@dashrender said in Server 2012 R2 not installing Updates:

@scottalanmiller said in Server 2012 R2 not installing Updates:

@dashrender said in Server 2012 R2 not installing Updates:

Of course though - this thread is about Windows Server, not desktop - where this should be MUCH less of an issue with properly designed code.

Same code, they don't make it twice. Less hardware hotplugging, but probably just as many lines of code in use.

Less desktop apps on the platform, but you're right - the base code is the same.

Fewer desktop apps, maybe. But in the Windows world, server often is treated as a desktop (like 90% of the time) so the reduction is rarely what you'd hope. And there tends to be lots of server-only code too, often running as desktop apps.

@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@wrx7m said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@black3dynamite said in Windows Server 2016 RDS - GPO for Disabling Windows Update Notifications for Non-Admins/Users?:

@wrx7m Is that a computer configuration or user configuration policy? Try applying the rules to only non-admins groups.

Yeah, it is at the computer level. I would like to do it via user config but I only want them to apply to users on the RD servers. I need to figure out the proper way to structure AD/GPOs to not screw up everything else.

I am guessing creating another OU as a sub container and move the RD servers into.

Edit: Since it isn't GPP, there isn't any item level targeting, so I can't do it that way.

If you can make those changes directly in the registry, maybe can allow you to use GPP and item level targeting.

Hmmm. That makes sense. Let me mull it over.

@Fredtx This has usually worked for me in the past.

@wrx7m said in Server 2016 - Force Default Update Server to WSUS Server Via GPO:

@dbeato said in Server 2016 - Force Default Update Server to WSUS Server Via GPO:

This would have happened on Server 2012 R2 as well, dual scan has been around and causes a lot of problems as you noted.

It is strange that I didn't have these issues in 2012 R2. I essentially copied the same GPO for 2012 R2 and made some minor changes to it to convert it for 2016. My 2012 R2 show the correct default service.

Weird, I have various Server 2016and now 2019 with WSUS and while dual scan was an issue for me on Server 2012/ 2012 R2 not anymore.

@jt1001001 Thanks. If you are running from PDQ deploy, you won't see anything. But, if you are doing it from PS/ISE or similar, that would be a great help.

That screwed me over the other day with Exchange 2016, I clicked on Check updates and it started installing updates without any permission....

@EddieJennings said in Windows Server 2019 Updates:

I'm create a template VM for Server 2019 (one with and one without the GUI). I'm curious to see if any of you have seen the following behaviors.

Non-GUI

Use sconfig to download and install updates. Choose All updates, download, and install. After notification the updates were installed (appears about 5 seconds after choosing to install), you're prompted to reboot. After reboot, check for updates again to find the same updates still listed, repeat from step 2 endlessly.

GUI
Updates stay forever at "pending dowload"

GUI and using sconfig
Same behavior as using sconfig in the non-GUI environment.

Nope, you got something weird going on.

@matteo-nunziati said in Stay on windows 10 current-1. Is this possible?:

@Dashrender as a general rule you are right: decreasing too much the delay at the wrong time lets you install 1809. This is why I've not solved.

I'm guessing you got 1803 instead of 1809 because MS is super slow rolling 1809 because of the problems they had during the first role out.

@Donahue said in Security Updates Not Listening to Times.:

@WrCombs said in Security Updates Not Listening to Times.:

@Donahue said in Security Updates Not Listening to Times.:

@WrCombs said in Security Updates Not Listening to Times.:

@Donahue said in Security Updates Not Listening to Times.:

@WrCombs said in Security Updates Not Listening to Times.:

5:30-6:00 pm and he manually restarts everything and then everything works fine.
Right now I

So for us following along at home, what was the actual problem and what was the fix? It looks like you were saying that the MSE updates were running at 5:30 or whenever, but was it actually trying to run a scan at that time? Was that the actual cause of the slowdowns?

The problem was that MSE was installing updates daily at 5-5:30 causing the Point of Sale that runs off of that PC to freeze and lock up until they were restarted.
The fix?
I excluded our application directory from MSE updates and havent had a problem in 3 days.
I have checked and the updates are still coming in , but no system lock ups.

I don't see the correlation. How is excluding a directory from updates even a thing? I can see excluding a directory from a scan, but MSE doesn't get updates based on directories.

