Azure Update Management Windows Update Desired State Configuration
Published Dec 19 2022 06:18 AM 3,873 Views
Microsoft

Introduction

Even though the Azure Update Center is already in preview many of our customers are still using Azure Update Management (the solution that uses Automation Account and Log Analytics workspace) to patch their servers. During one of these engagements, we realized that some of the Operating System Settings for Windows Update was not configured the way business required and this leads to erratic reboots and servers not patching on their expected schedules. 

We needed a way to ensure our machines have the appropriate settings. 

 

Requirements

 

  • Machines do not have to be Domain Joined
  • Machines that were previously domain joined need to have their registries changed
  • Machines must not reboot outside of the Patch Schedule

 

Some of our answers can be found in the official documentation here, but for the reboots we need to dig a little deeper. Below are the registry settings we can configure for restart behavior. 

If you would like to see more here is a great web site that looks at group policy settings and can help you find what is and is not configurable.  

This PowerShell Script can be run to see which current Windows Update Registry settings are applied on your machines.

 

1.png

 

For our Specific Solution we will choose Option 2 from the above article.

In my GitHub Repository you can find the Desired State Configuration File that will remove all other settings and apply the above settings

 

2.png

Save this file as "WindowsUpdate.ps1"

 

Solution

 

Now for our last few steps we will use Azure Automation State Configuration (DSC) to import the Configuration and Compile it. 

 

3.png

 

Click on Configurations and add

 

4.png

Choose the WindowsUpdate.ps1 file that you saved

 

wernerrall_1-1669722173829.png

 

Compile the Configuration

 

5.png

 

Once the compilation is complete, we can add machines (called Nodes)

Go to nodes and click Add

 

6.png

Choose Connect for your Node

wernerrall_2-1669722462654.png

and then choose your configuration name as "WindowsUpdate.localhost"

7.png

 

Now you are ready to go. Once the machine comes back and applies this configuration it will adhere to the update schedules set in Automation Account Update Management. 

 

 

 

 

Co-Authors
Version history
Last update:
‎Nov 29 2022 04:01 AM
Updated by: