|
|
Hi.
I have two Windows 2000 servers set up to provide Terminal Services to my
users (in application mode). None of the users are administrators on the
Terminal Services server. Automatic Updates is configured via GPO for these
servers, and I have configured "Allow non-administrators to receive update
notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
Despite having "Allow non-administrators to receive update notifications" to
Disabled, my users are getting the "Automatic Updates - Updating your
computer is almost complete. You must restart your computer for the updates
to take effect. Do you want to restart your computer now?" prompt (with
grayed-out buttons). I don't want the regular users to get that prompt and I
thought by configuring the "Allow non-administrators to receive update
notifications" policy to Disabled, they wouldn't get it. Am I doing
something wrong or misunderstanding the policy/behaviour? Thanks.
PJ.
|
|
Paul Jenkins wrote:
[Quoted Text] > I have two Windows 2000 servers set up to provide Terminal Services to my
> users (in application mode). None of the users are administrators on the
> Terminal Services server. Automatic Updates is configured via GPO for these
> servers, and I have configured "Allow non-administrators to receive update
> notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
> Despite having "Allow non-administrators to receive update notifications" to
> Disabled, my users are getting the "Automatic Updates - Updating your
> computer is almost complete. You must restart your computer for the updates
> to take effect. Do you want to restart your computer now?" prompt (with
> grayed-out buttons).
Are you sure this prompt is coming from the terminal server and not from the
computer the user is sitting in front of?
Harry.
|
|
On Wed, 9 May 2007 13:29:00 -0700, Paul Jenkins
<PaulJenkins[ at ]discussions.microsoft.com> wrote:
[Quoted Text] >Hi.
>
>I have two Windows 2000 servers set up to provide Terminal Services to my
>users (in application mode). None of the users are administrators on the
>Terminal Services server. Automatic Updates is configured via GPO for these
>servers, and I have configured "Allow non-administrators to receive update
>notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
>Despite having "Allow non-administrators to receive update notifications" to
>Disabled, my users are getting the "Automatic Updates - Updating your
>computer is almost complete. You must restart your computer for the updates
>to take effect. Do you want to restart your computer now?" prompt (with
>grayed-out buttons). I don't want the regular users to get that prompt and I
>thought by configuring the "Allow non-administrators to receive update
>notifications" policy to Disabled, they wouldn't get it. Am I doing
>something wrong or misunderstanding the policy/behaviour? Thanks.
>
>PJ.
What do you expect or require to happen. If you have configured the server to
automatically install the updates (option 4) then the server must reboot after
the install. I would recommend you set option 3 to download and notify. Then the
installation would be done by an administrator at a convenient time and the
system restarted if required.
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.
|
|
It's definitely coming from the server, within the RDP session. I can
recreate the problem on my notebook, which is fully patched and doesn't
prompt me. Thanks.
PJ.
"Harry Johnston" wrote:
[Quoted Text] > Paul Jenkins wrote:
>
> > I have two Windows 2000 servers set up to provide Terminal Services to my
> > users (in application mode). None of the users are administrators on the
> > Terminal Services server. Automatic Updates is configured via GPO for these
> > servers, and I have configured "Allow non-administrators to receive update
> > notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
> > Despite having "Allow non-administrators to receive update notifications" to
> > Disabled, my users are getting the "Automatic Updates - Updating your
> > computer is almost complete. You must restart your computer for the updates
> > to take effect. Do you want to restart your computer now?" prompt (with
> > grayed-out buttons).
>
> Are you sure this prompt is coming from the terminal server and not from the
> computer the user is sitting in front of?
>
> Harry.
>
|
|
Actually, Dave, you've made me think some more on this. The GPO enables the
"3 - Auto download and notify for install" policy. Our intention was that
our computer operations groups would log in and do the actual installations.
I think what's happened is that our computer operators probably installed
some updates that required a restart, and that they neglected to do the
restart. The message is actually an 'Updates have been installed ... restart
you computer' prompt, not a 'Updates are ready for installation prompt', and
the policy isn't designed to stop those restart prompts. Does that sound
logical to you? Thanks.
PJ.
