Windows Update Reboot Policy for Production VPS

Cumulative updates on Windows Server 2022 are not optional if the guest has a public IPv4. Rebooting them in the middle of a business day is optional, and it is how teams learn that IIS and a .NET Windows service do not drain connections the way they hoped. You want patches installed. You do not want the guest to decide 14:00 IST is a good time to restart W3SVC.

The default on a desktop-ish Server install is too eager for production and too shy for a forgotten lab. Pick a window, disable surprise auto-reboot while someone is in RDP, install updates in that window, reboot on purpose, and confirm the site and services came back. That is the whole policy. Tools are registry values, the Microsoft.Update COM API, and a scheduled task you can explain.

See what is pending before it sees you

Do not wait for a balloon in the system tray you will never look at on a VPS. Query the update session from PowerShell. Titles tell you whether you are dealing with a monthly cumulative, a .NET rollup, a servicing stack update, or a defender definition that does not need a reboot.

$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Pending = $Searcher.Search('IsInstalled=0 and Type="Software"')
$Pending.Updates | ForEach-Object { $_.Title }
$Reboot = (New-Object -ComObject Microsoft.Update.SystemInfo).RebootRequired
Write-Output $Reboot
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn
Get-CimInstance Win32_OperatingSystem | Select-Object LastBootUpTime

If RebootRequired is true, you are already on borrowed time. Some updates will not fully apply until that reboot happens, and a second patch wave can stack. Do not ignore it until the guest becomes weird in IIS.

Stop the guest from rebooting itself

The policy that bites production is automatic reboot with a logged-on admin or with nobody logged on at 03:00 because Active Hours were never set. On a VPS, RDP sessions do not equal a person at a desk. Set NoAutoRebootWithLoggedOnUsers, set a scheduled install window, and still treat the reboot as a change you schedule yourself for anything that serves customers.

$Au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
New-Item -Path $Au -Force | Out-Null
Set-ItemProperty -Path $Au -Name NoAutoRebootWithLoggedOnUsers -Type DWord -Value 1
Set-ItemProperty -Path $Au -Name AUOptions -Type DWord -Value 4
Set-ItemProperty -Path $Au -Name ScheduledInstallDay -Type DWord -Value 0
Set-ItemProperty -Path $Au -Name ScheduledInstallTime -Type DWord -Value 3
$Ux = 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings'
New-Item -Path $Ux -Force | Out-Null
Set-ItemProperty -Path $Ux -Name ActiveHoursStart -Type DWord -Value 8
Set-ItemProperty -Path $Ux -Name ActiveHoursEnd -Type DWord -Value 22
Set-ItemProperty -Path $Ux -Name IsActiveHoursEnabled -Type DWord -Value 1
Get-ItemProperty $Au | Select-Object NoAutoRebootWithLoggedOnUsers, AUOptions, ScheduledInstallTime

AUOptions 4 means download and schedule install. Day 0 is every day, time 3 is 03:00 local. Active hours 8 to 22 covers a typical India business day in Lucknow. This is not a substitute for a change calendar. It is a seatbelt so a cumulative package does not bounce IIS at noon because someone clicked Install now in a forgotten RDP window.

For a real production VPS, prefer a maintenance task: install, wait until the window, Restart-Computer. Document the window next to the DNS TTL and the customer status page. If you run two Windows guests, patch the spare first.

Install, reboot, verify, in that order

In the window, install pending software updates, reboot once, then prove the app:

• W3SVC running, site Started, HTTP 200 on the health URL.
• Your .NET Windows service Running, not stuck in StartPending.
• LastBootUpTime is inside the window, not six weeks ago and not a surprise 11:00 reboot.
• Get-WinEvent for the last hour is not a wall of disk or .NET exceptions.

Servicing stack updates should go in before the cumulative when the searcher lists both. Defender signatures can apply without a reboot; do not hold them. If an update fails, the CBS log under C:\Windows\Logs\CBS is the next stop, not a second reboot loop.

Tell humans before shutdown /r. An RDP session dies hard. IIS connections die harder. A 60-second delay with a message is cheap. After boot, do not assume the old session will reconnect cleanly; open a new one and run the verify list.

What not to do

Do not set the guest to never update. A public IPv4 Windows box that last patched in 2024 is a scripted incident. Do not disable the firewall to make Windows Update "work". Do not copy WSUS complexity for a single VPS; the public update endpoints are fine. Do not patch in the same hour you ship a new site binding.

Takeaway

Search pending updates, pin a window, suppress surprise reboots, then reboot on purpose and verify IIS and services. Patching is mandatory on a public Windows VPS; unscheduled downtime is not. Run this calendar on a Netbay Windows guest in Lucknow, on Intel Xeon Platinum and High-Speed SSD, following along at netbayhosts.in.