Windows Server 2012 reboot from updates on log out
Question
-
So, this has been a problem for a while, and is not coming to a head and needs to be resolved. Please help.
PLEASE NOTE: Everything is working great for 2008. We have been running this setup since 2003, and everything has worked fine.
Since we have started adding 2012 servers to the domain, they are rebooting on log out. The GPO is set to download the updates on Tuesday released, and patch and reboot on that following Sunday. But 2012 appears to be downloading and installing, and then after an admin logs in, there is a popup to reboot. You press "later" do your stuff and log out. On log out, it reboots without any notice. I have tried some changes, but with out success. Any help would be great!!
Attached a Pic of the GPO, and the gpresult for one of the problem 2012 servers
Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0 c 2012 Microsoft Corporation. All rights reserved. Created on 11/25/2015 at 3:19:47 PM RSOP data for DOMAIN-SUB1\USER-ws on ___SERVERNAME___ : Logging Mode ---------------------------------------------------------- OS Configuration: Member Server OS Version: 6.2.9200 Site Name: --CITY-- Roaming Profile: N/A Local Profile: C:\Users\USER-ws Connected over a slow link?: No COMPUTER SETTINGS ------------------ CN=___SERVERNAME___,OU=Health Center,OU=Dept,OU=Servers,OU=__PLACE__,OU=--CITY--,DC=DOMAIN-SUB1,DC=ad,DC=DOMAIN,DC=LOCAL__ Last time Group Policy was applied: 11/25/2015 at 3:15:26 PM Group Policy was applied from: PLACE1-adDOMAIN-SUB101.DOMAIN-SUB1.ad.DOMAIN.LOCAL__ Group Policy slow link threshold: 500 kbps Domain Name: DOMAIN-SUB1 Domain Type: Windows 2008 or later Applied Group Policy Objects ----------------------------- PLACE1 Servers - Default Domain Policy - All Servers in OU PLACE1 Servers - WSUS - All Servers in OU PLACE1 Servers - Disable Autorun - All Servers in OU PLACE1 Servers - Network Access Security fix - All Servers in OU PLACE1 Servers - CryptoLocker Fix - All Servers in OU The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- PLACE1 Servers - Disable Autorun - All Servers in OU Filtering: Not Applied (Unknown Reason) PLACE1 Servers - WSUS - All Servers in OU Filtering: Not Applied (Unknown Reason) Local Group Policy Filtering: Not Applied (Empty) PLACE1 Servers - Default Domain Policy - All Servers in OU Filtering: Not Applied (Unknown Reason) The computer is a part of the following security groups ------------------------------------------------------- BUILTIN\Administrators Everyone BUILTIN\Users NT AUTHORITY\NETWORK NT AUTHORITY\Authenticated Users This Organization ___SERVERNAME___$ Domain Computers Authentication authority asserted identity System Mandatory Level Resultant Set Of Policies for Computer --------------------------------------- Software Installations ---------------------- N/A Startup Scripts --------------- N/A Shutdown Scripts ---------------- N/A Account Policies ---------------- GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: LockoutDuration Computer Setting: 15 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MaximumPasswordAge Computer Setting: 400 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MinimumPasswordAge Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: ResetLockoutCount Computer Setting: 15 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: LockoutBadCount Computer Setting: 3 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: PasswordHistorySize Computer Setting: 10 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MinimumPasswordLength Computer Setting: 6 User Rights ----------- N/A Security Options ---------------- GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: PasswordComplexity Computer Setting: Not Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: ClearTextPassword Computer Setting: Not Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: ForceLogoffWhenHourExpire Computer Setting: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RequireLogonToChangePassword Computer Setting: Not Enabled GPO: PLACE1 Servers - Network Access Security fix - All Servers in OU Policy: LSAAnonymousNameLookup Computer Setting: Not Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: LSAAnonymousNameLookup Computer Setting: Not Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: NewGuestName Computer Setting: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59030 ValueName: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount Computer Setting: 2 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59045 ValueName: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59047 ValueName: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59103 ValueName: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59019 ValueName: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59059 ValueName: MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel Computer Setting: 1 GPO: PLACE1 Servers - Network Access Security fix - All Servers in OU Policy: @wsecedit.dll,-59051 ValueName: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes Computer Setting: GPO: PLACE1 Servers - Network Access Security fix - All Servers in OU Policy: @wsecedit.dll,-59052 ValueName: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares Computer Setting: GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59050 ValueName: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59044 ValueName: MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59040 ValueName: MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59098 ValueName: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59029 ValueName: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption Computer Setting: University of DOMAIN Computer System. Authorized Users Only. GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59023 ValueName: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59028 ValueName: MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText Computer Setting: University of DOMAIN Computer System. Authorized Use Only. GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59002 ValueName: MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59080 ValueName: MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59020 ValueName: MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59079 ValueName: MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59048 ValueName: MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous