I have a strong belief that thou shall not allow Automatic Updates (AU) to be automatically installed on Windows servers. 95% of the time the updates are just fine, but that other 5% can be quite painful.
Last night I installed KB927891 that AU had downloaded. AU actually downloaded two updates, but the one for ‘Update for Intelligent Message Filter for Exchange Server 2003: 2007.05.10 (KB907747)’ I unchecked since I’ve disabled IMF in ESM since I switched over to using a hosted spam filtering service. After AU informed me that I wouldn’t be told to install KB907747 again, the installation process continued. Eventually I was prompted to ‘Restart Now’, which I did.
Unfortunately for me, my server never came back up. That didn’t make me happy, since I was doing the updating from home and wasn’t scheduled to be in the office for five more days. First thing I did in the morning was come into the office to figure out what went wrong with the server.
The first thing I noticed when I walked into the server room was it was too quiet. I immediately noticed it was turned off, so I turned it back on. It came up okay, and after investigating the event logs, I found some interesting messages:
Event 4377 Source: Exchange Server 2003
Update for Intelligent Message Filter on Exchange Server 2003: 2007.05.10 (KB907747) was installed
Event ID: 19 Source: Windows Update Agent
Installation Succesful. Windows successfully installed the following update. Update for Windows Server 2003 (KB927891)
Event 19 Source: Windows Update Agent
Installation successful: Windows successfully installed the following update: Update for Intelligent Message Filter for Exchange Server 2003: 2007.05.10 (KB907747)
Event 1074 Source: User32
The process svchost.exe has initiated the power off of computer SERVER on behalf of user NT AUTHORITY\SYSTEM for the following reason:
No title for this reason could be found
Reason Code: 0×80070020
Shutdown Type: power off
So obviously the server shut itself down (instead of restarting) after installing both of the updates, even though I told it not to install the IMF update, and IMF is disabled anyway!
I decided to change the server’s registry key that enables IMF updates from 1 to 0. Next, I renamed the \Program Files\Exchsrvr\bin\MSCFv2 folder so that it wouldn’t be able to download the IMF updates again. I also restarted the SMTP virtual server so the change would take effect without rebooting the server.
To test the solution, I uninstalled the most recent IMF update that was shown in Add/Remove programs. Next, I restarted the AU service, and manually scanned my machine from Microsoft Update (after selecting Restore Hidden Updates). No missing updates were found, so I hope this means this will be the last time I have to deal with IMF on this box.
I haven’t had much luck finding a solution on the Internet as to why the server powered off instead of rebooting. No smoking gun was found in the WindowsUpdate.log file either. BTW, this server was Windows 2003 SP1, Exchange 2003 SP2. I’m going to assume this was a bug, a fluke, a glitch in the Matrix, act of God, whatever, and not worry about it unless it happens again.