Do you use Group Policy to manage your Windows Update Policy?

We all know it’s important to keep our servers updated. Unfortunately though, by default, Windows will automatically download and install all new Windows Updates on your servers. This will mean the servers will occasionally restart to install updates when you don’t want them too. You will also get annoying popups trying to get you to restart the computer.

Note: This rule is applied to both client PCs and servers.

It is also one more reason developers don’t like to join a company domain on their personal laptops!

Note: Server patching is also achievable via SCCM and you get more control over restarting windows like this. WSUS can also be used in conjunction with group policies to handle restart times better.

The best ensure you are still downloading updates but not installing them automatically is to use Group Policy.

1. Create an Organization Unit (OU) in Active Directory, and put all your Production Servers in the OU

2. Create a new Group Policy object and link it to the Production Server OU

3. Edit the new Group Policy object and drill down to
   Computer Configuration | Policies | Windows Components | Windows Update
4. Edit
   Configure Automatic Update Properties item and enable it
5. Set Configure Automatic Updating option to 3 – Auto download and notify for install

After the new Group Policy propagates, you will notice the update setting is now locked on the servers in the Production Server OU.

From now on your servers will be updated without unplanned reboots!

Check out "auto-update" rules for PCs and Servers.