"DaveMills" wrote:
[Quoted Text] > On Wed, 9 May 2007 13:29:00 -0700, Paul Jenkins > <PaulJenkins[ at ]discussions.microsoft.com> wrote: > > >Hi. > > > >I have two Windows 2000 servers set up to provide Terminal Services to my > >users (in application mode). None of the users are administrators on the > >Terminal Services server. Automatic Updates is configured via GPO for these > >servers, and I have configured "Allow non-administrators to receive update > >notifications" to Disabled ("Configure Automatic Updates" is Enabled!). > >Despite having "Allow non-administrators to receive update notifications" to > >Disabled, my users are getting the "Automatic Updates - Updating your > >computer is almost complete. You must restart your computer for the updates > >to take effect. Do you want to restart your computer now?" prompt (with > >grayed-out buttons). I don't want the regular users to get that prompt and I > >thought by configuring the "Allow non-administrators to receive update > >notifications" policy to Disabled, they wouldn't get it. Am I doing > >something wrong or misunderstanding the policy/behaviour? Thanks. > > > >PJ. > > What do you expect or require to happen. If you have configured the server to > automatically install the updates (option 4) then the server must reboot after > the install. I would recommend you set option 3 to download and notify. Then the > installation would be done by an administrator at a convenient time and the > system restarted if required. > -- > Dave Mills > There are 10 type of people, those that understand binary and those that don't. > |
|
On Wed, 9 May 2007 16:12:01 -0700, Paul Jenkins
<PaulJenkins[ at ]discussions.microsoft.com> wrote:
[Quoted Text] >Actually, Dave, you've made me think some more on this. The GPO enables the
>"3 - Auto download and notify for install" policy. Our intention was that
>our computer operations groups would log in and do the actual installations.
>I think what's happened is that our computer operators probably installed
>some updates that required a restart, and that they neglected to do the
>restart. The message is actually an 'Updates have been installed ... restart
>you computer' prompt, not a 'Updates are ready for installation prompt', and
>the policy isn't designed to stop those restart prompts. Does that sound
>logical to you? Thanks.
Yep
>
>PJ.
>
>"DaveMills" wrote:
>
>> On Wed, 9 May 2007 13:29:00 -0700, Paul Jenkins
>> <PaulJenkins[ at ]discussions.microsoft.com> wrote:
>>
>> >Hi.
>> >
>> >I have two Windows 2000 servers set up to provide Terminal Services to my
>> >users (in application mode). None of the users are administrators on the
>> >Terminal Services server. Automatic Updates is configured via GPO for these
>> >servers, and I have configured "Allow non-administrators to receive update
>> >notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
>> >Despite having "Allow non-administrators to receive update notifications" to
>> >Disabled, my users are getting the "Automatic Updates - Updating your
>> >computer is almost complete. You must restart your computer for the updates
>> >to take effect. Do you want to restart your computer now?" prompt (with
>> >grayed-out buttons). I don't want the regular users to get that prompt and I
>> >thought by configuring the "Allow non-administrators to receive update
>> >notifications" policy to Disabled, they wouldn't get it. Am I doing
>> >something wrong or misunderstanding the policy/behaviour? Thanks.
>> >
>> >PJ.
>>
>> What do you expect or require to happen. If you have configured the server to
>> automatically install the updates (option 4) then the server must reboot after
>> the install. I would recommend you set option 3 to download and notify. Then the
>> installation would be done by an administrator at a convenient time and the
>> system restarted if required.
>> --
>> Dave Mills
>> There are 10 type of people, those that understand binary and those that don't.
>>
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.
|
|
"Paul Jenkins" <PaulJenkins[ at ]discussions.microsoft.com> wrote in message
news:01DA8CCE-5D84-44AA-8540-CFBCCE0EFF3A[ at ]microsoft.com...
[Quoted Text] > Hi.
>
> I have two Windows 2000 servers set up to provide Terminal Services to my
> users (in application mode). None of the users are administrators on the
> Terminal Services server. Automatic Updates is configured via GPO for
> these
> servers, and I have configured "Allow non-administrators to receive update
> notifications" to Disabled ("Configure Automatic Updates" is Enabled!).
> Despite having "Allow non-administrators to receive update notifications"
> to
> Disabled, my users are getting the "Automatic Updates - Updating your
> computer is almost complete. You must restart your computer for the
> updates
> to take effect. Do you want to restart your computer now?" prompt (with
> grayed-out buttons). I don't want the regular users to get that prompt
> and I
> thought by configuring the "Allow non-administrators to receive update
> notifications" policy to Disabled, they wouldn't get it. Am I doing
> something wrong or misunderstanding the policy/behaviour? Thanks.
