2

I have been trying to find any pertinent articles online regarding this problem, but haven't uncovered much that is helpful.

For a couple months now I have been plagued with workstations and servers rebooting themselves for updates, despite the fact that my group policy explicitly tells it to not. The results of rsop.msc and gpresult /R both pull computer policies that configure the windows updates as such:

--Configure Automatic Updates - Enabled '2' (Notify for download and install)

--No Auto-restart with logged on users for scheduled.... - Enabled

I should note that there are no errors on the computer configuration policies for rsop.msc - but there are errors on the user configurations.

Are there some log files that might indicate why these policies are being ignored? Is it possible Microsoft is continuously releasing patches that are ignoring policy due to a critical security nature?

Thank you, and I apologize if this issue has been recorded somewhere else and I just haven't found it due to a failure of google-fu.

Update 1: I am able to run gpupdate /force without any incident and it says it completed successfully. Windows logs reciprocate this message by saying that the gp objects were detected and applied. Looking further through the logs I see an entry indicating that the server was being forced to restart in 30 minutes to complete installing a security update for IE 11 (among others, I am finding now).

Digging even more I am finding that the registry settings for Windows Update are all over the place - some configured correctly, some set to something that would seem conflicting: enter image description here

However, the "most important" setting "NoAutoRebootWithLoggedOnUsers" is clearly set to be enabled and stop it from rebooting while I was logged in.

  • Can you provide a complete GPResults html report for us to look over? GPResult reports should report reasons why polices weren't applied (if they weren't). Have you looked in the Windows Event Logs for errors relating to GPO application (that's where Windows logs things)? – Ƭᴇcʜιᴇ007 May 18 '15 at 14:17
  • I believe the No Auto start requires a 2nd policy to be active, also it is only when a user is logged on. Does the server/workstation reboot when users are logged on, or perhaps when they aren't? There are different policies located at different places that configure windows update. One section is for the user, where another is for the whole pc, and there is overlap too. I'm pretty sure you just have to finetune your group policy. – LPChip May 18 '15 at 14:28
  • @Ƭᴇcʜιᴇ007 I am not certain what gpresult would help with since it needs the context of what the individual policies say (is only specified in rsop.msc or on the domain controller itself). However, if you would like to see it anyways, could you assist me with uploading the text appropriately? I'm not very experienced in using this site. – ironman9330 May 18 '15 at 14:32
  • @LDChip - I am not aware of a second policy that has to be in place, but I will look that up. Yes, I was logged into the server when it rebooted earlier today. I didn't think there was any policy in User configurations that controlled reboot/update – ironman9330 May 18 '15 at 14:34
  • 5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.