Forced autodownload reboots - NOT LEGAL!

This is a very unhappy IT consultant, who has had several
Servers I am responsible for have a forced reboot of them
occur at 3:00am after downloading a security update.

the following is from the EVENT VIEWER:

Restart Required: To complete the installation of the
following updates, the computer will be restarted within
five minutes. Until this computer has been restarted,
Windows cannot search for or download new updates.
- Security Update for Windows Server 2003 (KB833987)

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I am dismayed at the apparent lack of concern for sites
operating 24/7 and forcing a reboot of critical server
systems after an autodownload! I got paged by two sites in
the middle of the night wanting to know why their Servers
just crashed!

These reboots should ONLY be done after fair warning and
be planned.
When has this policy changed? -it cost one of my
engineering sites a huge loss in productivity and $$$ due
to steel pattern cutting robot control files having to be
reloaded!
NOT HAPPY!
This shouldnt be allowed to happen!

Shenan
Wed Sep 15 20:02:38 CDT 2004

anonymous wrote:
> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for have a forced reboot of them
> occur at 3:00am after downloading a security update.
>
> the following is from the EVENT VIEWER:
>
> Restart Required: To complete the installation of the
> following updates, the computer will be restarted within
> five minutes. Until this computer has been restarted,
> Windows cannot search for or download new updates.
> - Security Update for Windows Server 2003 (KB833987)
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload! I got paged by two sites in
> the middle of the night wanting to know why their Servers
> just crashed!
>
> These reboots should ONLY be done after fair warning and
> be planned.
> When has this policy changed? -it cost one of my
> engineering sites a huge loss in productivity and $$$ due
> to steel pattern cutting robot control files having to be
> reloaded!
> NOT HAPPY!
> This shouldnt be allowed to happen!

Did you consult the articles on the update before installing?

Particularly:

Restart Requirement
In some cases, this update does not require a restart. The installer stops
the required services, applies the update, and then restarts the services.
However, if the required services cannot be stopped for any reason or if
required files are in use, this update will require a restart. If this
occurs, a message appears that advises you to restart.

I suppose you also scanned past this part:

To install the security update without forcing the system to restart, use
the following command at a command prompt for Windows Server 2003:

Windowsserver2003-kb833987-x86-enu /norestart

Maybe? Just Maybe?

--
<- Shenan ->
--
The information is provided "as is", it is suggested you research for
yourself before you take any advice - you are the one ultimately
responsible for your actions/problems/solutions. Know what you are
getting into before you jump in with both feet.

Colin
Wed Sep 15 21:53:21 CDT 2004


<anonymous@discussions.microsoft.com> wrote in message
news:30e101c49b86$e18b1d10$a501280a@phx.gbl...
> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for have a forced reboot of them
> occur at 3:00am after downloading a security update.
>
> the following is from the EVENT VIEWER:
>
> Restart Required: To complete the installation of the
> following updates, the computer will be restarted within
> five minutes. Until this computer has been restarted,
> Windows cannot search for or download new updates.
> - Security Update for Windows Server 2003 (KB833987)
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload! I got paged by two sites in
> the middle of the night wanting to know why their Servers
> just crashed!
>
> These reboots should ONLY be done after fair warning and
> be planned.
> When has this policy changed? -it cost one of my
> engineering sites a huge loss in productivity and $$$ due
> to steel pattern cutting robot control files having to be
> reloaded!
> NOT HAPPY!
> This shouldnt be allowed to happen!


I agree with you that all reboots on such a critical system should be
approved and planned, but by AUTOMATING it you are saying "do whatever you
need to do, because I don't want to manually do it"

But I guess this is a good reason to test patches on a test environment
before letting it go into production. Yes, this means that automatic
updates might not be a good idea in your environment. Are you using SUS?
SMS might be a better idea, to allow you more control over what goes onto
your systems and when. Yes it costs $$$ but maybe that's the product that
meets your needs.

Just my take on this...

Shenan
Wed Sep 15 22:16:50 CDT 2004

anonymous wrote:
> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for have a forced reboot of them
> occur at 3:00am after downloading a security update.
>
> the following is from the EVENT VIEWER:
>
> Restart Required: To complete the installation of the
> following updates, the computer will be restarted within
> five minutes. Until this computer has been restarted,
> Windows cannot search for or download new updates.
> - Security Update for Windows Server 2003 (KB833987)
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload! I got paged by two sites in
> the middle of the night wanting to know why their Servers
> just crashed!
>
> These reboots should ONLY be done after fair warning and
> be planned.
> When has this policy changed? -it cost one of my
> engineering sites a huge loss in productivity and $$$ due
> to steel pattern cutting robot control files having to be
> reloaded!
> NOT HAPPY!
> This shouldnt be allowed to happen!

Colin Nash [MVP] wrote:
> I agree with you that all reboots on such a critical system should be
> approved and planned, but by AUTOMATING it you are saying "do
> whatever you need to do, because I don't want to manually do it"
>
> But I guess this is a good reason to test patches on a test
> environment before letting it go into production. Yes, this means
> that automatic updates might not be a good idea in your environment.
> Are you using SUS? SMS might be a better idea, to allow you more
> control over what goes onto your systems and when. Yes it costs $$$
> but maybe that's the product that meets your needs.
>
> Just my take on this...


I'm shocked anyone would turn on FULL Automatic updates on a production
server in the first place, personally. You KNOW from experience that some
updates require reboots, just a fact - has been for years.. If you don't
want your servers rebooting without planning - why would you set them to
automatically install? heh

And if it wasn't automatic, then I have to wonder if the consultant in
question shouldn't consult the documentation more before performing such
updates.

