A brief Windows 10 PSA.

[theweaselking]

If you've gotten the "anniversary update" of Windows 10, you have probably already noticed that it wasn't just an "update", it was a clean install of a new copy of the OS and then an import of your settings and profile. Which means annoying things like the default MS apps (Edge, Explorer, Store) are re-pinned to start menu, the crappy MS programs for music and things have reset their defaults, your privacy settings have been eBayed unless you were careful during the update, etc.

All that's fine. It's annoying, but not actively harmful.

Actively harmful: The option to "notify me when a restart is required to install updates" has been REMOVED. Now there's no setting in the Windows Update options to avoid automatic reboots when it "thinks" you aren't using your computer, and you can only specify a 12 hour window of "never reboot during this time"

The good news is, there's a solution to that, hiding in Local Group Policy (Win10 Pro) or the Registry (Win10 Home).

If you've got Win10 Pro:
1) click start, type "gpedit.msc", press enter. Make the window fullscreen, you will need the room.
2) On the left, navigate to Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update.
3) On the right, locate "No auto-restart with logged-on users for scheduled automatic updates installations" and double-click it.
4) Change the radio button from "not configured" to "enabled". Click OK.
5) Close the Local Group Policy Editor window.

Now, the machine will no longer reboot as long as a user is logged in. If all the users are logged out, it'll still reboot automatically but that's generally much less of a problem.

(OPTIONAL: in that same location from Step 2, choose "Configure Automatic Updates", click Enabled, choose option 3. This reverts to the Win7 default behaviour of "notify me before installing updates", which is good for updates that require a reboot to install and BAD for updates that don't require a reboot. If you set this option, you need to watch for update notifications and deal with them in a timely manner. You can't afford to ignore them.)

If you've got Win10 Home: Fucked if I know, it's in the registry somewhere. I'm 100% sure it's there, and I'm also 100% sure I don't know where it is. I'll go digging to see if I can find the setting, later, and I'll update this post if I do.

EDIT: It *looks like* the right solution for Win10 home is: Start -> "regedit" -> Enter. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate

If there's an "AU" subkey, click on it. If there isn't, right-click on "WindowsUpdate", choose "new->key" and name it AU. Inside AU, right-click and choose "New->DWORD Value", name it "AUOptions" and set its value to "3". Close regedit and reboot. This is the same as that step marked OPTIONAL up above for Pro users - if there's a registry equivalent to "No auto-restart with logged-on users" I haven't found it, but this should also get around the problem.

Comments

[matgb]

Wait, I thought the entire point of Win10 being the "final" version of Windows and rolling updates, etc was to stop this sort of shit from happening?

I mean, it's my backup travel laptop that I don't use much but I have heavily personalised it so I don't need to worry about crap when I'm travelling.

That sucks. Anything that assumes my internet connection is always usable for stuff I haven't authorised is just not a good plan, especially for people travelling, etc. Gah.

[theweaselking.livejournal.com]

I'm not surprised that they're working harder and harder to ensure that updates actually get applied ASAP. I'm just annoyed that they've hidden my "no really, I know what I'm doing, I need you to NEVER EVER reboot my machine without asking me" option.

[resonant.livejournal.com]

I was in a meeting with 60+ engineers and managers in a room. The presenter was projecting information onto a screen with her laptop, and it was essential if we were to learn anything. Our outsourced IT department then decided they wanted to remotely reboot the laptop used by the presenter.

Then they installed another set of updates, and rebooted again just as we got the presentation restarted.

We lost more than a person-day of productivity because of that. Now that's going to happen all the time.

[theweaselking.livejournal.com]

Not exactly: If you're sitting in front of the machine, and it's not in the 12-hour "active period", and an update wants to trigger, it pops up a warning with a multi-minute countdown for you to say FUCK OFF I'M USING IT and it tries again tomorrow.

"Remotely rebooting a machine without the logged-in user's permission" is just an asshole move in general, but at least Win10 Update let's the user kill it.

[resonant.livejournal.com]

At work, we have a 3D printer that we use to make assembly fixtures. Some print runs take more than 12 hours. If the computer reboots partway through, we lose hundreds of dollars of material, and could miss a customer commit with thousands in penalty charges.

[theweaselking.livejournal.com]

Yup, that's a nasty-assed use case failure. Options include: Paying for Win10 Enterprise (which still has the same features as before), using the Group Policy option I mentioned, stationing someone to sit in front of it for the 12 hours that aren't standard-use so they can wiggle the mouse and click FUCK RIGHT THE FUCK OFF on time, using a different OS.

[jayblanc.livejournal.com]

And this is a reason not to use a Home Desktop OS for that kind of job.

Windows Home and Windows Pro are explicitly not work-station or industrial computing OSes. Windows Home is basically a gaming-OS that you can also have a word-processor and a spreadsheet on. Windows Pro is Windows Home that you can do some remote-work on. Windows Enterprise is the one that lets you run your own Update Server instead of Microsoft's, which lets you schedule updates and manage reboots. (Albeit then you need a competent IT manager.)

The computer running that 3D printer needs to either be on Windows Enterprise, or some other workstation or enterprise OS. Running it from Windows Home or even Pro is asking for trouble.

[theweaselking.livejournal.com]

You're not quite right about Pro - Pro can be domain-joined, takes Group Policy, and plays perfectly well with WSUS (including disabling MS' update servers). There's no reason to not use Pro in a small/medium business environment - the advantages of Enterprise are things that only really come into play when you buy machines 50+ at a time.

But yes, your industrial controller should not be running 10 Home. It could be worse, though - I had to repair a giant computer-controlled saw once that was running XP. Service Pack 1. In 2013.

[jayblanc.livejournal.com]

Pro can connect to enterprise, but it's not really hardened enough to *be* enterprise. Nor is it a really good idea as an industrial controller, for much the same reasons. Pro is really just Home, with things turned on to enable it to talk to enterprise. The problem is the things that are not turned off.

[pappy-legba.livejournal.com]

Forum necromancy ensues. Thanks for this.

I wouldn't need this if the active hour window was 18 hours instead of 12.