Hardware

Ask something
Question Locked

Windows XP automatic updates causing restart without prompt

0 helpful
6 replies

by james.ryder

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

I'm having a bit of trouble with windows update in that when it wants to restart a machine, after it has automatically installed updates, it just does it without prompting.

Our users are in a locked down environment. They can only run programs allowed by policy (we specify exe's allowed to run) (wuauclt.exe and update.exe are allowed by the way). They cannot see, but have access to, the C drive, and are users on the machines, not administrators. Normally problems of this nature have been resolved by increasing permissions on certain folders/files or adding extra exe's to the allowed list. Oddly I can't seem to find what is stopping the windows update notification from appearing.

to clarify, users don't see the notification advising them of updates available, or downloading etc and don't know when their PC will restart. it is all set to happen automatically.

Our computer configuration is:
Allow Automatic Updates immediate installation - Enabled
Configure Automatic Updates - Enabled
Configure automatic updating: 4 - Auto download and schedule the install
Scheduled install day: 0 - Every day
Scheduled install time: 00:00

Re-prompt for restart with scheduled installations - Enabled
Wait the following period before
prompting again with a scheduled
restart (minutes): 15

Reschedule Automatic Updates scheduled installations - Enabled
Standard Workstation WSUS Policy
Wait after system
startup (minutes): 3

The user configuration also includes:

Remove access to use all Windows Update features - Enabled

This problem is not experienced by users who are not in the locked down environment, even if they use the PC's that are in that group. would the "remove access to user all windows update features" setting be causing this? and if so would turning it off allow our users to change the windows update settings?

Thanks

EDIT: i have compared the policy results from an unrestricted user/machine and a restricted machine/user and the only windows update policy difference is the user configuration:
remove access to use all Windows Update features - Enabled

6 replies

by oh smeg

You are unable to test the updates or in any way control them so if M$ push out a faulty Update that breaks things you are hit company wide with a reload/image demand. [b]Very time consuming and costly.[/b]

Use the WUS 3 option and push any updates out Company wide from the WUS server. But you should first test every Update to see that it doesn't adversely affect the business before deploying it.

Col

by james.ryder

all updates have to be allowed by our technical admins, it won't just update all the machines as soon as MS releases one. what I didn't put in my last post is that the update server is not microsofts server, it's ours.
This isn't even relevant to this discussion! hence why i didn't mention the server, this is about the restarts initiated by the updates.

by oh smeg

It's local owned & controlled by the company who then decides what & when gets pushed out across the company.

There seems to be a Major Design Flaw with your description of the system if it's pushing out Patches during working hours.

Fact M$ Security Patches at least require restarting the computers to take effect.

Windows Auto Update when enabled will restart computers automatically when the new Patches become available.

Personally I can't see what is being used here as it's not a Auto Update and by the description it doesn't appear to be a WUS update Service or if it is it's very poorly implemented but there may be a Corporate Reason for this that I'm not aware of.

[i]all updates have to be allowed by our technical admins, it won't just update all the machines as soon as MS releases one. what I didn't put in my last post is that the update server is not microsofts server, it's ours.
This isn't even relevant to this discussion! hence why i didn't mention the server, this is about the restarts initiated by the updates.[/i]

Now a couple of questions

[i]all updates have to be allowed by our technical admins, it won't just update all the machines as soon as MS releases one[/i]

Well what type of Update Service is being used here?

[i]This isn't even relevant to this discussion[/i]

What discussion this is a Question so I was assuming that you wanted an answer.

by james.ryder

The last part of our policy is this:
Specify intranet Microsoft update service location - Enabled

Set the intranet update service for detecting updates: **our local Server address here**
Set the intranet statistics server: **our local Server Address here

admins look at all the updates and select whatever ones they want etc...
the PC's look to our server for the updates.

so yes i know it's not owned by MS...

Now, as to the 'flaw' in my description... i'm not the person who controls all this so i'm no expert, but I would assume that, when machines are only turned on when the user gets to work in the morning, and turned off in the evening when they go home, there is no other time to update their machines. our updates are set to schedule at midnight after they are distributed... but obviously that never happens as the PC's are off then and it does it when they next turn on.... when the users are using them.

you say windows auto update will restart computers automatically.... although I agree I have to say that the users should be prompted to restart... and if they ignore it windows will eventually say "ok i'm restarting in 5 minutes"... that's what happens on my machine for example (as it's not in the locked down environment). on the majority of 'normal' users pc's it doesn't tell them anything at all... probably due to the policy difference i explained earlier. All i need to know is if i'm right in my assumption about that policy difference.

not sure on the specifics of the service we use.. do you need more detail than that it is a WSUS service?

by oh smeg

But when connected to a Domain and working under Domain Rules it doesn't apply. Look at it as a [b]Undocumented Feature[/b] not a fault because M$ Windows doesn't have any faults M$ told me so Honest. :D

Col

This discussion is closed to new replies.