locked
Unexpected server reboots - KB2992611 RRS feed

  • Question

  • Hi Guys

    Something strange appears to have happened this morning.

    We use WSUS to keep all windows servers up to date and have group policy set so that the servers check for updates @ 7am on a sunday.

    Our downtime window is every 3rd sunday so I tend to approve any unapproved updates on the thursday/friday beforehand and the servers check for their updates and reboot if necessary on sunday as expected

    Last week we were told by our security team that we needed to patch KB2992611 urgently. So I went ahead and set the update to approved and set a deadline of 16/11/2014 @ 7am.

    On sunday afternoon I ran a report against KB2992611 and I saw that all servers had reported this had been installed successfully.

    However, I've come in this morning and several servers have rebooted @ 7am today. Having checked WSUS it looks like KB2992611 has been released as it has a release date of 18/11/2014. The update also had the deadline set to 16/11/2014 so is this why the servers rebooted?

    If this is true does this mean that if any updates are rereleased after a deadline has been set my servers will reboot?

    As you can imagine we can't allow servers to reboot outside of our downtime so do i need to clear the deadline set on any previously installed updates?

    Many thanks

    Robbie

    Wednesday, November 19, 2014 9:45 AM

Answers

  • Thanks for the input everybody.

    No more servers have rebooted since I marked the update unapproved so I think my servers will ok until our next downtime (3rd sunday in December).

    I just don't understand how Microsoft can justify 'tricking' wsus into thinking this new 'rereleased' update was already approved. They should really have given it a new KB number.

    Robbie

    • Marked as answer by Steven_Lee0510 Sunday, November 30, 2014 3:04 PM
    Thursday, November 20, 2014 8:52 AM

All replies

  • Hello,

    I'm currently experiencing the same issue. My servers are all configured to update once a month. The updates start installing Friday night and the deadline is Sunday night. So the server will reboot sunday night.

    The KB2992611 update was releases last week. it has been approved by WSUS on Friday together with a couple of other updates. The installation of the KB2992611 was started today. (even tho the other updates installed Fryday/Saturday with the deadline set on Sunday, The server rebooted sunday without any trouble)

    I think the KB2992611 update needs to be installed seperately. The problem in my case was that this policy was not set sorrectly:

    "Re-prompt for restart with scheduled installation was" set to "disabled"

    Perhaps the KB2992611 update is installed after the rest of the updates. When you dont specify the policy to prompt for a reboot i gues it just reboots when it seems fit. It's a bit stange but it's the only real explanation I could find.

    I hope this might help you out even tho the damage has already been done... in my case.

    Thijs


    Wednesday, November 19, 2014 11:38 AM
  • Hi Thijs

    Thanks for your response. I'm sorry to hear that you to have had the same problems as me!

    Interestingly only Hyper-V 2008 hosts seem to have installed the update 'twice' is this the same for your environment? or should I be expecting more servers to reboot at somepoint later today? :)

    Thanks

    Robbie

    Wednesday, November 19, 2014 11:44 AM
  • Robbie,

    My hosts are running on VMware 5.1. The update is indeed installed twice (i didn't notice this before). The problem occurred on all my Windows server operating systems. (2003, 2008, R2)

    I think you problem might be a little more complicated...

    The problem with the reboot seems over for me now. it started this morning around 7 and the last reboot was 11:00. Now i need to check all the WSUS policy's on all servers we are running. Just to make sure that the other servers don't reboot.

    I don't understand why the update has to be installed twice... I just hope these sudden reboots won't happen to me again! I will keep following the post and keep you posted if i find out more.

    Thijs

    Wednesday, November 19, 2014 12:20 PM
  • I have had the same issues in my labs across multiple operating systems.
    It seems the patch KB2992611 was re-released on November 18th.
    I'm not sure why the second release would install without approval.

    I approved this patch with a deadline for November 12.  And it installed on November 12.  Then on the 18th and 19th had most of my 3000+ systems reboot without any subsequent approvals, and the patch installed again.

    Wednesday, November 19, 2014 8:46 PM
  • Thursday, November 20, 2014 4:51 AM
  • Thanks for the input everybody.

    No more servers have rebooted since I marked the update unapproved so I think my servers will ok until our next downtime (3rd sunday in December).

    I just don't understand how Microsoft can justify 'tricking' wsus into thinking this new 'rereleased' update was already approved. They should really have given it a new KB number.

    Robbie

    • Marked as answer by Steven_Lee0510 Sunday, November 30, 2014 3:04 PM
    Thursday, November 20, 2014 8:52 AM