Group Policy Recommendations to enforce updates within 2 weeks of availability.

%3CLINGO-SUB%20id%3D%22lingo-sub-1060324%22%20slang%3D%22en-US%22%3EGroup%20Policy%20Recommendations%20to%20enforce%20updates%20within%202%20weeks%20of%20availability.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1060324%22%20slang%3D%22en-US%22%3E%3CP%3EI%20manage%20about%2060%20Windows%2010%20Pro%20systems%20for%20a%20small%20business%2C%20and%20I'm%20looking%20to%20help%20to%20implement%20a%20slightly%20more%20%22aggressive%22%20system%20update%20policy%20that%20the%20defaults%2C%20to%20help%20ensure%20that%20my%20users%20are%20receiving%20and%20installing%20updates%20within%202%20weeks%20of%20availability.%26nbsp%3B%20I%20am%20requesting%20any%20recommendations%20for%20me%20to%20make%20sure%20I'm%20cleanly%20implementing%20the%20following%20scenario%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20would%20like%3A%3C%2FP%3E%3CP%3E-%20Windows%20to%20search%20for%20updates%20daily%20(with%20the%20exception%20of%20maybe%20patch%20Tuesday).%3C%2FP%3E%3CP%3E-%20Windows%20to%20automatically%20download%20and%20install%20new%20updates%2C%20without%20prompting%20the%20user%20to%20do%20anything.%3C%2FP%3E%3CP%3E-%20I%20want%20the%20user%20to%20be%20prompted%20to%20restart%2Fschedule%20the%20updates%20once%20they're%20available.%26nbsp%3B%20I%20would%20like%20this%20notice%20to%20require%20user%20interaction%20and%20not%20be%20a%20temporary%20toast%20pop-up.%3C%2FP%3E%3CP%3E-%20%3CSTRONG%3EBut%3C%2FSTRONG%3E%20I%20want%20the%20user%20to%20be%20able%20to%20dismiss%2Fsnooze%20the%20updates%20for%20a%20period%20of%20up%20to%2014%20days.%3C%2FP%3E%3CP%3E-%20After%20the%2014%20days%2C%20I%20would%20like%20the%20system%20to%20force%20the%20update%2C%20%3CEM%3Eeven%20if%20the%20user%20is%20logged%20in%3C%2FEM%3E%2C%20but%20inform%20the%20user%20with%20a%20notice%20about%20the%20pending%20system%20restart%2C%20which%20would%20require%20user%20interaction%2C%20so%20that%20they%20are%20aware%20of%20the%20restart.%26nbsp%3B%20I%20would%20like%20them%20to%20be%20notified%20at%20least%20twice%20-%20the%20first%20one%20at%20least%20one%20hour%20before%20restart%2C%20and%20the%20second%20and%20last%20one%2015%20minutes%20before%20the%20forced%20restart.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E-%20Optionally%2C%20I%20would%20like%20to%20prevent%20the%20user%20from%20choosing%20to%20restart%20or%20shutdown%20without%20initiating%20the%20installation%20of%20pending%20updates%2C%20once%20they've%20been%20informed%20that%20updates%20are%20ready%20to%20install.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20feel%20that%20I%20have%20everything%20set%20up%20correctly%2C%20but%20wanted%20to%20see%20if%20there%20were%20some%20recommended%20group%20policies%20so%20that%20I%20can%20consolidate%20or%20clean%20up%20some%20of%20the%20ones%20I%20have%20configured%20for%20my%20users.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you!%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I manage about 60 Windows 10 Pro systems for a small business, and I'm looking to help to implement a slightly more "aggressive" system update policy that the defaults, to help ensure that my users are receiving and installing updates within 2 weeks of availability.  I am requesting any recommendations for me to make sure I'm cleanly implementing the following scenario:

 

I would like:

- Windows to search for updates daily (with the exception of maybe patch Tuesday).

- Windows to automatically download and install new updates, without prompting the user to do anything.

- I want the user to be prompted to restart/schedule the updates once they're available.  I would like this notice to require user interaction and not be a temporary toast pop-up.

- But I want the user to be able to dismiss/snooze the updates for a period of up to 14 days.

- After the 14 days, I would like the system to force the update, even if the user is logged in, but inform the user with a notice about the pending system restart, which would require user interaction, so that they are aware of the restart.  I would like them to be notified at least twice - the first one at least one hour before restart, and the second and last one 15 minutes before the forced restart.  

- Optionally, I would like to prevent the user from choosing to restart or shutdown without initiating the installation of pending updates, once they've been informed that updates are ready to install.  

 

I feel that I have everything set up correctly, but wanted to see if there were some recommended group policies so that I can consolidate or clean up some of the ones I have configured for my users.

 

Thank you!  

0 Replies