wsus - Enforcing Update Installation

We just set this up to automatically install with the system scheduler at 5:00AM and reboot. In my orginization it would be extremely rare for somebody to be working at that hour so they would never see a message to reboot. Here are my registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://server:8530"
"WUStatusServer"="http://server:8530"
"ElevateNonAdmins"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"AUOptions"=dword:00000004
"AutoInstallMinorUpdates"=dword:00000001
"DetectionFrequency"=dword:00000002
"NoAutoRebootWithLoggedOnUsers"=dword:00000000
"NoAutoUpdate"=dword:00000000
"UseWUServer"=dword:00000001
"DetectionFrequencyEnabled"=dword:00000001
"RebootRelaunchTimeout"=dword:0000003c
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RebootWarningTimeout"=dword:0000000f
"RebootWarningTimeoutEnabled"=dword:00000001
"RescheduleWaitTime"=dword:00000001
"RescheduleWaitTimeEnabled"=dword:00000000
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000005

The only annoying thing is that our users get the little icon in the systray notifying them that there are updates available. This occasionally results in a call to the helpdesk, however we just tell the user to ignore this icon and the updates get installed overnight.

This is likely trickiest if your organization is big on saving energy costs and shut down each night, but if not I recommend setting updates to deploy approx 1.5 hours after the office has shut down.

Also, if you have a specific group of users who stay later than others you would create a new GPO for them and specify the updates for a different time.

Enforcing Update Installation

Comments: