Windows 2016 Server Patching

[Rav3n]

Sorry for a slightly off-topic post but we use Batchpatch for patching our server fleet. Batchpatch works great for Windows 2008 – 2012R2 but have noticed that downloading updates for Server 2016 is extremely slow, despite the same policies being applied as the other servers.

Does anyone have any thoughts? It is more likely to be an issue with Windows Update on 2016 rather than Batchpatch.

[doug]

I can confirm that it’s not a BatchPatch issue. When using BatchPatch in the default mode, the target computer’s Windows Update Agent is what handles downloading the updates. You can find lots of complaints on the web about Win 2016 update downloading being slow. That said, you have several options to help deal with this or workaround it.

1. My primary recommendation would be to have the computers download the updates using group policy so that the updates are already downloaded by the time your maintenance window begins. In this way you can use BP to initiate and monitor the installation process without having to wait for the slow download (use BP action ‘Install downloaded updates’). You could of course also use BP to initiate the download process before the maintenance window, but why not just let the computers take care of it themselves with group policy?

In Group Policy editor (gpedit.msc) go to ‘Computer Configuration > Administrative Templates > Windows Components > Windows Update’ and set the ‘Configure Automatic Updates’ setting to 3 = ‘(Default setting) Download the updates automatically and notify when they are ready to be installed’

2. You could use BatchPatch in online cached mode. In this mode the BatchPatch computer downloads the updates and pushes them to target computers rather than each target computer’s Windows Update Agent downloading the updates, so you will not be subject to the same slowness issue. However, unfortunately there is one potential roadblock with this method, which is that starting with Win 10 v1709 Microsoft made a change that makes it no longer possible for BatchPatch running in online cached mode to automatically download the large cumulative update each month. I assume the same issue exists in Win 2016 v1709 and is not exclusive to Win 10, but I have not actually tested Win 2016 for this issue at the time of this writing. This issue is not a bug. It’s a change to how Microsoft distributes the cumulative updates. I would suggest you give it a try just to see if it works or not. I suspect that Win 2016 is going to behave the same as Win 10, but you’ll be able to test it more quickly than I can because at the moment our lab is in the process of being upgraded, so I don’t have access to it right now. Also, if you are still running a version of Win 2016 that is older than v1709, then I think this will work well for you because the change was not introduced until v1709. Also note, it’s the OS version of the target computers that matters in this case, not the version of the computer running BatchPatch.

cached-mode-and-offline-updates

3. You could use BatchPatch in offline cached mode. This will work and will not have the same potential roadblock as described for online cached mode. However, there is still a caveat, unfortunately, which is that offline mode does not include *all* updates. It includes all security updates plus various other updates that Microsoft selects, but it will not include all non-security updates that you would see when using online regular mode or online cached mode. That said, one possible solution might be to do a download/install cycle with offline cached mode, and then go back to online cached mode and do a second cycle to get any remaining non-security updates. (Or for the second cycle you could try online regular non-cached mode and see if it’s quick because the large updates presumably would have been handled during the offline mode cycle, so perhaps the slow download issue might not be a problem in the second cycle if there are only small updates left.)

4. You could use the BatchPatch ‘Deployment’ feature to deploy the updates to target computers instead of using the BatchPatch Windows Update actions. In this case you would need to manually download the desired update files from Microsoft from the update catalog (typically they come in .MSU format), and then you can distribute them with the BatchPatch deployment action.

remotely-install-multiple-msu-files-or-msi-and-msp-files-to-numerous-computers

[Rav3n]

Thanks Doug, great response. I will try out the Group Policy option I think.

[Author]

Posts