This is what I know : okay? Stay with me here;

My terminals on the front of house were locking up every time a Security Update came through on my Back office PC. Causing the Site to have to restart the terminals manually every time at the same time, Daily.

After excluding the Directory for my application, I haven't had an issue in 3 days, and counting at multiple of my Windows 7 Sites.

Could it be that the updates were spinning up more RAM to install these updates?

Could it be that The System was False Positive hitting as @Dashrender suggested?

I wonder if it wasn't also running a scan at the same time using the newly installed updates? That is the only thing that makes sense. I wont argue with the results, I was just not satisfied with the explanation, because I couldn't follow the logic.

I tend to agree that a scan must be happening - otherwise updates alone shouldn't affect the operation of the PC.

We have a set of Group Policy Objects that are set up at the domain level with WMI filters in place for two of the three.
The first has all of the key settings for updates that are shared across the board.
The second using a WMI filter to point only to desktop operating systems with the necessary settings in place for all desktop OS versions that we manage.
The third is for server operating systems only. It delimits to download but not update automatically along with a few other settings.

We've been using this setup since I can remember and not once have we hit servers auto-installing and rebooting. It's too risky for that to happen.

hello,

I 've had the same issues, and after many attempts and trying most suggestions I 've found online such as uninstall hyper v, remove antivirus, run windows update troubleshooter changing bios settings for virtualisation, and clearing windows>softwaredistribution folder, fixing Windows corruption errors with DISM & SFC tools and restarting bits and windows installer... and nothing seemed to do the trick.. until I thought to try decrypting the C drive i had encrypted with VeraCrypt... and bingo this fixed it for me...

@momurda said in WSUS preparation for Windows 10 Feature Upgrades:

Wow. Definitely not doing that if I have the same problems as you.
Ill just go around and install the upgrade manually.
Not even sure why MS still has WSUS, it is nothing but problems unless you spend hours a week fixing and maintaining it.

I hear ya, this took me an hour to research, make sure to gather correct logs and then do the how-tos.

@matteo-nunziati said in windows server updates: critical/cumulative/security:

ok,

I'm still confused about the terminology. Please, can you confirm and/or fix my interpretation?

critical: not a security fix, but something seriously broken is fixed here. security: a security fix, something seriously broken is fixed here and a security hole is closed. cumulative: just use this if you have missed a lot of stuff and you have a long queue updates otherwise. Download this bulk huge fatty thing and align with upstream. all other types... really too many types here, do they really worth?

Now the second question.

Having an hyperv server 2016 should I need to install critical fixes? I mean: if I do not notice any misfunction should I patch? to me it is right to patch as you never know when a critical bug will hit your usage.

Also, as a general rule I patch manually and I always require recommended updates only. Then I choose what to install.

any opinion/correction/suggestion?!

thank you.

I do at least Critical, security, and definition updates to all servers, hypervisors included.
For Windows10 desktops, I do everything.

But I do it all through WSUS.

https://www.theregister.co.uk/2017/04/13/microsoft_kills_support_old_windows_on_new_chips/

@BRRABill said in Argh! Windows 10 Updates...:

@scottalanmiller said in Argh! Windows 10 Updates...:

I patched mine with the Ubuntu 16.10 patch and it seems to work beautifully now.

You're like the Android people who keep talking about having a removable battery.

@BRRABill Even more annoying, I have a Lumia 950 XL Windows 10 Mobile phone and it has a removable battery too. :thumbsup_tone2:

Just saying ...

@scottalanmiller said in Updating Windows from the Command Line:

Keeping a system up to date is very important and doing so from the command line can be one of the easiest ways to do this on Windows.

Updating a Windows system, server or desktop, can be as simple as running this command as an administrator:

wuauclt.exe /detectnow /updatenow

If you only want to look for the latest updates without applying them, you can just run:

wuauclt.exe /detectnow

Also:
wuauclt.exe /a /detectnow

(/ResetAuthorization)

http://ss64.com/nt/wuauclt.html

All done. Thanks, guys! I am still learning using DC's, in case that wasn't obvious. 😛

Aww... I'm not trying to use WSUS - I'm trying good ol' MS update servers here.

The preview has always had the option for local network or Internet. Oh that the sending part can't be selected between the two. We're still going to keep using WSUS though.