Prevent Server Restart after Windows Updates

Question

we have a number of servers in our office, as a small hosting company, and these servers are critical to business, ... web server, mail server, db server, etc.

On a semi-regular basis, when the machines get automatic updates, they just automagically reboot themselves in the middle of the night. A number of them have software which must be running on the console session (bad practice, I know, but out of my control). When they reboot themselves, these programs obviously shut down, leaving customers upset and services interrupted.

How do you set a Windows Server 2003 R2 machine to NEVER automagically reboot itself after updates? And perhaps, if possible, to instead email someone so that they are aware it needs a pending reboot and can schedule it for the best time?

Thanks in advance!

Solution 1

In group policy for the server, navigate to:

Computer Configuration->Administrative Templates->Windows Components->Windows Update->No auto-restart for scheduled Automatic Update installation

You can get to this by running gpedit.msc.

Reboot to apply changes.

Don't forget that your server won't be updated until you reboot and will be vulnerable to the threats!

Solution 2

You can accomplish this, and leaving updates installed waiting for a reboot does not leave the server in an inconsistent state. Updates that require a reboot are not applied until the reboot occurs. The settings to manage automatic updates are too numerous to list here, but you can manage them in a domain via Group Policy, or on stand-alone machines using Local Policy. Go to Computer Configuration>Administrative Templates>Windows Components>Windows Update.

Solution 3

The best solution that I am aware of is to turn off automatic updates. Then you schedule maintenance windows with your customers and apply the updates manually and do the reboot then make sure everything that you need is running after the reboot.

Just stopping the reboots is a bad idea because that gives the impression that you are fully updated when you really aren't since updates that need reboots to complete...well...you know...need reboots to complete.

Solution 4

If you can't (or don't want to) reboot a server, you should postpone update installation to when you can safely reboot it.

You should never install updates that require reboots without actually rebooting the machine; this leaves the system in an inconsistent state, and you can have any kind of troubles until a reboot is finally done.

Solution 5

I would suggest to keep the auto updates running, BUT have the servers only download the updates and not install them.

Have you thought about a WSUS server for easier patch maintenance?

View more solutions

Comments

[eidylon]

Well, for that same reason I'd rather not turn them off, just to keep things updated for sure, but get a notification to an email address that would notify several people so we are sure to be aware. Something like the operator notifications in Sql Server.

[Dave Drager]

But - lets be realistic. For most situations any kind of automatic update is not going to impact an installed program. If you do have software that ties in so closely with the Windows files, then you should turn it off. But for 90% of the situations out there, users will receive more security benefit from the automatic updates than the risk it will impact running software.

[eidylon]

Does running GPEDIT on the PDC actually edit the domain group policy? Because it says in the gpedit.msc console "Local Computer Policy".

[Dave Drager]

To deploy this to all of your servers, you will need to edit on PDC (or a PC on the domain) and apply that group policy to your servers. The directions I mentioned only edit local group policy - but I am not group policy expert!

[Srinivasan MK]

Don't forget though that you will remain vulnerable to whatever the patch fixed until you do the reboot.

[Matthias]

"Reboot to apply changes." - sigh ;-)

[Alexander.Iljushkin]

why the heck do I need to always reboot my server? this is server, and it's purpose is to be always running