn't apply either for me.

[Michael]

I removed the duff WSUS server entry I created in Group Policy and prior to this Microsoft Update was failing as expected. Ran gpupdate and then it downloaded Windows Defender definitions as I speculated from Microsoft Update, so it does work. The GUI just doesn't state otherwise like it does Windows 10.

[AndiMarv]

Thank you for your help working through this one. I do home m$oft patch this at some point so that it is more clear when these settings are applied.

[Explorer]

Try logging on as a different user with admin rights and try Windows Updates again. I had that issue with 2012R2 with updates just not downloading. I logged on as a different admin user, installed the updates OK and then it worked when I did it as the original user!

 

That never worked but something really interesting... I opened CMD & used sconfig to update the server & strangely after 2 days of trying to update it the usual way, it actually worked through the command line.