1

We have an enviroment that has mulitple sites and several servers that need to be running 24x7. They are all hosted on Hyper-V hosts at each site. We have fluctuating times when we can shut down servers and perform quarterly maintenance so WE, not Microsoft, need to control when updates are applied to the servers.

Years ago we had our GPO set to download and let admins install, but then some MS update along the way enabled updates to auto-install anyway. Now our latest GPO had Windows Updates set to:

Computer Configuration > Administrative Templates > Windows Components > Windows Update → Configure Automatic Updates = Disabled

This worked for the past year or more, but the week of July 4th we installed the 2025-06 cummulative update on all servers. On July 10th at 1:00 AM all of our servers installed the 2025-07 cummulative update which shutdown everything at every site for hours because the 2025-XX cummulative updates seem to take for ever to run and they had to run on the VMs and the hosts. It was a nightmare.

I know some are going to want to respond that you should never disable automatic updates for security reasons, which I understand, but this is not the case. We just need to be able to regain control of when patches are applied to our servers and if I need to totally disable the servers ability to update on its own then that is what I need to do. The only down times I have experienced in the past 5 years are due to untested Microsoft updates being crammed down my throat so I need this to stop.

Some of the servers are running DNS, Azure Connect, etc so restricting them from the Internet is not possible and trying to block sites that cram Windows Updates down is like playing Wack-a-Mole. What is the latest way to prevent any Windows Server from being updated automatically?

13 Spice ups
2

On the contrary, given how the world is at the moment, you want automatic patching on, by whatever method.

First of all, confirm dual scan is disabled, otherwise they will, on-reboot grab queued patches form MS and apply them.

But you can limit where they go and what ports are used.

For DNS, only allow port 53 out, outside of this, why would the server itself need internet access, for your AZ connect box, I would see this as less important, but limit it again to only where it needs.

I wouldn’t rely on WSUS or WU alone, if you want control, I’d invest in a patch management solution to do this.

I have no idea how many you have or need to manage, but Vendors > Action1 is FREE for the first 200, so if you’re device count is less than 200, there are no fees.

All devices will need internet access, but the agent will disable WU completely and take over this.

It also includes management of 3rd party apps.

For your situation, I didn’t see any mention of WSUS, so can you confirm this is pure Windows Update directly?

3 Spice ups
3

We did ours manually*, whether it was once a week, or once a month, researched each update & patch that that server wanted to install, and then manually installed them myself: for the larger ones I would give the Hyper-v clients more CPU’s so it wouldn’t take forever, and then set them all back to their paid for limit, It was all very manual: but the updates got done, on a regular basis, and there were no MS Induced downtimes: we controlled it.

If I remember correctly, we had set to updates to download, but not install, this gave us the list of updates so we could research them see if we actually needed it wanted it or not.

It’s like feeding your laundry into the washer one piece at a time, you can soak it give it more soap, ring it out, hand rub it a bit, give each piece due diligence before dropping them down in to the wash-bin that already filling and working. (not a perfect analogy, but you see my meaning I hope.

This manual method is only going to work for “so many computers” beyond that, you have to employ a tool or other delivery method: /Agreed. Something liek what Rod mentioned above would be my first stop in researching a replacement to the fully automatic MS deployment.

*We had 1 host with 4 to 7 clients on it, depending on who we had with us at the time. No a big workload, but it paid the bills!

3 Spice ups
4

JordanCN,

I think, that you are the victim of broken update 2025-06 with DHCP problem.
I have corporate rule for install updates for DC and important servers one-two weeks after Windows issued this and all updates for DC are approved manually.

You should have possibility for update Windows Servers, but you should have one-two servers for test updates before you will approve for other servers. DCs should be on the end of list.

3 Spice ups
5

I feel you… I have a few machines that are halted at different stages of Win10, even have a couple of 32bit machines running.
I am scared of this upcoming change - manufacturer, we cannot afford downtime & ‘please wait while we faff around restarting & don’t actually do anything’
The truly critical machines I lock down & use offline updaters to install critical updates, which will all change when I get them September Ready (anyone else hearing Pavlov’s dog?).
I have already noticed that those machines that are up to date, no longer have the ability to edit group policy etc. I am genuinely scared about the uncontrollable updates environment ~~ It’s ALIVE!!~~
Honestly, at this rate, the world will NEVER stop using embedded XP systems. We have already reverted some critical services to Linux based devices, with more planned.

4 Spice ups
6

Thanks Rod,

But I would have to say, given the way the world is, it makes me much less likely to want to trust Microsoft or any company with pushing updates that I have not vetted myself. The only downtime or disruptions I have faced in the past 5 years has been due to Microsoft or some other vendor forced updates. I am sure everyone here could give you a list.

Most of the actions you suggest are in place such as limiting access, 3rd party patching solutions, etc. But even when I try to limit where clients go, Microsoft has put in back doors to circumvent security measures.

5 Spice ups
7

Computers here are set to pull from Microsoft Update for Business via Intune. Servers are set via WSUS to pull but not install (GPO). Once a month (usually Friday after Patch Tuesday) I will login to WSUS, confirm the updates that MS has suggested (due diligence is important, make sure no one is reporting server-bricking). Then, Friday afternoon, updates will be installed and restarts scheduled for around 8pm that night. I’ll login and monitor, verify the servers reboot, check for critical services post-reboot, then call it a day.

3 Spice ups
8

Nothing stops you vetting them, your policies can be different for different devices, even with WSUS or WU.

Not sure how anyone can help if you are saying updates are forced, even if you decide not to apply them.

Best of luck.

3 Spice ups
9

Hey Jordan just thought I’d chime in with what I do. It works for me but it may not fit your situation. It also took some time to build out…

So I have all my Production VMs and Physical Host Server in an separate address groups in my main firewall. I have rules built for each service that needs to go out, which was built by making a ‘DENY ALL ANY ALWAYS’ one VM at a time, and then looking at the logs to see what actually needed to go out, and then building a policy for to allow each thing, with a DENY all below. They only talk to a few things that the applications that run on them contain that are actually needed, and only on certain ports. We are allowing of course EDR and SIEM.

How that looks is:

VM1 can talk to A on port 1
VM2 can talk to C on port 2
VM3 can talk to E on port 3
Host1 can talk to G on port 4
Host2 can talk to I on port 5
Host3 can talk to K on port 6
Production VMs Group can talk to EDR
Production VMs Group can talk to SIEM
Physical Host Servers Group can talk to EDR
Physical Host Servers Group can talk to SIEM
Production VMs Group DENY ALL ANY ALWAYS
Physical Host Servers Group DENY ALL ANY ALWAYS

Like I said it took a while I just picked out one VM and restricted it, figured each thing out, got it working, then DENY all after, then moved on to the next machine. Once they were all done one by one cleaned up the policies and grouped everything.

We use WSUS and it works perfectly fine for me, and they get no updates from anywhere else. We are aware of dual scan and are configured to prevent it. : )

Maybe this will help someone, or maybe this is so commonsense everyone is like “duh we’d do that if we could but it won’t work because of X” :laughing::man_shrugging:

4 Spice ups
10

Have you updated the ADMX files on the domain controllers recently, or ever? Two months ago, I updated the ADMX files for Win11, and the last time I had done anything with the ADMX files was in 2019. I had been running into servers & laptops ignoring the domain policies for years, and the last two Patch Tuesday cycles were significantly better, going from maybe 50% responding correctly to 90+% this month. I also had an additional Group Policy change with that ADMX update a couple months ago, so there might be coincidence instead of correlation, but the Group Policy was for a limited software installation that was not part of the OU the servers are in.

2 Spice ups
11

I was going through my notes and there’s actually one additional change I made specifically to the Server 2016 servers in late May, so I wasn’t thinking about June. I enabled the local policy of “Always automatically restart at the scheduled time” in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Update. It is enabled now with a time value of 15 minutes, and the Server 2016 scheduled reboots were a lot of my problem, but not all of it.

2 Spice ups
12

Thanks, but actually the point is I am not being allowed to vet them. As of July 4th, I was 100% patched with all Windows Updates, and less than 1 week later, this happened.

I had not changed my policy and there were no other updates waiting because I ran the check 2 times each server after patching to ensure there was nothing else waiting.

Main point is still, forced updates cause downtime at unpredictable times. I can’t think of a single company that finds it acceptable to have unpredictable outages just to apply an update.

2 Spice ups
13

I agree, and my point is, if they’re being forced, how can we help solve that?

Perhaps a little outside the box thinking. Instead of granting your servers full internet access, or even restrictive internet access, cut it off where you can, until you know your patching cycle is ready.

For example, if you patch every Sunday, disable internet access for your systems until Sunday, that way, when you enable it, any patches that are forced, will still be visible to you. But you choose to install them on Sunday only.

Most firewalls have schedulers for rules.

3 Spice ups
14

Please check these settings, especially if you are hybrid.

  • Windows Update for Business (WUfB) policies taking precedence
  • Feature and quality updates being pushed via cloud-based policies
  • “Update Stack Packages” and “Experience Packs” installing silently
  • Azure-connected services (like Azure Arc or Defender) potentially triggering updates
2 Spice ups
15

But I thought that some of the GPO were obsolete as Server 2016 or later (much like Win10 or Win11) have some options removed ? So now its like either download & install or do not download at all ?

Then normally updates should be installed on test or UAT or Dev servers before installing on their production counterparts. In some cases, we would also use VM snapshots before installing updates just in case.

One main reason why we moved off server 20xx with hyper-v role (since server 2012) was Windows Updates on hosts.

Maybe disabling the Windows Update Services ?

1 Spice up
16

If you want to really disable Windows update create a GPO and stop services “Windows Update” and “Windows Modules Installer” in Computer Configuration > Policies > Windows Settings > Security Settings > System Services

1 Spice up
17

I think OP just want to manually update instead of automatically update then the server reboots by itself ?

In the previous OSes, there is this option to either do not update or download but do not install…

1 Spice up
18

this is simply unrealistic. There is no way to truely do this and you are always trusting the vendor (and 100 others) the Published Vulnerabilities you are running are a much higher risk than any occasional (non malicious and recoverable) mistakes that may occur due to updates. You are better off explaining a couple hour outage that wasn’t’ malicious vs explaining why you haven’t patched for 3-6 months and are down with something like ransomware

A more realistic approach would be to delay installs so you are only applying patches that are 7-14 days old, and taking advantage of Heard Immunity for lack of a better word against mistakes.

You can mitigate update risks, you can’t mitigate risks from running published CVEs

@Action1 suggested by @Rod-IT already would be a good option as it will allow you to control your patching and update schedules which sounds like your biggest challenge.

2 Spice ups
19

Agreed, the last time you could see EVERY update Windows was pushing was back in XP when each patch was a line item/check box instead of a packaged rollup/cumulative update.

1 Spice up
20

heehee…last time had SP1, SP2, SP3, SP4 etc…but at least not “MONTHLY” ?

1 Spice up