Windows Software Update Services Question

Does any one know much about Microsoft Software Update Services? We have been using it for the past 3 months now and all seems good except for the notification of a restart on the user’s workstation.

I have an article with screen shots at www.comfirstcu.com pertaining to this.

What is happening here is when the install is successful and the workstation needs to be restarted, it prompts the user. The problem here is it prompts for a restart yes or no only the no is unelectable thus forcing the user to restart the system.

We are running on a 2003 domain with AD in place. Our users belong to a membership that does not have admin rights. We have enabled Windows update in the Group Policy to download and install at 6am daily. Everything is working as far as installing the updates via SUS, its just that the user is prompted to shutdown and is given only one choice but to choose yes and restart.

Is there a way to use SUS without having to force the user to shutdown immediately?

TIA

Keyer

 

EDIT: Sorry re-read your post...noticed you mentioned We are running on a 2003 domain with AD in place. Our users belong to a membership that does not have admin rights Forget all the stuff I wrote below.

Read Example 1 on page 61. I don't think that what your asking (un-grey "No ") is feasible without giving your users "Local-admin" access on the workstation.

I'm sure someone will correct me if I'm wrong.

Have you looked at the new Windows Update Services? that is supposed be available in the first half of 2005.

---------------------------------------------

Yes...You can use the Group Policies (gpedit.msc) or you can edit the Registry. I used the info from the SUS_Deployguide_SP1.doc on page http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx to setup our SUS server clients.

Note: When I mention page numbers these are the numbers that I see using OpenOffice 1.1.2 to view the Word document. The page numbers might be different if using MS Word.

From Group Policies...
Using the document from above on page 56.
Start "gpedit.msc" and navigate to Computer Configuration => Administrative Templates => Windows Components => Windows Update. With Windows Update selected, in the right-hand window you should have 4 policies that you can set. The last (bottom) one should be the "No auto-restart for scheduled Automatic Updates installations ". "Enable" the policy.

If you do not see "Windows Update" under "Windows Components" then you will have to install it using the instructions on page 55.

Now if you only see 2 policies that you can set then your using an older wuau.adm template. Go to => http://www.microsoft.com/downloads/...EA-D274-42E6-8025-8C667B4C94E9&displaylang=en to get a newer version.

For Registry...
From Page 60...No automatic restart with logged on users...
To prevent Automatic Updates from restarting a computer while users are logged on, the administrator can create the NoAutoRebootWithLoggedOnUsers registry value in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU. The value is a DWORD and must be either 0 (false) or 1 (true). If this value is changed while the computer is in a restart pending state, it will not take effect until the next time an update requires a restart.

HTH

 

Keyer - how about running the updates and rebooting before any users are on the PCs? Should be possible to use Wake-on-LAN to start up the PCs, do the updates, then shut down the PCs so when the user starts up for the day, the update will finish.

The updates that require a reboot normally will have some essential files stored in a temp folder and if those were somehow deleted before the restart you'd have a bad update.