I had a bit of an unexpected event this afternoon. A Windows Server 2012 R2 terminal server rebooted itself unexpectedly after an update installation, contrary to the settings set in the Group Policy.
The following GPO applies to the server:
Windows Update
Data collected on: 2016-12-19 16:23:58
General
Details
Domain xxxx.xxxxxxxxxxx.net
Owner XXXX\Domain Admins
Created 2016-11-15 13:36:44
Modified 2016-11-15 13:39:40
User Revisions 0 (AD), 0 (SYSVOL)
Computer Revisions 5 (AD), 5 (SYSVOL)
Unique ID {91ADBD9A-8488-4F98-B04A-9C8029A437B2}
GPO Status Enabled
Links
Location Enforced Link Status Path
xxxx No Enabled xxxx.xxxxxxxxxxx.net
This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:Name
NT AUTHORITY\Authenticated Users
Delegation
These groups and users have the specified permission for this GPOName Allowed Permissions Inherited
XXXX\Domain Admins Edit settings, delete, modify security No
XXXX\Domain Computers Read No
XXXX\Enterprise Admins Edit settings, delete, modify security No
NT AUTHORITY\Authenticated Users Read (from Security Filtering) No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No
NT AUTHORITY\SYSTEM Edit settings, delete, modify security No
Computer Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the central store.Windows Components/Windows Update
Policy Setting Comment
Allow Automatic Updates immediate installation Enabled
Allow non-administrators to receive update notifications Disabled
Always automatically restart at the scheduled time Enabled
The restart timer will give users
this much time to save their
work (minutes): 15
Policy Setting Comment
Configure Automatic Updates Enabled
Configure automatic updating: 4 - Auto download and schedule the install
The following settings are only required and applicable if 4 is selected.
Install during automatic maintenance Disabled
Scheduled install day: 0 - Every day
Scheduled install time: 03:00
Policy Setting Comment
Turn on recommended updates via Automatic Updates Enabled
User Configuration (Enabled)
No settings defined.
The expected result therefore should be that the server should install any updates with no impact immediately, and install any updates not requiring any reboot at 3 AM, after which it will reboot.
The actual result is that the server rebooted at 16:51:30 with the following message in WindowsUpdate.log:
2017-01-11
16:51:30:071
812
1368
AU
Client has determined it is safe to reboot without warning. Rebooting now...
By using the TerminalServices-LocalSessionManager log I have been able to determine that the last user of the terminal server logged off for the day at 16:41:29, so it would seem that after exactly 10 minutes of nobody being logged onto the computer, the machine
did reboot. The full
WindowsUpdate.log is available for review.
Further analysis of the log does seem to indicate that updates that required reboots were installed at 03.00 at 2017-01-11 as per the setting, but for some undetermined reason, the server was not rebooted at that time.