WSUS Mind of its own.

[Theldron]

Hi all,

 

We use WSUS in my school and i have set it up to install updates on a Friday evening, but it seems that it chooses to do it on a Thursday when and will install the updates and restart when people are using the PCs even though I have setup an install time (Friday 17:00) and active hours (08:00 to 17:00) so not sure why this is happening. Here is a screenshot of part of the GPO:

 

 

Have I missed something? We currently have Window 10 Enterprise 2016 LTSB on all client machines.

 

Cheers

[jthompson]

Do you have any automatic approval rules in WSUS? You may have a deadline set there for clients to finish updates by. Any clients needing a restart to complete updates may be holding off from doing so, until they hit that deadline, even if they started the installation on time on the Friday before.

[Theldron]

Do you have any automatic approval rules in WSUS? You may have a deadline set there for clients to finish updates by. Any clients needing a restart to complete updates may be holding off from doing so, until they hit that deadline, even if they started the installation on time on the Friday before.

 

Hi, thanks for replying. This is what I have setup in WSUS.

 

[jthompson]

If your clients pick up any security, critical or update rollups updates on a Monday, they'll be forced to get them installed and finished 2 days after, at 3am. I think that takes you to 3am on a Thursday. That deadline will override your GPO settings that tell clients to wait until Friday at 1700: they're having to get started earlier than that. When staff start up their computers Thursday morning, Windows is forcing any updates that it needs to do to complete updates.

 

You could try increasing that deadline to more than a week (10 days, maybe), so that you're not forcing the clients to install before they reach Friday afternoon. After starting installation on Friday afternoon, the clients that are needing to restart to complete their updates will then be waiting until that 10 day limit elapses, if users haven't already restarted before then.

 

Edit: I'd better bracket all that with a big "I think". WSUS logic is a tricky thing to get your head around, as you've discovered.

Edited March 12, 2020 by jthompson

[Theldron]

If your clients pick up any security, critical or update rollups updates on a Monday, they'll be forced to get them installed and finished 2 days after, at 3am. I think that takes you to 3am on a Thursday. That deadline will override your GPO settings that tell clients to wait until Friday at 1700: they're having to get started earlier than that. When staff start up their computers Thursday morning, Windows is forcing any updates that it needs to do to complete updates.

 

You could try increasing that deadline to more than a week (10 days, maybe), so that you're not forcing the clients to install before they reach Friday afternoon. After starting installation on Friday afternoon, the clients that are needing to restart to complete their updates will then be waiting until that 10 day limit elapses, if users haven't already restarted before then.

 

Brilliant will give that a go, thanks mate.