I've been dealing with a recurring issue at work: many users turn off their computers every night or barely use their laptops after getting home, which leads to significant delays in security updates and patches. I recently checked several devices and found quite a few that were months behind on updates, which is concerning. I've had some success with using PowerShell to check for and install updates, scheduling reboots for overnight times to minimize disruption. However, this only works if the machines are powered on and connected. We also utilize ConnectWise Automate for managing Windows updates, but I've faced consistency issues with it, especially when it comes to installations during the day. I'm curious how other IT professionals manage this problem. Do you enforce keeping devices on overnight? Do you rely on user reminders? Or do you accept some patch delays as inevitable? I'm looking for insights on balancing security, reliability, and user experience.
6 Answers
We rely on Intune, which handles the updates regardless of whether machines are on or off. We set scheduled reboot times and notify users beforehand. If they ignore the prompts, we just force the updates. It sounds harsh, but it keeps everything running smoothly.
I use a Wake on LAN (WoL) script to turn on machines at midnight to handle updates better. Of course, I still send out plenty of warnings beforehand to let users know their computers might reset after a patch installation.
Every now and then I get woken up by my wife's laptop from this process—definitely keeps everyone on their toes!
Nice, WoL is the way to go! Very effective!
For laptops, it's a trickier situation, but for desktops, we set BIOS to boot them up at a specific time every morning and start running updates shortly thereafter. That way, we ensure they're patched during working hours.
We have a protocol in place. We give users a schedule and send out reminders before their computers are automatically forced to restart after a certain number of days without updates. It's not ideal, but we have to ensure the machines are kept up to date.
That's a solid approach. I always give a grace period too, letting users know they need to update at their convenience, or the updates are happening whether they like it or not.
What kind of system do you use to manage the warning schedules?
Honestly, I think the simplest solution is just to handle updates during lunch breaks. Set a timer, and if they miss the window, force the restart at the end of the day. This balances updates well without interrupting work too much.
That’s actually a great idea! Practical and considerate at the same time.
We don’t allow users to shut down their machines overnight. It's easier to automate updates if they don't. If someone leaves their device off, they just have to wait for updates when they log back in, which is their choice!
Exactly! Users need to understand that updates are essential and can't just ignore them.
Haha, love it! Can't believe how much faster updates happen when people don’t complain about it.