[ltsb, 1607] Windows 10 and WSUS, updates to install on shutdown

[kennysarmy]

On our Windows 7 PC's the users get the option to shutdown and install updates when applicable.

 

Our Windows 10 PC's don't seem to ever get this, updates are pushed out via WSUS and the only machines on 100% up to date are those that have recently been "touched" by a domain admin who installed the updates manually.

 

Can anyone share with me their GPO for WSUS that allows non admins to install updates at next shutdown?

[kennysarmy]

Guessing no one else has this issue?

 

Normal users can shut down PC's and install updates?

 

Must be one of my GPO's then....

[KK20]

Our W10 GPO for WSUS:

 

computer->policies->Admin->windows components->windows update

 

Allow Automatic Updates immediate installation Disabled

Automatic Updates detection frequency Enabled

Check for updates at the following

interval (hours): 4

 

Configure Automatic Updates Enabled

Configure automatic updating: 4 - Auto download and schedule the install

The following settings are only required and applicable if 4 is selected.

Install during automatic maintenance

Scheduled install day: 0 - Every day

Scheduled install time: 16:05

If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below:

Every week

First week of the month

Second week of the month

Third week of the month

Fourth week of the month

 

Install updates for other Microsoft products

 

Delay Restart for scheduled installations Enabled

Wait the following period before

proceeding with a scheduled

restart (minutes): 15

 

Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box Enabled

Enable client-side targeting Enabled

Target group name for this computer CommonUpdates;Windows10

 

 

Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Enabled

No auto-restart with logged on users for scheduled automatic updates installations Enabled

Re-prompt for restart with scheduled installations Enabled

Wait the following period before

prompting again with a scheduled

restart (minutes): 30

 

Reschedule Automatic Updates scheduled installations Enabled

Wait after system

startup (minutes): 30

 

Policy Setting Comment

Specify intranet Microsoft update service location Enabled

Set the intranet update service for detecting updates: http://:8530

Set the intranet statistics server: http://:8530

Set the alternate download server:

(example: http://IntranetUpd01)

Download files with no Url in the metadata if alternate download server is set.

 

I always seem to be at 99% with updates, there always seems to be at least 1 update "waiting to be installed" at any one time....

Edited November 29, 2017 by KK20

[kennysarmy]

Curious as to your rationale on "Allow Automatic Updates immediate installation" : Disabled

[KK20]

because I only want the updates installing after 16:05 not during the day. "Wait after system startup" gets registration out of the way too. It should be noted that this policy is unchanged from our W7, W8.1 and W10 machines (WMI exists to point to different client side processing), it has always worked for us. Edited November 29, 2017 by KK20

[kennysarmy]

Some good stuff here:

 

https://community.spiceworks.com/how_to/1390-wsus-gpo-settings-for-the-real-world