This is a question I have had since I started with SCCM 2007. I thought I had a grasp of it until I was talking with a customer and started second guessing myself.
Why aren’t all my updates installing during the Maintenance Window?
Why do I have Servers in a Reboot Pending State after our scheduled Windows Update weekend?
I have a 3-hour Maintenance Window defined, that should be lots of time…
Customer Questions
I started doing some research to find a definitive answer to these questions and everything I could find referenced old blog posts that don’t exist anymore or some pretty unclear information, so I setup my lab and set down to get some concrete information…
I started with a pretty old Windows Server 2012 R2 image, so I know there are lots of updates to apply.
In the UpdatesDeployment.log we see that it is trying to install the update when the deadline hits, and since we aren’t in a Maintenance Window it will wait until it is in a Maintenance Window before attempting the install again.
No current service window available to run updates assignment with time required = 600 UpdatesDeploymentAgent 11/29/2019 3:20:06 PM 3840 (0x0F00)
No service window available to run updates assignment UpdatesDeploymentAgent 11/29/2019 3:20:06 PM 3840 (0x0F00)
This assignment ({CDCB2B61-2743-4A16-A8B4-CA2949E85BF3}) will be retried once the service window is available. UpdatesDeploymentAgent 11/29/2019 3:20:06 PM 3840 (0x0F00)
I then deployed a Maintenance Window so when the Maintenance Window starts we see in the ServiceWindowManager.log that when each update attempts to install it will check to see if there is enough time remaining in the Maintenance Window to complete the install. This is based on the Max Run Time attribute of the software update.
If there is enough time remaining in the Maintenance Windows, you will see the following entries in ServiceWindowManager.log:
OnIsServiceWindowAvailable called with: Runtime:600, Type:4 ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
No Service Windows exist for this type. Will check if the program can run in the All Programs window… ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
Biggest Active Service Window has ID = {14D90B4F-4BB8-4070-85A0-806C2800AD5D} having Starttime=11/29/19 15:30:00 ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
Duration is 0 days, 01 hours, 00 mins, 00 secs ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
ActiveServiceWindow has 3595 seconds left ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
Program can run! Setting *canProgramRun to TRUE ServiceWindowManager 11/29/2019 3:30:05 PM 560 (0x0230)
If there isn’t enough time remaining in the Maintenance Windows, you will see the following entries in ServiceWindowManager.log:
OnIsServiceWindowAvailable called with: Runtime:3600, Type:4 ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
No Service Windows exist for this type. Will check if the program can run in the All Programs window… ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
Biggest Active Service Window has ID = {14D90B4F-4BB8-4070-85A0-806C2800AD5D} having Starttime=11/29/19 15:30:00 ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
Duration is 0 days, 01 hours, 00 mins, 00 secs ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
FindBiggestMergedTimeWindow called with TimeStart=11/29/19 15:31:13 and TimeEnd=11/29/19 16:30:00 ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
Biggest Chainable Service Window for Type=1 not found ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
Program cannot Run! Setting *canProgramRun to FALSE ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
WillProgramRun called with: Runtime:3600, Type:4 ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
No Service Windows of this type exist. ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
There exists an All Programs window for this duration. The Program will run eventually. ServiceWindowManager 11/29/2019 3:31:13 PM 2764 (0x0ACC)
As well as the following entries in UpdateHandler.log:
No current service window available with time required = 3600 UpdatesHandler 11/29/2019 3:32:56 PM 2764 (0x0ACC)
Not enough service window available to run update (03a8098b-7740-40da-9082-00ea285035be) UpdatesHandler 11/29/2019 3:32:56 PM 2764 (0x0ACC)
Once everything that can be installed during the Maintenance Window is installed, it will attempt to reboot the machine. This is where the next thing can interfere. Computer Restart settings, specifically “Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes)”. For a workstation, this setting makes sense, but for a server this could cause the machine to overshoot its maintenance window.
Assuming someone is logged onto the server, and you have this set to the default, which is 90 minutes (5400 seconds). Once you are within 90 minutes of the end of your maintenance window the machine will not reboot automatically, and you will see the following in the ServiceWindowManager.log
OnIsServiceWindowAvailable called with: Runtime:5400, Type:4 ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
No Service Windows exist for this type. Will check if the program can run in the All Programs window… ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
Biggest Active Service Window has ID = {14D90B4F-4BB8-4070-85A0-806C2800AD5D} having Starttime=11/29/2019 3:30:00 PM ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
Duration is 0 days, 01 hours, 00 mins, 00 secs ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
FindBiggestMergedTimeWindow called with TimeStart=11/29/2019 4:16:04 PM and TimeEnd=11/29/2019 4:30:00 PM ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
Biggest Chainable Service Window for Type=1 not found ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
Program cannot Run! Setting *canProgramRun to FALSE ServiceWindowManager 11/29/2019 4:16:04 PM 4072 (0x0FE8)
When you logon to the server you will see the “Recently installed software requires a computer restart” message, along with the Task Bar Icon.
The computer will automatically reboot during the next Maintenance Window – this is usually is too late, and you are attempting to install more updates.
Now, to answer the customers questions:
Why aren’t all my updates installing during the Maintenance Window? – If the Max Run Time is set to 120 minutes (2 hours) once you are within 120 minutes of the end of the maintenance window, we no longer have enough time to install those updates.
Why do I have Servers in a Reboot Pending State after our scheduled Windows Update weekend? – If someone is logged onto the Server (even in a disconnected state), your maintenance window is effectively reduced by the time specified in the Computer Restart setting “Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes)”. So for your server infrastructure you make want to reduce this down to 2 minutes with the “Display a dialog box that the user cannot close, which displays the countdown interval before the user is logged off or the computer restarts (minutes)” set to 1 minute.
I have a 3-hour Maintenance Window defined, that should be lots of time… – Well that does depend on what the Max Run Time is for all deployments, along with what the Reboot Settings are if someone is logged on.
I hope I have imparted information regarding how updates and Maintenance Windows interact. I know I learned a lot doing this.
