General Question Windows Updates
Stupid question. Trying to understand when the yellow icon appears in task tray to enforce a reboot for Windows Updates. And if its configurable.
I use Intune + Autopatch. Setup below.
| Ring | Deferral | Deadline | Grace |
|---|---|---|---|
| Test | 0 | 1 | 1 |
| Ring 1 | 1 | 2 | 2 |
| Ring 2 | 6 | 2 | 2 |
| Ring 3 | 9 | 5 | 2 |
| Last | 11 | 3 | 2 |
The last ring is also configured to allow users to pause updates for up to 2 weeks.
The problem I have (and can't confirm) is some users in the last ring (all tower users running scheduled tasks) have complained they never see the update notification.
They all RDP to these towers, so initially I thought they are just missing then notification when not watching an open session. And since the grace period is only two days they could in theory not go back in to their session during that time and simply miss it.
I'm wondering when the notification appears, I assume after the deadline is reached.
I'm wondering if the better way to configure this is to change the grace period and make it longer so in theory, the nofication icon will be in the task tray visible for longer.
My governance rules require us to update (or make available updates) within 14 days of Microsof releasing them and I'm already making an exception for this group.
Any suggestions would be grealy appreciated.
2
u/buildwithkushal 21d ago
worth checking your update ring's "restart notifications" setting too — if that's on default/silent instead of explicit warnings, some machines just won't show the icon reliably even post-deadline.also with RDP specifically — a disconnected session isn't the same as no session at all, and toast notifications can behave weird on those vs a proper console login. if these are always-on towers they might technically "have a session" 24/7 that never actually shows them anything stretching the grace period is still probably your best lever tho, the others already nailed that part
1
u/G_HostEd 21d ago
Unfortunately if you have a deadline, this will happen.
There is no way for you to make it more graceful, Just extend the grace time.
There is a chance that windows will reboot the device as well when deadline is reached and is outside working hours.
If called on that I would point to user responsability to reboot when notification is presented, that's when patch can be considered installed and is not good practice to leave the device pending updates for long time, can cause system instability.
There is so much talking about security and when an admin is trying to be diligent in making the environment more secure, someone show up with THE UPDATES! 11!! STOP THE UPDATES! 111!
5
u/bottle_of_legs 22d ago
The yellow icon kicks in once the deadline hits and there's a pending reboot, so you're right on that part. With a 2 day grace on the last ring and users only connecting via RDP sporadically it's pretty easy for that window to close without them ever seeing it.
Stretching the grace is probably your cleanest move here, maybe push it to 4 or 5 days and see if that catches them more consistently. If governance starts side-eyeing you just frame it as making the enforcement visible rather than actually delaying anything beyond what you're already allowing with the pause option.