Windows Server patching: updates, rings and safe restarts

Start DC01, DC02 and SRV01. Take snapshots called “Before patching” first. Work in PowerShell as administrator.

1Read the build and recent updates

On SRV01, run this:

$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"Build: $($cv.CurrentBuild).$($cv.UBR)"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3 HotFixID, Description, InstalledOn

You should see something like this:

Build: 26100.NNNN

HotFixID  Description     InstalledOn
--------  -----------     -----------
KB50xxxxx Security Update 14/10/2026 00:00:00
KB50yyyyy Update          14/10/2026 00:00:00

NNNN and the KB numbers depend on the month. Compare the UBR with Microsoft’s Windows Server release information page to see which month’s update the server has. Get-HotFix only shows some update types, so the build number is the more reliable answer to “how patched is this server?”

✅ Checkpoint: You know SRV01’s full build (26100.something) and its most recent updates.

2Search for missing updates

On SRV01, ask the Windows Update Agent directly (built in, no modules needed):

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
$result = $searcher.Search("IsInstalled=0 and IsHidden=0")
$result.Updates | Select-Object Title, @{n='SizeMB';e={[math]::Round($_.MaxDownloadSize/1MB)}}, IsDownloaded

You should see something like this:

Title                                                                              SizeMB IsDownloaded
-----                                                                              ------ ------------
2026-10 Cumulative Update for Microsoft server operating system version 24H2 for x64-based Systems (KB...)  ...        False
Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version ...)                    ...         True

This is the same search that Settings, sconfig and most tools run. If it fails with an error code, you’ve found a Windows Update problem to fix before anything else (Break It covers one).

✅ Checkpoint: The search returns a list (possibly including a cumulative update) without errors.

3Install updates with sconfig

On SRV01, run sconfig, choose 6 (Install updates), then 1 for all quality updates. Choose A to install all, and when it asks to restart, choose No for now: you’ll check what “installed but not restarted” looks like in Break It.

Then, from the PowerShell window, read the update events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WindowsUpdateClient'; Id=19,20} -MaxEvents 5 |
    Select-Object TimeCreated, Id, Message | Format-List

You should see something like this:

TimeCreated : 19/10/2026 20:21:44
Id          : 19
Message     : Installation Successful: Windows successfully installed the following update: 2026-10 Cumulative Update for
              Microsoft server operating system version 24H2 for x64-based Systems (KB...)

Event 19 is a successful install, event 20 a failure with an error code. These events are your record when someone asks “was this server patched last month?”

✅ Checkpoint: Event 19 shows the cumulative update installed (restart still pending).

4Set update behaviour for servers with a GPO

On DC01, create the GPO and link it to Servers:

New-GPO -Name 'C-Server-Updates' | New-GPLink -Target 'OU=Servers,OU=SAATLAB,DC=saatlab,DC=internal' | Out-Null
$k = 'HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
Set-GPRegistryValue -Name 'C-Server-Updates' -Key $k -ValueName NoAutoUpdate -Type DWord -Value 0 | Out-Null
Set-GPRegistryValue -Name 'C-Server-Updates' -Key $k -ValueName AUOptions -Type DWord -Value 3 | Out-Null
Set-GPRegistryValue -Name 'C-Server-Updates' -Key $k -ValueName NoAutoRebootWithLoggedOnUsers -Type DWord -Value 1 | Out-Null

These are the settings behind Computer Configuration, Administrative Templates, Windows Components, Windows Update, Configure Automatic Updates. AUOptions 3 means “download and notify for install”: servers fetch updates in the background, and you choose when to install and restart. Workstations usually get option 4 (install on a schedule) instead.

On SRV01, apply and check:

gpupdate /force
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU' | Select-Object NoAutoUpdate, AUOptions

You should see this:

NoAutoUpdate AUOptions
------------ ---------
           0         3

✅ Checkpoint: SRV01 has AUOptions 3 from C-Server-Updates.

5Write a pending-restart check

On SRV01, define the function and run it:

function Test-PendingReboot {
    $keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending',
            'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
    $file = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name PendingFileRenameOperations -ErrorAction SilentlyContinue) -ne $null
    [pscustomobject]@{ Computer = $env:COMPUTERNAME; CBS = (Test-Path $keys[0]); WU = (Test-Path $keys[1]); FileRename = $file }
}
Test-PendingReboot

You should see something like this:

Computer CBS  WU   FileRename
-------- ---  --   ----------
SRV01    True True True

Any True means SRV01 needs a restart to finish installing. Restart it now with Restart-Computer, sign in, and run the build check from step 1 again: the UBR is higher, and Test-PendingReboot shows False everywhere.

✅ Checkpoint: After the restart, the UBR has increased and Test-PendingReboot returns False for all three checks.

6Patch the DCs one at a time

From SRV01 or DC01, install updates on DC02 first (sconfig option 6 on DC02, or the same steps remotely), then restart it and wait:

Restart-Computer -ComputerName DC02 -Wait -For PowerShell -Timeout 900 -Force
repadmin /replsummary
Get-ADDomainController -Filter * | Select-Object Name, OperatingSystemVersion

You should see something like this:

Source DSA          largest delta    fails/total %%   error
 DC01                      03m:10s    0 /   5    0
 DC02                      02m:41s    0 /   5    0
...

Name OperatingSystemVersion
---- ----------------------
DC01 10.0 (26100)
DC02 10.0 (26100)

Only when DC02 is back, replicating with no failures, do you patch DC01 the same way. While one DC restarts, the other handles every sign-in and DNS query. That’s the second DC from Lesson 13 earning its keep.

✅ Checkpoint: DC02 restarted and replsummary shows 0 failures before you patch DC01.