--
<- Shenan ->
--
The information is provided "as is", it is suggested you research for
yourself before you take any advice - you are the one ultimately
responsible for your actions/problems/solutions. Know what you are
getting into before you jump in with both feet.

Vanguardx
Thu Sep 16 01:20:44 CDT 2004

"anonymous@discussions.microsoft.com"
<anonymous@discussions.microsoft.com>
wrote in news:30e101c49b86$e18b1d10$a501280a@phx.gbl:
> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for have a forced reboot of them
> occur at 3:00am after downloading a security update.
>
> the following is from the EVENT VIEWER:
>
> Restart Required: To complete the installation of the
> following updates, the computer will be restarted within
> five minutes. Until this computer has been restarted,
> Windows cannot search for or download new updates.
> - Security Update for Windows Server 2003 (KB833987)
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload! I got paged by two sites in
> the middle of the night wanting to know why their Servers
> just crashed!
>
> These reboots should ONLY be done after fair warning and
> be planned.
> When has this policy changed? -it cost one of my
> engineering sites a huge loss in productivity and $$$ due
> to steel pattern cutting robot control files having to be
> reloaded!
> NOT HAPPY!
> This shouldnt be allowed to happen!

You enable automatic updates to download and install (rather than just
notify you WITHOUT even downloading them) and you wonder why you got an
update that you didn't plan for?

You don't disable automatic updates and then wonder why you have no
control over what updates gets installed? You don't review ALL updates
before installing them?

You install updates FIRST on your *production* servers rather than test
on a non-production or test host? You really think all updates are safe
or do not alter previously established behavior?

Because you don't want to do the work of reviewing updates before
installing them on a test host before impacting your production hosts
and you relinquish all control to someone else, you think its
Microsoft's fault for doing exactly what you told them to do via
configuration? So how many MORE programs do YOU also have configured to
perform automatic updates on a *production* server? If you don't have
the luxury of testing patches first on a non-production host then notify
your client they will be susceptible to outages and possible corruption
of behavior to convince them to allocate resources for test platforms.
I haven't used them but maybe even VMware or Virtual PC could help to
provide a sandbox platform on which to test OS and program updates.

Or was this a joke post?

--
_________________________________________________________________
******** Post replies to newsgroup - Share with others ********
Email: lh_811newsATyahooDOTcom and append "=NEWS=" to Subject.
_________________________________________________________________

Stephen
Thu Sep 16 07:29:39 CDT 2004

> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for...

Then whoever is paying you should fire you and get a better IT consultant.

Not reading Microsoft's documentation on forced reboots? You should be shot.

Stephen Howe

Phillip
Thu Sep 16 11:57:16 CDT 2004

It is easly dealt with by using SUS and GPO to control how updates are
handled. This the normal way to run SUS, and SUS is the normal way to handle
the Updates.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

<anonymous@discussions.microsoft.com> wrote in message
news:30e101c49b86$e18b1d10$a501280a@phx.gbl...
> This is a very unhappy IT consultant, who has had several
> Servers I am responsible for have a forced reboot of them
> occur at 3:00am after downloading a security update.
>
> the following is from the EVENT VIEWER:
>
> Restart Required: To complete the installation of the
> following updates, the computer will be restarted within
> five minutes. Until this computer has been restarted,
> Windows cannot search for or download new updates.
> - Security Update for Windows Server 2003 (KB833987)
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload! I got paged by two sites in
> the middle of the night wanting to know why their Servers
> just crashed!
>
> These reboots should ONLY be done after fair warning and
> be planned.
> When has this policy changed? -it cost one of my
> engineering sites a huge loss in productivity and $$$ due
> to steel pattern cutting robot control files having to be
> reloaded!
> NOT HAPPY!
> This shouldnt be allowed to happen!

levinson_k
Fri Sep 17 09:45:43 CDT 2004

<anonymous@discussions.microsoft.com> wrote in message news:<30e101c49b86$e18b1d10$a501280a@phx.gbl>...

> I am dismayed at the apparent lack of concern for sites
> operating 24/7 and forcing a reboot of critical server
> systems after an autodownload!

Me too. I'm not sure it's Microsoft's lack of concern, however.

I've never had this problem with MS patches.

Despite what other people think, it's perfectly fine to enable SUS or
Automatic Updates to *download* patches to production servers if you
wish. However, you do have to fully read the SUS / Automatic Updates
documentation. It's not that hard... there are only about nine
registry values available, and only one to three of them make any
difference. The one or two values you want to change are these:

In the Windows Registry, under
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU:

NoAutoRebootWithLoggedOnUsers = use 1
0 = reboot notification dialog has no countdown timer, system waits
for user to select reboot
1 = reboot notification dialog has a 5 minute countdown timer, system
reboots unless canceled by a local Administrator.

However, AFAIK, if no Windows users are logged in or attached to the
server either locally or remotely, the server always reboots unless
you change the setting below. [This could be a good thing, depending
on your point of view.]

AUOptions: use 4 for workstations, use 3 for mission critical servers
that should not be automatically rebooted
3 = automatically download and notify of installation
4 = automatic download and scheduled installation.

Alternately, you might be able to use a server cluster and set the
install times on each server to be different, so that all servers are
not rebooted at the same time.

Additionally, you may want to consider using SUS server to control
what patches your servers get and when they get them, e.g. after the
patch has been tested and approved by you.

You might also want to notify your support staff that MS patches
almost always come out on the second Tuesday of each month.

I agree with you that if the default setting for Automatic Updates on
Windows server is to reboot the server automatically, I suppose that
might not be the best default setting, for the benefit of server
admins that don't completely read the documentation first.

I hope this helps. Don't give up on Automatic Updates, it's a great
thing when used properly.