Windows 2003 WSUS Clients Hanging at "Windows Is Shutting Down..." After Scheduled Patch Install and Auto-Reboot

[rasena]

I had gone through this topic a number of time but still it looks like it is not going to resolve so easily. Also the topic remains incomplete after going through a set of new threads. I am having a very large network here that has a batch of 30 computers each. now I am using WSUS to run windows update and that is the only way to push updates on allthe system. Rightnow I am using WSUS 2.0 and did not feel to go for upgades. There is a automatic patching policy in GPO that allows to install the patch and reboot the system. After a few while I had noticed that some servers in the network are freezing and there is nothing I can do. I had tried to apply the updates where the system freeze on Windows is shutting down. In this there are many systems which are not working well. What can be the reason.

[Mr.Walter]

It looks that the problem lies with the Antivirus. You must ensure that the antivirus must not at all block the service and allow you to move ahead properly. If WSUS is interrupted or block by any security application then this kind of issues are common and there is nothing you can do. You will need to find out in each system and modify the settings. You will need to check out the antivirus that might be on the right track. I had faced the same issue on Windows 2000.

[LeSueur]

I had constantly faced this error on Windows XP not on the server. But it is a bit complicated to find out what is the actual problem behind the same. I think the problem lies with antivirus only. There are 4 workstation on which I was testing WSUS. Among those 4 only 1 was properly updated which was not having any kind of security application installed on the same. I thought there will be some kind of problem that is causing the problem and getting that in in details is very complicated if you are on WSUS. The more older system the more problems will appear.

[stfconsulting]

Did anyone ever figure this out? Working with MSFT now and they have no idea. Here is the run down of our experience with the problem:

We see this problem on some of our Windows 2003 servers when ever they reboot for a Scheduled Update. The server will complete the shutdown process and log the shutdown event 6006. When we use the Remote Access Controller to gain access to the server all we see is a grey screen. We have to powercycle the server to bring it back online. We have worked with Microsoft on the issue through the Private News Groups and here is their response. The problem is really annoying because there are issues that occur on the client side with Outlook when they have not been able to talk to the server for a few hours. Some of our customers that have BES also need to have that server restarted because it lost contact with Exchange for so long. We have tried added the SYSTEM account to the User Rights Assignment and that did not help. I guess we can experiment with the screen saver settings next. None of the other suggestions apply to us. The log that you see below is from a brand new Poweredge 2900 with the firmware fully up to date and the patches up to date (SP2).

Issue:
Servers cannot shutdown properly after Windows Update finishes installation

Suggestion:
We found that System account was not configured with Shut Down The System rights. We used the Group Policy to assign the rights to the System account.

Additional information:
Below is some known shutdown issues:
1) Do not use the "Do not require CTRL+ALT+DEL" policy as this is known to cause shutdown issues. The DisableCAD registry key and the local policy will be deleted by the .REG file above, but the policy must be manually checked.
The policy is under \Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DEL

2) Having a default screen saver. Disable the default screen saver and just use the monitor power save feature. Without the screen saver, the power save will still work, and is the best way to prevent burn-in. The registry settings above will automatically remove the screensaver for you.

3) The System user account must have the SEShutdown user right for Automatic Updates to reboot the server.
The policy is understand \Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system.

Please note: If a 3rd party service or process is being used to shutdown the machine, make sure the user account for it has this privilege.

4) Citrix servers may not shutdown properly due to orphaned winlogon and csrss processes. In this case, we need to contact Citrix for further suggestions/solutions.

[vertaylor]

We've experienced this same issue with our Windows 2003 servers. After scheduled updates from WSUS, several of them would initiate restart and just hang. It would then require someone going to the physical console to move a mouse to allow the server to complete the restart.

After alot of guessing/testing we determined is that it was the Windows logon screensaver that was somehow interfering with the restart. After disabling the logon screensaver on our servers, we have not had this issue again.

Steps to disable the screensaver are on Microsoft's site: http://support.microsoft.com/kb/185348