How to prevent Terminal Server Users from restarting the server after an Automatic Update

In group policy for the server, navigate to:

Computer Configuration->Administrative Templates->Windows Components->Windows Update->No auto-restart for scheduled Automatic Update installation

You can get to this by running gpedit.msc.

Reboot to apply changes.

Don't forget that your server won't be updated until you reboot and will be vulnerable to the threats!

For some strange reason reboots started by Windows Update have a nasty track record of causing problems. The solution I've been using for years is to script the install and then reboot separately via a scheduled task. I've had no reboot problems since doing this.

I use version 2.4 of this script (because it just works and I see no reason to upgrade it), which I've modified slightly to create a flag file when a reboot is required. The script check for updates and installs any that it finds. That script runs late on Saturday night via the Task Scheduler. Early Sunday morning another scheduled task fires a script which looks for that flag file. If it's found the file is deleted and the server performs a reboot.