Avatar of sedberg1
sedberg1
 asked on

Configuring who can install MS Updates

Our domain has about 30 servers used for hosting LOB applications.  We do updates only quarterly but unfortunately we've situations where local admins have installed MS updates and rebooted servers when they should not have, disrupting service.  So, I wanted to see:

1. How to disable to pop-up that appears in the notification area that tells users there are MS updates ready to install.  I'm looking through Group Policy but can only find a setting to disable the pop up for non-admins.  And I can't remove certain domain users from the local admins group, however, those particular users are not domain admins.
2. How to restrict the MS updates so only domain administrators can install MS updates.  Can't find this setting and have looked online.

We're running purely 2008.  The DCs are both 2008 R2.  Forest and domain functional levels are 2008 R2.  All servers are part of the domain.  

Any suggestions?
Windows Server 2008Active DirectoryMicrosoft Server OS

Avatar of undefined
Last Comment
sedberg1

8/22/2022 - Mon
Krzysztof Pytko

All local administrators have possibility to do that, so you cannot restrict these users from installing MS updates.

The only one option is to restrict number of administrators on servers.

Regards,
Krzysztof
sedberg1

ASKER
What about the popups?
pnrhait

I am unsure of any GPO that will remove the pop notification for Windows Updates. I have all my servers set to not install updates. This way there is no notification.  We have our Change Windows every 3 Saturday of the Month. We review which patches need to be installed prior to the change window. Day of Change Window a email is sent to our Administrators to apply the certain patch which at that time they will download and install, while hiding the unwanted patches. These are for our critical servers. Everything else we use WSUS.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER CERTIFIED SOLUTION
sedberg1

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
sedberg1

ASKER
This is the right answer.