Windows Updates - WSUS- GPO - Update and Restart...

[Koldov]

How does everybody deal with this?

 

I am constantly getting complaints that teacher laptops are restarting at unsuitable times.

 

I've looked through all the GPO settings and have to say I'm a little confused by some of them (some don't work if others are or aren't set, some override others etc.) but I can't even find a suitable time for them to 'Update and Restart'. We tried lunchtimes, but this made a restart happen when they return for afternoon lessons, we tried after school, but this interfered with meetings or teachers who wouldn't wait to go home and just 'closed the lid'.

 

There never seems to be a time that suits everyone of course and due to the inexact nature of the update installation/restart process, some laptops install before others and either get a restart warning or not (some delay, some if ignored or who don't get a warning just restart), sometimes the update and restart on shutdown doesn't even appear.

 

I know this is a bit of a non-problem for us as it's 'PEBCAK', (but even I've been caught out at the end of the day if I've been busy) and at least I seem to have managed somehow to stop it doing this during lesson times, but I would like a clear set of guidelines on what makes these update installations so hit and miss.

 

Also, what are the core GPOs that make this happen and have it happen reliably.

 

Firstly I need to know that the updates are installing obviously so I'm happy with the 'update in the background' part and not the 'let the user decide when to download' part), but then I need it to reliably warn the users that the updates have happened and that the machine needs to restart. Then I need them to able to defer that restart until a suitable time, but with the proviso that it will happen anyway within a set period of time (say 4 hours or so). Given the fact it has become a bit more complicated with 'active hours' and although I thought I'd set 'update notifications' it doesn't seem to happen reliably (though this is of course anecdotal) as with the 'Update and Shutdown' message.

 

It seems that the GPOs have varying degrees of accuracy (like within 1 day of the installation +20 hours given the phase of the moon)... But also updates that are installed when 'the computer is idle' means that some are installed at a suitable time and others maybe at lunchtime or at the end of the day when teachers are taking children to the playground to go home (and then come back to go home but get the update message).

 

There have also been times when the laptop comes up with the message that it is going to restart in say 5 minutes and then doesn't (possibly because of 'active hours' because when you go into the updates page it says 'due to restart at 16:40' or something (active hours 08:00 - 16:00)...

 

Sorry for the rant, but I have just finished a rather long and detailed email back to my teacher...

[Jaan]

You mention laptops...... we have this issue with the odd wifi windows based laptop (we have Chromebooks mainly)..... We find the Windows laptops aren't "on" long enough to get everything they need from WSUS. We have a set time we download and install our updates from wsus.

 

I'm happy to post our wsus/windows updates GPO if any good to you?

 

Our cable connected machines are all 99% upto date. But these have a permanent cable connection. We also ask staff to leave machines on at the end of the day, as our classroom management software (ABtutor) shuts everything down at a set time and applies any pending windows updates.

[Koldov]

The following are the basic settings I have applied:

 

Always automatically restart at the scheduled time – Enabled

The restart will give the users this much time to save their work (minutes) – 30

Configure automatic updating – Auto download and install

Scheduled install day – Every day

Scheduled install time – 15:00

Configure auto-restart reminder notifications (min) – 15

Specify the method by which the auto-restart required notification is dismissed – User action

Specify the period for auto-restart warning reminder notifications: Reminder (hours): 2

Specify the period for auto-restart immiment warning notifications: Warning (mins): 15

Specify the update notifications display options : 0 (default) – Default OS Windows Update notifications

Re-prompt for restart with scheduled installations – Enabled

Wait the following period before prompting again with a scheduled restart (minutes): 10

Reschedule Automatic Updates scheduled installations – Enabled

Wait after system startup (minutes): 1

Specify active hours range for auto-restarts - Disabled

[Jaan]

We don't notify users of anything......... and have;

 

No auto-restart with logged on users for scheduled automatic updates installations Enabled

 

and

 

Allow Automatic Updates immediate installation Enabled (this installs updates that don't need restarts)

 

also

 

Turn off auto-restart for updates during active hours Enabled

 

Edited April 16, 2021 by Jaan

[Koldov]

Possibly where my confusion lies then...

 

To me, this reads:

 

No auto-restart with logged on users for scheduled automatic updates installations Enabled - Don't restart if someone is logged on

 

and

 

Turn off auto-restart for updates during active hours Enabled - Don't restart in active hours (i.e. when the laptop is in school and being used - for us 08:00 - 16:00).

 

If both of those things are true then it doesn't get updated until the user shuts down (and if the user doesn't shutdown it never gets updated - you know the 'old close the lid and go home' scenario).

 

This was a big problem and why I started the whole 'restart' thing in the first place unfortunately.

[Jaan]

Yeah, we have this issue with the windows laptops....

 

what about setting a GPO to "shutdown" laptop if lid is closed...... ideally, shutdown and apply updates if that an option

 

We use ABtutor to shutdown machines and apply updates..... think the other classroom management stuffs allows this. not sure what you're using.

[Jaan]

Our power plan (forgive the name)

 

[Koldov]

Yes, this is for laptops, but no we don't have any classroom management software.

 

Just WSUS and me (sometimes I sneak around classrooms at lunchtime restarting their logged on and left open laptops)...

[Guest Guest]

We use SCCM to mange windows updates, I have the forced reboot set for 12 hours after installation, they get a prompt they can't get rid of 30 mins before the restart.

 

Never had any complaints

[sigma]

I have:

Specify the period for auto-restart warning reminder notifications: Reminder (hours): 96

Specify the period for auto-restart immiment warning notifications: Warning (mins): 240

For staff laptops. There still seem to be complaints.

 

My issue is with those staff who never bring their laptops to school for months at a time

[Koldov]

The only issue with shutdown on lid close is we end up with teachers wandering around the school with their laptops open, as they don't want to wait 30 seconds to startup again when they get to their next classroom/meeting...