THE OFFICIAL BLOG OF THE SBS "DIVA"

What kind of Numbnut is worried about rebooting?  Unless you have the "Clear the pagefile before shutting down" setting thinking you're clearning it to be more secure, rebooting takes about 5 minutes.  (If you do have the clear pagefile setting checked, it could take an hour or more depending on how big it is...don't ask me how I know).

And really, wasn't it suggested by some smarter people than me to go ahead and reboot BEFORE applying a patch if the machine has been running for a month or two?  The thinking is that in case there's a problem and it won't come back up, you won't confuse the issue with a patch...what caused it to not restart?  The patch?  Or some other problem you don't know about because you didn't restart first?

Durring the work day no reboot should happen. People shut down their machines. Forcing a shutdown every 5 minutes and close everything out if no response is detrimental to your un-saved work. The patch can wait till the person shuts down at the end of the day or has to reboot for something else.

Woah, Eric, how far behind are you on patches that you have to shutdown "every five minutes"?  Yes, you're right, the patch can wait until the end of the day - we apply patches overnight, and we've trained our users that before they leave at the end of the day, they restart their machine - restart, not shut-down.
In somewhat unrelated notes, I'll warn again that applying a patch that asks for a restart, and then not restarting, is likely to lead to loss of data, too, because you've patched only the code that isn't running right now - so if some of that patched code then starts running, it's going to expect that the other code that it talks to is also patched.
When I'm manually installing my own patches, I reboot twice before, and twice after.  The first "before" is so that anything that got installed or applied a patch can finish whatever it couldn't do because of locked items; the second "before" is so that the system comes up into its fully-installed, fully-patched current state, and I can check that there are no obvious errors.
If I don't do that, I run the risk of blaming bad behaviour on the wrong patch.
Then I patch.  If the patch requires a restart, I restart, let it install all its meaty goodness, and then I restart again, so that I have a system with the patch in place, that has booted from that state.
Perhaps it's paranoia, and maybe it's inconvenient, but then I don't find myself blaming an OS patch for a crash caused by an unannounced application update that hadn't finished installing because it was waiting for a reboot.

In response to Alunj:

Eric is referring to what happens when you have automatic updates turned on, and get a critical patch installed which requires a reboot.

I get prompted every so often (probably about 5 minutes), that the computer will restart itself in 5 minutes if I don't take any action.  The possible options are restart now and cancel.  If you cancel, you will be prompted in another 5 minutes and the process begins again.  This process only starts when the download is complete.  If you are set to automatically install updates, this will often appear in the middle of the day on the Wednesday after Patch Tuesday.

Imagine what would happen if your client left a document with critical changes open, then walked away for 7 minutes to get a cup of coffee.  Their changes would not be saved, and they will get back to their computer to see "Press CTRL + ALT + Delete to begin".

I don't see how this is beneficial.

This doesn't happen in a proper "user" level WSUS environment. (mine is 100% users with user level, nobody, including myself, runs as an admin)

We have installs set for 7 a.m.  Machines are forced on via BIOS at 6:50.  The machines are all patched and ready to go well before the first users trickle in at 7:30/8.

Laptop users are trained about the second Wednesday of the month to leave machines idle after startup.  Patches are part of basic firm policy.  Users are used to it, and 90% of it aren't even aware it's going on, as users get no notification that they have been patched.

I thought about using a hammer to the head as that is the only option left. I have lost track how many times walking in the door to have the boss come running up "I need to you to go here in fix this" only to fix the problem was caused by no patch and or running as admin!

PS my machine gets patched, home one too. I even make update CDs for co-workers to use. Oh well back to the mines.

If you have the users trained well enough, you can restart the machine ANY TIME YOU WANT.

Regards,

BOFH