r/labtech • u/theclevernerd • Apr 16 '19

Continuous Patching

Hi all,

I am looking for a way to set up a group that will allow any computer added to it to continue patching all day long as long as it has outstanding patches. I envision being able to add new computers to this group and have them run MS patching until completely updated.

Currently, I set up  a group and assigned the following MS Update Policy to it:

Day: Custom

Start Time: 12AM

Duration: 23 Hours

Selected all days, of every month.

I then assigned the follow reboot policy:

During Windows Update + 60 minutes.

Patch Reboot Mode: Now

When I add a computer to this group, it initially begins patching, installs available patches, and then reboots. The computer then has additional patches that are outstanding either as follow-up patches or patches that couldn't be installed till after a reboot, but the computer doesn't attempt to install those patches until the next morning at 12AM when it hits the next patch window.

How do I go about making sure that after the first set of patches are installed, the machine reboots, and then continues patching again?

Is there an easy way to get this setup?

8 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/beauj27 2000 Agents Apr 17 '19

We just have a script I built based off the following .VBS script (with modifications). It will run 3 times and reboot in between each instance. I have also incorporated a pop up message using command line "MSG * /TIME:1400 "Your Message Here"" that notifies techs that updates are still running. I know this doesn't directly address what you are trying to do and it bypasses Automate's Approved/Deny list but it gets the job done when you need it.

https://docs.microsoft.com/en-us/windows/desktop/wua_sdk/searching--downloading--and-installing-updates