It set the server in Maintenance Mode just before start installing updates, and when the server has rebootet and up running, it stops Maintenance Mode.

Our helpdesk is so happy now, the only see things which are error after patchning, not windows services down, then updates ISS and SQL and so on.

Made this on you RMS server

1. Create a Subscription / monitor System EVENT ID 18 Source: contains Update.

Alert description
$Target/Property[Type="Windows1!Microsoft.Windows.Computer"]/PrincipalName$
$Data/Context/EventDescription$
Preparing for security later to day.

2. Then a channel
D:\xxxxxx_auto\xxxxxx_WSUS_MAINT.REXX $Data/Context/DataItem/AlertDescription$

3. Then a Rexx file (use something else if you want)

/* REXX */
/* Program provides a command to put servers in maintenance mode at specific time */
/* ifm. installation of security updates. event 18 from systemlog */

arg parmstr

logfil = ‘D:\xxxxxx_auto\logs\’date(I)’-wsus-maint-input.txt’ /* what is called program */
logfil2 = ‘D:\xxxxxx_auto\wsus-timer.cmd’ /* commands to the scheduled task */
skipfil = ‘D:\xxxxxx_auto\logs\’date(I)’-wsus-maint-skip.txt’ /* errors in the input log here */

‘@echo ‘time() ‘”‘parmstr’” >> ‘logfil

/*————————————————-*/
/* valider input – exit If the input is not correct */
/*————————————————-*/
if pos(‘THESE UPDATES ON’,parmstr) = ’0′ then ,
do
‘@echo ‘parmstr’ >> ‘ skipfil
exit
end

parse value parmstr with servernavn r2 ‘THESE UPDATES ON’ datoen ‘ AT ‘ klokken r3

parse value datoen with dd ‘.’ maaned aaaa

/*—————————————————————————————————————*/
/* Validate the content and length on the date fields */
/*—————————————————————————————————————*/

dd = strip(dd)
if pos(‘?’,dd) ’0′ then dd = strip(dd,,’?')
if length(dd) < '2' then dd = '0'dd

if pos('?',maaned) ’0′ then maaned = strip(maaned,,’?')

if pos(‘?’,aaaa) ’0′ then aaaa = strip(aaaa,,’?')

/*—————————————————————————————————————*/
/* When the scheduled task must be created with month as the number we just convert from name to number */
/*—————————————————————————————————————*/

if substr(maaned,1,3) = ‘JAN’ then maaned = ’01′
if substr(maaned,1,3) = ‘FEB’ then maaned = ’02′
if substr(maaned,1,3) = ‘MAR’ then maaned = ’03′
if substr(maaned,1,3) = ‘APR’ then maaned = ’04′
if substr(maaned,1,2) = ‘MA’ then maaned = ’05′
if substr(maaned,1,3) = ‘JUN’ then maaned = ’06′
if substr(maaned,1,3) = ‘JUL’ then maaned = ’07′
if substr(maaned,1,3) = ‘AUG’ then maaned = ’08′
if substr(maaned,1,3) = ‘SEP’ then maaned = ’09′
if substr(maaned,1,1) = ‘O’ then maaned = ’10′
if substr(maaned,1,3) = ‘NOV’ then maaned = ’11′
if substr(maaned,1,3) = ‘DEC’ then maaned = ’12′

klokken = substr(klokken,1,5)
dato = maaned’/'strip(dd)’/'strip(aaaa)

taskid = servernavn
if pos(‘.’,taskid) ’0′ then parse value taskid with taskid ‘.’ rst_tsk

servernavn = strip(servernavn)

/*say taskid servernavn dato klokken*/

/*——————————————————-*/
/* write to the file later executed by the scheduled task */
/*——————————————————-*/
‘@echo cmd.exe /c d:\xxxxxx_auto\AMM_OPRET_SCHTASK.CMD’ taskid servernavn klokken dato ‘ >> ‘ logfil2

/*—————————————————————————————————————————–*/
/* If the domain controllers, there may come alarms on the running far can not see it there is to be restarted * /
/ * These alarms bother we do not see, so we put also “his partner” in maintenance mode */
/*—————————————————————————————————————————–*/

partner_server = ”

select
/*———————————————*/
/* xx.DK */
/*———————————————*/
when servernavn = ‘xx-DC4.xx.DK’ then ,
do
partner_server = ‘xx-DC5.xx.DK’
partner_taskid = ‘xx-DC5′
end
when servernavn = ‘xx-DC5.xx.DK’ then ,
do
partner_server = ‘xx-DC4.xx.DK’
partner_taskid = ‘x-DC4′
end

/*———————————————*/
/* yy.xx.DK */
/*———————————————*/
when servernavn = ‘ADMIN-DC02.yy.xx.DK’ then ,
do
partner_server = ‘ADMIN-DC3.yy.xx.DK.DK’
partner_taskid = ‘ADMIN-DC3′
end
when servernavn = ‘ADMIN-DC3..yy.xx.DK’ then ,
do
partner_server = ‘ADMIN-DC02..yy.xx.DK.DK’
partner_taskid = ‘ADMIN-DC02′
end

otherwise
do
nop
end
end

/*——————————————————-*/
/* write to the file later executed by the scheduled task */
/*——————————————————-*/
if partner_server ” then ,
do
‘@echo cmd.exe /c d:\xxxxxx_auto\AMM_OPRET_SCHTASK.CMD’ partner_taskid partner_server klokken dato ‘ >> ‘ logfil2

end

/*’@start cmd.exe /c d:\xxxxxx_auto\AMM_OPRET_SCHTASK.CMD’ taskid servernavn klokken dato */

/*’@echo ‘time() taskid servernavn klokken dato’ >> ‘ logfil */

exit

4. Then a Cmd file call AMM_OPRET_SCHTASK.cmd

@echo off
rem …………………………………………………………….
rem . This program will create a schedule task .
rem . Run the program with the parameter. .
rem . Parameter 1 is what you want the task to be named. .
rem . Parameter 2 is the full server name. .
rem . Parameter 3 is the time when the server in maintenance mode. .
rem . Parameter 4 is the date in mm/dd/åååå .
rem …………………………………………………………….

schtasks /create /RU xxxx\SCOM_scheduler /RP PASSWORD /SC ONCE /TN xxxxxx_AMM_%1 /TR “C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe D:\xxxxxx_auto\AgentMaintenanceModeV4.ps1 -rootMS: ‘xx-rms01′ -computerPrincipalName: ‘%2′ -minutes:30 -Comment: ‘Server is being patched’ -reason: ‘PlannedOther’” /ST %3 /SD %4 /V1 /F /RL HIGHEST /Z

5. Then a empty Cmd file call wsus-timer.cmd

6. Then a Cmd file call wsus-timer-admin.cmd

cmd /c d:\xxxxxx_auto\wsus-timer.cmd
del /q d:\xxxxxx_auto\wsus-timer.cmd
echo rem >> d:\xxxxxx_auto\wsus-timer.cmd

7. Then a Schedule task as call wsus-timer-admin.cmd once per hour.

Good luck

thanks for that cool blog post! It’s good to see the improvements in that area.

cheers,
Stefan

Thanks
Manish