Force software reboots after Software Updates install, and do a WUA rescan upon reboot and install any remaining patches?

Question

Running SCCM 2007 SP2 R3 and having two big issues with SUP that impacted us severely with the February patches.  An RDP patch from November broke our 2-factor authentication (2FA) method, so we stopped deployment until Microsoft could fix the
patch.  Rather than fixing the patch...they made a patch for the patch.
We divided our servers up into multiple Day/Time maintenance windows, like SUN, MON, TUE, and from 0200 to 0600 AM, and we run deployments weekly as needed.
There doesn't seem to be a way in SUP to "let SCCM control reboot" and ALWAYS reboot (whether the patches request it or not), and, as a result, we seem to have an awful lot of servers that are stuck at "reboot pending" after patch installation,
and have actually taken to using a third-party program to reboot the servers.
There also doesn't seem to be a way to force SCCM SUP to rescan the computer after the patch is applied until after a day...or, for servers, a week (from Mon to Mon, for example).
What happened this time around was that the first patch installed and broke 2FA, the second patch is not recognized as being needed until after a reboot and rescan--since that did not occur, it took up to a week to get the second patch installed (IF the
server ever was rebooted), which...was unacceptable.
Soooo...how can I:
     1.  ALWAYS force SCCM to reboot after patching (60-min countdown if user logged-on), just like we do with our normal deployment advertisement, package, program.
     2.  Force a WUA scan after this reboot, so, if remaining patches from this patch group are needed, they get detected and installed, and hopefully this will all work within the 4-hour window (we might be able to extend it earlier,
but, not past 0600).
Thanks!

Answer 1

Thanks, Don.  OK, if there is a "reboot required" returned at the end of the patch deployment...shouldn't the computer then reboot?  We see a large number of computers with "reboot required" that never reboot.  Is there something wrong in
the setup to stop a reboot from occurring?
Thanks.
It looks like you've continued the conversation with Jason and it's taken an interesting turn ;)
But, in the case where a reboot_required is the returned resultcode, CCM will look to your MW and deployment settings, and the context of the installation event (enforcement etc), to determine if the reboot request should be honoured or refused.
You should be able to see all the to-and-fro of this logic within the client logfiles, as it's occurring (or after the event).
If you do some spelunking into the logfiles, don't forget to look at windowsupdate.log (the WUAgent logfile), as that can, with the CCM logfiles, paint a more complete picture of the "flow of things".
This does all assume that the client machine is in a healthy and predictable state to begin with.
If there is already some other pending_reboot hiding in the background, or, WUAgent is running with it's own configuration (potentially fighting with CCM), or, it's Win8 with the "Automatic Maintenance" scheduled task, you can get some unexpected behaviour
(but usually that is unexpected reboot, rather than unexpected no-reboot)
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)