Windows Updates. GPO?

[Gongalong]

Hi folks,

 

I want to ensure our servers are updated on a fortnightly basis and that the restarts happen around 2am. Is this best achieved via a GPO?

 

(We have MEMCM and use it for client Windows Updates with WSUS but (1) none of our servers have the CM agent installed and (2) I prefer to keep servers separate from MEMCM if possible.)

 

If best achieved by a GPO, does anyone have a list of what needs to be configured, or will the following achieve it?

 

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update

Specify deadline before auto-restart for update installation = 14 days

Turn off auto-restart for updates during active hours: Start = 3am, End = 2am

 

Thanks

[Oaktech]

I install updates by GPO as you describe, but I do the restarts by scheduled task (shutdown.exe /r) so that I can stagger the restarts to ensure there is always a DC up as we've had an issue where all 3 dcs were restarted for updates simultaneously and a whole load of other stuff messed up because DNS resolution, DHCP and AD were all unavailable at the same time.

[Gongalong]

Good point. I rebooted some of our root DCs at the same time and it caused one of them to corrupt.

 

Is there a GPO setting that ensure the updates get installed? The most likely candidate looks to be "Allow Automatic Updates immediate installation" but it seems sort of wishy washy about certain updates.

[Gongalong]

Hmm, I'm guessing that "Configure Automatic Updates" is the one to set, along with the task scheduled reboot.