WSUS settings on Servers/PCs

[Bruce123]

I just wonder what WSUS settings people have configured for their servers/PCs.

 

For servers, we currently have configured:

 

"Allow Automatic Updates immediate installation"

"4- Auto download and schedule the install"

"Schedule install time 3:00am"

"No auto-restart with logged on users for scheduled automatic updates installations"

 

My concern the effect of the latter option.

 

If if an RDP session is left (e.g. disconnected) on the server, will it delay the reboot until deadline for the update is reached, and then trigger an immediate reboot whatever the time (which could potentially be during business hours)?

 

Thanks,

 

Bruce.

[Steve21]

We use SCCM but in terms of windows updates we deny servers to auto install anything. Then push out what we want over half-terms etc. Seems safer than risking a random update nuking servers

 

Steve

[jthompson]

If you did want your servers to install their updates, but not have them go for restarts during work hours, you could set a deadline in the Automatic Approvals rules for them.

 

Use the setting "4- Auto download and schedule the install" as you have done, leave off the "No auto-restart with logged on users for scheduled automatic updates installations", but in Automatic Approvals, set a deadline for something like 7 days at 3am. That way, updates that require a restart to complete will install themselves, but the server won't be forced to restart (i.e. to complete that update) until 7 days later at 3am, regardless of the time of day that the update was first approved.