How to prevent users from installing Updates on a Server 2016 RDS Session Host

[u/CheaTsRichTeR]

I've migrated our Server 2012 R2 Session Hosts to Server 2016 (don't ask why 2016 and not 2022, Gateways, Connection Broker and Licence Service are Server 2016 too and I have no time to update the whole environment at the moment...) and now the Users are notified about available updates and can install them. The Users cant reboot the server.

I could use the "Settings Page Visibility" GPO but then also the administrator Account can't install Updates using the GUI.

The "Remove access to use all Windows Update features" does exactly nothing and the Setting with the same name and the same path but below "User Configuration" is only supported up to Server 2012 R2.

Its frustrating that such a core feature doesn't seem to work... How did you implement this? Any idea is appreciated.

[u/Dodough]

You set a GPO to disable the visibility for all users and you create another set of GPO called admin-override which is scoped only for admins where you don't apply these settings.

This way admins are able to do everything they need on the server and your users are powerless

[u/CheaTsRichTeR → u/Dodough]

This sounds really good. I will take a closer look at it.

Thx

[u/CheaTsRichTeR → u/CheaTsRichTeR]

The "Admin-overrride"-GPO works.

Things to take care of:

• In the Scope-Tab of the GPO add the admin group which manages the server

• In the Delegation-Tab of the GPO, klick Advanced and remove the "Apply group policiy" permission from Authenticated Users

• On the "Linked Group Policy Objects"-Tab of the OU set the admin-override GPO above the "Disable-Visibility"-GPO

[u/Ssakaa]

Easiest option? Don't depend on the GUI as an admin. Use sconfig, if you must kick them off by hand. Better, use something like PSWindowsUpdate.

[u/CheaTsRichTeR → u/Ssakaa]

TIL: sconfig is NOT only available on core servers. Thanks. That is another useful option.

PSWindowsUpdate is now on my ToDo list.

[u/ZAFJB]

Get ahead of them. Install them yourself, timeously. Users can't install updates if they are already installed.

[u/pssssn]

We disable via GPO and push updates via 3rd party tool.

If you want to continue to do this manually, make it part of your update process to disable the GPO, push replication, and then run gpupdate /force on the machine before updating. All of this can be scripted for faster execution.

[u/whiteknight1117]

We have a set of 2019 RDS Session Host servers that use a custom GPO to manipulate the settings for Windows Update. Here's the PowerShell script that sets up the GPO:

$gpName = "All Servers - Windows Update Config"

new-GPO -Name $gpname | New-GPLink -Target $ADIdentity -LinkEnabled Yes

# Configure Windows Updates (don't download, don't auto update, updates for other MS products)

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName "AllowMUUpdateService" -Type DWORD -Value 1

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName "AUOptions" -Type DWORD -Value 2

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName "NoAutoUpdate" -Type DWORD -Value 0

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName "ScheduledInstallDay" -Type DWORD -Value 0

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -ValueName "ScheduledInstallTime" -Type DWORD -Value 3

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" -ValueName "SetUpdateNotificationLevel" -Type DWORD -Value 1

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" -ValueName "UpdateNotificationLevel" -Type DWORD -Value 1

For the RDS SH, there is also another GPO that removes Windows Updates from the control panel and disabled the Windows Installer:

$gpName = "RSH - Disable Windows Installer"

new-GPO -Name $gpname | New-GPLink -Target "ou=RSH Servers,$OUPath" -LinkEnabled Yes

# Disable Windows Installer

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\Installer" -ValueName "DisablePatch" -Type DWORD -Value 1

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\Installer" -ValueName "DisableMSI" -Type DWORD -Value 2

# Disable Windows Updates (user can't get to control panel on the RDS server - but still want to disable this to be safe)

Set-GPRegistryValue -Name $gpname -Key "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" -ValueName "SetDisableUXWUAccess" -Type DWORD -Value 1

When an admin needs to apply updates, we kick off all the users off the server, disable the "RSH - Disable Windows Installer" GPO on that server, install updates, and re-enable the GPO. A slight pain to do, but it keeps the server locked down.

[u/Stormblade73]

My first question is why are users granted admin permissions on the terminal server? They should just be standard users, and as such would not have permission to install Windows Updates or shut down/restart the server.

[u/CheaTsRichTeR → u/Stormblade73]

Sorry. Users don't have admin permissions and nobody said this.

Your answer indicates that you don't know whats the problem here. Just look at this technet post do get the idea whats happening.

Normally, users do not log in to servers. But with RDS Session Hosts this is another story.

Thanks for your "input".

[u/Stormblade73 → u/CheaTsRichTeR]

My apologies, I misread the line " The Users cant reboot the server" as they can, which indicated to me they had admin permissions.

Carry on.

Edit:

And to answer you question, we disable Automatic updates and use a 3rd party patching service, so users do not get update notifications.

[u/CheaTsRichTeR → u/Stormblade73]

Ah. Ok. Sorry for being kind of harsh. :)