How do I make Windows Updates install automatically without rebooting the server?

Question

We finally have the redundancy in place to put all of our servers on an automatic, staggered monthly reboot schedule. I also have a WSUS server and a group policy that points them to a Servers group on it. Up to this point, we've been manually installing updates on servers.

I'm trying to implement Group Policy to automate patch management like so:

1. Every Patch Tuesday, a sysadmin approves updates for the Servers group on the WSUS server that were published on the last Patch Tuesday (we want our servers to be 30 days behind on patches except for the test servers).
2. The servers download and install the updates automatically, but should sit at a pending reboot state.
3. When the server's scheduled reboot time rolls around, the server automatically reboots, thus completing the pending update process.

My issue is with the Configure Automatic Updates policy. The policy has four options (curiously numbered 2-5 instead of 1-4). Option 3 automatically downloads the updates but a sysadmin has to choose to install them. Option 4 automatically downloads and installs them, but wants to reboot the server automatically as well.

Looking at the other options, I only see three other policies concerning reboots:

• Always automatically restart at the scheduled time. This only affects Server 2012 and we have a bunch of 2008 R2 servers as well.
• Delay restart for scheduled installations. This policy can delay a reboot, but requires you to enter a value > 0 into the box.
• No auto-restart with logged on users for scheduled automatic updates installations. This only blocks reboots if a user is logged in.

So how do I direct Windows Update to automatically download AND install updates, but not reboot the server?

Solution

Interestingly enough, I'm working on a very similar project for a client.

Unfortunately, there isn't any way to download and install the updates and hold a pending required reboot. What you can do is download the updates and use a third party utility or VB script or Powershell script to install the updates and hold the pending required reboot. We've opted to use a Powershell script.

Two third party utilities that we tested that seem to work very well are:

Updates Deployment Commander

and

ABC-Update

Comments

[Riccardo]

could you share that powershell script?