Comments on: Windows Server – Semi-Annual Channel (SAC) vs Long-Term Servicing Channel (LTSC)

By: Craig jones

Craig jones — Thu, 30 Nov 2017 12:49:53 +0000

In reply to Craig jones. That makes sense, thanks for the info :)

By: Thomas Maurer

Thomas Maurer — Thu, 30 Nov 2017 12:48:27 +0000

In reply to Craig jones. Definitely LTSC

By: Craig jones

Craig jones — Thu, 30 Nov 2017 12:06:01 +0000

Which Server 2016 version would you recommend for SCCM 1710? I’m thinking LTSB but I can’t be certain that there won’t be updates include in SAC that me be required in the future?

By: Julien

Julien — Tue, 21 Nov 2017 13:46:04 +0000

I based my comment on the way we set it up, It is true I never realized by default Windows 2016 1607 allows a standard user to install updates and restart, that’s really stupid … A workaround working for us is we disable Windows update service on our RDSH servers and we don’t configure WSUS settings for those servers, so when trying to run windows update, you have an error. I’ll take a look to find out how to block standard users but as you said, usual registry don’t work, probably a bug again. Cheers, Julien

By: Bart van de Beek

Bart van de Beek — Tue, 21 Nov 2017 10:43:31 +0000

No, standard user and I disallow any access to Windows Updates in a GPO for standard users. Nevertheless, by default, v1607 ignores most of these settings, GPO-wise or otherwise. A standard user can check for, download, install and even reboot the server afterwards. I have no idea on what you base your comment on. Would like to see your GPO-settings which disable Windows Updates for standard users. In 2016 the familiar interface of Windows Updates through Control Panel is replaced with the Modern App Settings, and there a user sees and can use the Windows Update page without restriction. I know there’s a new GPO-setting since Creators Update (Win10) which enables you to customize this Modern Appp Settings and hide parts of the left pane, ie. “Windows Update”-TAB, page or how you wanna call it. Same goes then for “Windows Defender”-TAB and any TAB you wish to hide. So while this allows you to completely hide user-access to Windows Updates on Win10 Creators Update, it does nothing for v1607 2016 Server, as this setting doesn’t exist for that OS yet.

By: Julien

Julien — Mon, 20 Nov 2017 19:31:15 +0000

Is your user local admin? Did you allow standard user to install windows updates in your GPO? By default standard users can’t install windows updates. I use Windows Server 2016 as a RDS role and I don’t have any problem so far.

By: Bart van de Beek

Bart van de Beek — Mon, 20 Nov 2017 13:34:30 +0000

In my book, it has turned into a genuine mess. Anything RDS-related defaults back to LTSB (Long Term Servicing Branch ? It’s now redubbed LTSC ?)… Because of that, you get v1607 on 2016. As an example, it’s only since somewhere around Win10 creators update that there’s a GPO-parameter implemented to simply hide the modern settings for windows updates. As a result, any 2016 RDS-farm now has to cope with a user being able to start windows updates, install them, and even restart the server afterwards ! This is rediculous. That’s why I was on the lookout for v1709 and was disappointed it’s only for SAC-scenario’s. How in the world am I supposed to lock down installing windows updates/reboots from users without the proper GPO-parameters available and where 2016 (next to a whole bunch of others) totally ignores the “old existing” settings ? Same with “Active Hours” for example. you can only set 12 hours diefference. IN later win10 versions, you can set longer periods, but not so in 2016 v1607 yet, ofcourse. Since it’s LTSC, first chance I get is to upgrade the whole platform with next LTSC-release (2018/2019 somewhere?), or do you know or are aware of any workarounds for these type of “little caveats” perhaps ?