Creating a Windows Update Deployment on a Monthly Schedule

[thepaulmacca]

I'm not sure if this is even possible but will ask the question...

I'm creating an automation account with update management enabled, and I'm looking to create 2 deployment schedules:

• Definition Updates (every hour)
• Windows Updates (3rd Saturday of the month at 10pm)

I've managed to create the definition updates deployment fine, but I'm getting stuck with the windows updates deployment

I'm looking to create this deployment on the 3rd Saturday of the month at 10pm, but for different timezones. Is this possible?

Here is what I have so far:

param baseTime string = utcNow('u')

var defenderDefinitionUpdatesStartTime = dateTimeAdd(baseTime, 'PT1H')

resource automationAccount 'Microsoft.Automation/automationAccounts@2020-01-13-preview' = {
  name: automationAccountName
  location: location
  properties: {
    sku: {
      name: 'Basic'
    }
  }
  resource defenderDefinitionUpdates 'softwareUpdateConfigurations@2019-06-01' = {
    name: 'defenderDefinitionUpdates'
    properties: {
      scheduleInfo: {
        description: 'Windows Defender Definition Updates'
        frequency: 'Hour'
        interval: 1
        isEnabled: true
        startTime: defenderDefinitionUpdatesStartTime
      }
      updateConfiguration: {
        duration: 'PT1H'
        operatingSystem: 'Windows'
        targets: {
          azureQueries: [
            {
              scope: [
                subscription().id
              ]
              tagSettings: {
                filterOperator: 'All'
                tags: {
                  MaintenanceWindow: [
                    'ThirdSaturdayOfMonth'
                  ]
                }
              }
            }
          ]
        }
        windows: {
          includedUpdateClassifications: 'Definition'
          rebootSetting: 'Never'
        }
      }
    }
  }
  resource windowsUpdates 'softwareUpdateConfigurations@2019-06-01' = {
    name: 'windowsUpdates'
    properties: {
      scheduleInfo: {
          advancedSchedule: {
            monthlyOccurrences: [
              {
                day: 'Saturday'
                occurrence: 3
              }
            ]
          }
        description: 'Windows OS Updates'
        frequency: 'Month'
        interval: 1
        isEnabled: true
        startTime: ''
      }
      updateConfiguration: {
        duration: 'PT2H'
        operatingSystem: 'Windows'
        targets: {
          azureQueries: [
            {
              scope: [
                subscription().id
              ]
              tagSettings: {
                filterOperator: 'All'
                tags: {
                  MaintenanceWindow: [
                    'ThirdSaturdayOfMonth'
                  ]
                }
              }
            }
          ]
        }
        windows: {
          includedUpdateClassifications: 'Critical,Security,UpdateRollup,Updates'
          rebootSetting: 'IfRequired'
        }
      }
    }
  }
  dependsOn: [
    logAnalyticsWorkspace
  ]
}

I'm probably trying to be too fancy, but if anyone knows of a way to solve it, I'm all ears

Thanks!

[brwilkinson]

I believe what you are looking for should be available with the scheduler that is part of the 'softwareUpdateConfigurations'

I have been using weekly updates that look like this.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/5e1ac1fa60b751f44697286b7c59791a6b243e3b/ADF/bicep/OMS.bicep#L887

        scheduleInfo: {
            isEnabled: patchingStatus.windows
            frequency: 'Week'
            interval: 1
            advancedSchedule: {
                weekDays: [
                    'Wednesday'
                    'Thursday'
                ]
            }
        }

When referencing the api docs here:

https://docs.microsoft.com/en-us/azure/templates/microsoft.automation/2019-06-01/automationaccounts/softwareupdateconfigurations?tabs=bicep#sucscheduleproperties

It appears that your configuration looks good, are you having some troubles with it ? i.e. it's not running or errors out ?

When I deploy the following (It defaults to UTC)

        scheduleInfo: {
            isEnabled: patchingStatus.windows
            frequency: 'Month'
            interval: 1
            advancedSchedule: {
                monthlyOccurrences: [
                    {
                        day: 'Saturday'
                        occurrence: 3
                    }
                ]
            }
        }

This is generated, which looks good ?

When I update it to include the timeZone, that is reflected in the schedule

        scheduleInfo: {
            isEnabled: patchingStatus.windows
            frequency: 'Month'
            timeZone: 'America/Denver'
            interval: 1
            advancedSchedule: {
                monthlyOccurrences: [
                    {
                        day: 'Saturday'
                        occurrence: 3
                    }
                ]
            }
        }

Are you able to share some more info? i.e. is it time zone OR start time related Etc?

[brwilkinson]

Adding the Starttime as well... which has to be at least 5 minutes beyond the actual deployment time.

Simply using '20:00' would fail anytime the deployment was after 7.55pm, so I think just adding 1 day to that would always work.

i.e. start the schedule at 8pm tomorrow, then it will look for the 3rd Saturday after that.

        scheduleInfo: {
            isEnabled: patchingStatus.windows
            frequency: 'Month'
            timeZone: 'America/Los_Angeles'
            interval: 1
            startTime: dateTimeAdd('20:00', 'P1D')
            advancedSchedule: {
                monthlyOccurrences: [
                    {
                        day: 'Saturday'
                        occurrence: 3
                    }
                ]
            }
        }

I think that should cover it for most scenarios, you just pass in the different TimeZone and Start time to create each unique schedule, that gets mapped to a resource group with Virtual Machines in any specific timezone Etc.

I pushed the example, in case it's helpful
https://github.com/brwilkinson/AzureDeploymentFramework/blob/07085f5333874b08f1ff38301a6a17f74030621f/ADF/bicep/OMS.bicep#L858

[thepaulmacca]

Thanks for getting back to me, this is great I really appreciate it! I'll give it a try tomorrow and report back 👍

[thepaulmacca]

@brwilkinson I'm so sorry for not getting back to you sooner - this works an absolute treat. Thanks again for your help! 👍

[brwilkinson]

Hey Paul, thanks for letting us know.

It's also worth mentioning that the OSProfile also has some 'patchSettings' ,.. that can be set at deployment time as part of the current Preview outlined below.

https://docs.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?tabs=bicep#windowsconfiguration
https://docs.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?tabs=bicep#linuxconfiguration

• https://docs.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?tabs=bicep#patchsettings

The 'PatchMode' where some Operating systems support the 'AutomaticByPlatform' setting, which has some advantages.

** Preview details here:**
https://docs.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching#patch-orchestration-modes

[thepaulmacca]

Thanks, I saw that a while back and must revisit it soon as that's a cool feature!