Computer Setting: 1 GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: @wsecedit.dll,-59031 ValueName: MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning Computer Setting: 14 Event Log Settings ------------------ GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MaximumLogSize Computer Setting: 8192 Log Name: Security GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RetentionDays Computer Setting: 0 Log Name: Application GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MaximumLogSize Computer Setting: 8192 Log Name: Application GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RetentionDays Computer Setting: 0 Log Name: Security GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: MaximumLogSize Computer Setting: 8192 Log Name: System GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RetentionDays Computer Setting: 0 Log Name: System GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RestrictGuestAccess Computer Setting: Enabled Log Name: Security GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RestrictGuestAccess Computer Setting: Enabled Log Name: Application GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Policy: RestrictGuestAccess Computer Setting: Enabled Log Name: System Restricted Groups ----------------- N/A System Services --------------- GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: TlntSvr Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: SharedAccess Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: SCardSvr Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: Messenger Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: RSVP Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: wuauserv Startup: Automatic GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: SCardDrv Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: W32Time Startup: Automatic GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: Fax Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: mnmsrvc Startup: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU ServiceName: UPS Startup: disabled Registry Settings ----------------- N/A File System Settings -------------------- N/A Public Key Policies ------------------- N/A Administrative Templates ------------------------ GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\System\GroupPolicyRefreshTimeDC Value: 30, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWNoExternalURL Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWNoSecondLevelCollection Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWAllowHeadless Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{741aa09c-9ddd-4235-958c-101cfdcf779b}\SaferFlags Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\ForceQueueMode Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d0e3cad9-e439-4787-bff7-e70e24804065}\SaferFlags Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\W32time\TimeProviders\NtpClient\Enabled Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\WUStatusServer Value: 104, 0, 116, 0, 116, 0, 112, 0, 58, 0, 47, 0, 47, 0, 102, 0, 98, 0, 107, 0, 45, 0, 119, 0, 115, 0, 117, 0, 115, 0, 46, 0, 97, 0, 112, 0, 112, 0, 115, 0, 46, 0, 97, 0, 100, 0, 46, 0, 97, 0, 108, 0, 97, 0, 115, 0, 107, 0, 97, 0, 46, 0, 101, 0, 100, 0, 117, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\NoSplash Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows NT\Printers\PublishPrinters Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\DetectionFrequencyEnabled Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\NoUpdateCheck Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\System\GroupPolicyRefreshTimeOffset Value: 30, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}\Description Value: 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWNoFileCollection Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\System\GroupPolicyRefreshTimeOffsetDC Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\ShowUI Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\DefaultLevel Value: 0, 0, 4, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWReporteeName State: disabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\SchLOCAL__ledInstallDay Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Messenger\Client\PreventRun Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\DetectionFrequency Value: 4, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}\Description Value: 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\PolicyScope Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Disable Autorun - All Servers in OU Folder Id: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun Value: 255, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions Value: 4, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows NT\Printers\Immortal Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\AU\SchLOCAL__ledInstallTime Value: 3, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\PowerShell\EnableScripts Value: 1, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DoReport Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy Value: 82, 0, 101, 0, 109, 0, 111, 0, 116, 0, 101, 0, 83, 0, 105, 0, 103, 0, 110, 0, 101, 0, 100, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\System\GroupPolicyRefreshTime Value: 15, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{741aa09c-9ddd-4235-958c-101cfdcf779b}\Description Value: 0, 0 State: Enabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\DWFileTreeRoot State: disabled GPO: PLACE1 Servers - Default Domain Policy - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Network Connections\NC_ShowSharedAccessUI Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - WSUS - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\WindowsUpdate\WUServer Value: 104, 0, 116, 0, 116, 0, 112, 0, 58, 0, 47, 0, 47, 0, 102, 0, 98, 0, 107, 0, 45, 0, 119, 0, 115, 0, 117, 0, 115, 0, 46, 0, 97, 0, 112, 0, 112, 0, 115, 0, 46, 0, 97, 0, 100, 0, 46, 0, 97, 0, 108, 0, 97, 0, 115, 0, 107, 0, 97, 0, 46, 0, 101, 0, 100, 0, 117, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}\SaferFlags Value: 0, 0, 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{d0e3cad9-e439-4787-bff7-e70e24804065}\Description Value: 0, 0 State: Enabled GPO: PLACE1 Servers - CryptoLocker Fix - All Servers in OU Folder Id: Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}\SaferFlags Value: 0, 0, 0, 0 State: Enabled
BlankMonkey