The only way to ensure these prompts are not presented to the user is to
*not* install updates during working hours.
Even more so critical for a Terminal Services server.
How do I apply updates to my Terminal Server using WSUS?
http://wsusinfo.onsitechsolutions.com/articles/033.htm
--
Lawrence Garvin, M.S., MCTS, MCP
Independent WSUS Evangelist
MVP-Software Distribution (2005-2007)
https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, almost everything else is at
http://wsusinfo.onsitechsolutions.com
.....
>
> PJ.
|
|
Lawrence Garvin (MVP) wrote:
[Quoted Text] >> I have two Windows 2000 servers set up to provide Terminal Services to my
>> users (in application mode). None of the users are administrators on the
>> Terminal Services server.
> The only way to ensure these prompts are not presented to the user is to
> *not* install updates during working hours.
Just as a data point, when I'm updating our terminal server I kick everybody off
and reboot the server before applying the updates. The reboot probably isn't
necessary but it makes me feel safer. :-)
Harry.
|
|
"Harry Johnston" <harry[ at ]scms.waikato.ac.nz> wrote in message
news:OKtJtM1lHHA.2272[ at ]TK2MSFTNGP02.phx.gbl...
[Quoted Text] > Lawrence Garvin (MVP) wrote:
>
>>> I have two Windows 2000 servers set up to provide Terminal Services to
>>> my
>>> users (in application mode). None of the users are administrators on
>>> the
>>> Terminal Services server.
>
>> The only way to ensure these prompts are not presented to the user is to
>> *not* install updates during working hours.
>
> Just as a data point, when I'm updating our terminal server I kick
> everybody off and reboot the server before applying the updates. The
> reboot probably isn't necessary but it makes me feel safer. :-)
That's probably a very good "safety point", Harry, and I believe I'll add
that step to the article on my website. (Which I hope to getting around to
updating within the next couple of weeks.)
--
Lawrence Garvin, M.S., MCTS, MCP
Independent WSUS Evangelist
MVP-Software Distribution (2005-2007)
https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, almost everything else is at
http://wsusinfo.onsitechsolutions.com
.....
|
|
Lawrence Garvin (MVP) wrote:
[Quoted Text] >> Just as a data point, when I'm updating our terminal server I kick
>> everybody off and reboot the server before applying the updates. The
>> reboot probably isn't necessary but it makes me feel safer. :-)
>
> That's probably a very good "safety point", Harry, and I believe I'll add
> that step to the article on my website. (Which I hope to getting around to
> updating within the next couple of weeks.)
I forgot to mention that it is probably a good idea to remove logon access to
prevent anyone from logging in while the updates are being installed. We have a
domain group which contains everybody who should be able to use the server, so
to block access I just remove the domain group from the Remote Desktop Users
group on the terminal server before the first reboot.
Of course, it's best to then remember to put the group back after the updates
are installed and the server rebooted again (if necessary) - I forgot one time
and had to deal with some grumpy users. :-)
Harry.
|
|
"Harry Johnston" <harry[ at ]scms.waikato.ac.nz> wrote in message
news:OcLPjLamHHA.1388[ at ]TK2MSFTNGP05.phx.gbl...
[Quoted Text] > Lawrence Garvin (MVP) wrote:
>
>>> Just as a data point, when I'm updating our terminal server I kick
>>> everybody off and reboot the server before applying the updates. The
>>> reboot probably isn't necessary but it makes me feel safer. :-)
>>
>> That's probably a very good "safety point", Harry, and I believe I'll add
>> that step to the article on my website. (Which I hope to getting around
>> to updating within the next couple of weeks.)
>
> I forgot to mention that it is probably a good idea to remove logon access
> to prevent anyone from logging in while the updates are being installed.
I believe that step is already documented in the article.
> We have a domain group which contains everybody who should be able to use
> the server, so to block access I just remove the domain group from the
> Remote Desktop Users group on the terminal server before the first reboot.
Excellent methodology!
> Of course, it's best to then remember to put the group back after the
> updates are installed and the server rebooted again (if necessary)
Ahh...yes.... "clean up" is every so most important.
> - I forgot one time and had to deal with some grumpy users. :-)
Ooooops. ;-0
--
Lawrence Garvin, M.S., MCTS, MCP
Independent WSUS Evangelist
MVP-Software Distribution (2005-2007)
https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, almost everything else is at
http://wsusinfo.onsitechsolutions.com
.....
|
|
|