Workflow: Windows update restart

Overview

Important Windows updates often require a device restart. Unfortunately, many employees do not restart their devices as they might not know/care about the update, leading to potential compliance and performance issues. Although Microsoft might send reminders and notifications about necessary restarts, it is not always enough.

The Windows update restart workflow performs an automated check of devices pending a restart due to a Windows update. The restart process then asks users permission for a restart, with the option to delay a maximum of 3 times, at which point, the restart will be enforced.

This workflow ensures a restart in deployed across devices that require it for Windows update reasons. This saves significant time for any support teams that manually reach out to employees to request a restart.

Fully automated device restart process using Nexthink Flow.

  • Automate the retrieval of Windows Boot information to take appropriate action based on results.

  • Ask users to restart now or delay by an hour or in 24h

  • After three delays, the restart will be enforced to ensure the update takes place

Changelog

V1.0.0.0 - Initial Release

Dependencies

To utilize this workflow, you need to install the necessary content into your Nexthink Infinity tenant.

Remote actions

  • Test pending reboot

  • Restart Windows device

For more details about remote actions in workflows see https://nexthink.gitbook.io/opd/user-guide/workflows/creating-workflows/designer.

Engage campaigns

  • Restart device - Workflow invoke

  • Restart device - Last call - Workflow invoke

For more details about campaigns see https://nexthink.gitbook.io/opd/user-guide/campaigns and campaigns in workflows see https://nexthink.gitbook.io/opd/user-guide/workflows/creating-workflows/designer.

Configuration

Remote action and campaign configuration

Please note: To be used in a workflow, the following remote actions must be configured with a manual trigger. It can be combined with other execution triggers if the remote action is also used outside of a workflow.

To be used in a workflow, campaigns must be specified in the input parameters of some of the remote actions and published.

Following remote actions are used in the workflow and must be configured.

  • Test pending reboot

  • Restart Windows device

The “Restart Windows Device” remote action requires all input parameters to be set to allow custom values.

The “Restart Windows Device” remote action requires a campaign as a mandatory input parameter. However, the campaign triggered by the remote action is not used in the workflow. Instead, it is replaced with dedicated campaigns: “Restart device - Workflow invoke” and “Restart device - Last call - Workflow invoke”. Therefore, the NQL ID of the campaign for the remote action can be any ID, unless the remote action is intended to be used separately from the workflow.

Trigger configuration for the workflow

This workflow is primarily designed to run automatically using a scheduled trigger. However, enabling the manual trigger can also be beneficial for ad hoc usage. The recommended schedule will select all devices that have not performed a Windows update in more than 30 days. Below are the details on how it can be configured.

NQL:

Code
1 ddevices during past 30d
2 | where operating_system.platform == windows
3 | where operating_system.days_since_last_update > 30

Workflow Structure

This section describes the key steps in this workflow:

  • Verify if a Windows reboot is pending on the device, and if so, initiate an Engage campaign to inquire whether the user can restart immediately or needs to delay it.

  • When the user agrees to restart immediately, the workflow triggers a remote action to restart the Windows device. If not, the workflow manages a delay of either 1 hour or 24 hours, based on the user’s preference. After the delay period, the user will be asked two more times if they wish to delay. On the third request, the user will be notified through the Engage campaign that this is their final opportunity to delay.\


Last updated