There have been numerous posts where people ask about ways to delay (or cancel) the reboot of the client machine once the update is “installed”.
Let me attempt to elaborate on the relationships between download, install and reboot operations and how they should be spaced in time for the client machine to be in the most stable and secure state.
(1) Download and install are two independent and distinct operations.
(2) Install and reboot are two very closely tied operations.
Just downloading the update on your machine has no effect in patching the machine.
A downloaded but not-installed update does not affect the security or functionality of the machine in any way.
On the other side, for an update which requires reboot; the install and reboot operations should be tied together very tightly. For an update that requires reboot, the update is NOT installed until the system reboots. A partially installed update (pending reboot) results in a non-updated and insecure state of the machine. Also since this is a ‘synthesized’ state, it can result in instability.
Ideally, install and reboot should be a quantum operation.
Let me explain this point with an example.
Let’s say update U requires reboot.
You install U on your machine and have not rebooted the machine yet.
At this stage the update is NOT fully installed. Only after the machine is rebooted, the update is fully installed.
So as an admin, one should try to view install and reboot operations as part of a single transaction.
The admin should attempt to minimize the time for which any machine is in a reboot pending state.
Admins are far better off to schedule the installation of reboot required updates at a time when the system can be safely rebooted vs delaying reboot to introduce stability risk in combination with the system not being updated and protected.
There are various settings in the group policy which the can control the reboot behavior of client machine and the user experience around this.
Most relevant ones being
· No auto-restart for scheduled Automatic Updates installation
· Delay restart for scheduled installations
· Re-prompt for restart with scheduled installations
I will blog about it next. Stay Tuned…
Chinmay Parekh (WSUS)