[1709, fcu] Automatic Updates - installation settings

[gshaw]

With the majority of our Win10 machines deployed now I've noticed something that may come back to bite us or it may be a non-issue, hoping someone who's been running it for longer can confirm...

 

Until now we've used the "Download and Notify for install" option in WSUS with updates effectively installing on Shutdown. This works pretty well, used to have them on a schedule but it caused problems with exams and classes as machines were slowing down mid-lesson to install the updates.

 

Now with Windows 10 it seems that install on shutdown isn't a "thing" anymore and you'll only see that option once updates have already been installed and the machine needs to reboot. My question is if we don't schedule an install and have Active Hours set on default (8am-5pm) does that mean that updates will never actually install at all? I know after a certain period users will get that unavoidable nag screen saying "You need some updates" but again they can still cancel out of the install (as most will I'd imagine).

 

We've bought Impero this year and that seems to WoL machines better than anything else we've used in the past so that may become an option but not ideal as machines get unplugged, taken out the wall etc. so can't rely on a WoL maintenance window entirely for updates. Any thoughts on how to get around MS latest bout of silliness?

[Safa]

Hi So

 

I have been doing this method for some time:

 

I have the machines install the updates throughout the day and not restart. I then have a schedule on every machine to shut down the PC's at 8pm.

I have also disabled users from shutting down their machines, so when the machines do shutdown the updates get installed.

 

don't get me wrong its about 95% effective but its the best solution I have found in regard to keeping all the PC's up to date.

[gshaw]

Hi So

 

I have been doing this method for some time:

 

I have the machines install the updates throughout the day and not restart. I then have a schedule on every machine to shut down the PC's at 8pm.

I have also disabled users from shutting down their machines, so when the machines do shutdown the updates get installed.

 

don't get me wrong its about 95% effective but its the best solution I have found in regard to keeping all the PC's up to date.

 

@Safa thanks for this, by "install the updates throughout the day" does that mean you've set a scheduled install time or changed the maintenance window so it's outside normal hours and therefore updates will install as and when required?

[Safa]

I have it set for 19:00 but I have seen that sometimes Windows will install them earlier or throughout the day; I think security updates and app updates slightly differ.

but I have attached my GPO settings for you:

 

 

So the updates install at approx 19:00 and then with the task scheduled shutdown it will install the updates at 10 pm if there are any.

[WCHS_Panthers]

Safa,

 

How are you setting up your Group Policy for shutting down your machines at 8pm? I have been trying to create a GP to have nightly restarts but for some reason it just does not take affect.

 

Hi So

 

I have been doing this method for some time:

 

I have the machines install the updates throughout the day and not restart. I then have a schedule on every machine to shut down the PC's at 8pm.

I have also disabled users from shutting down their machines, so when the machines do shutdown the updates get installed.

 

don't get me wrong its about 95% effective but its the best solution I have found in regard to keeping all the PC's up to date.