Cluster Aware Update (CAU): Remote Updating Mode - Configuration for Windows Server 2012

Before Windows Server 2012, patching for cluster server was very tedious job - move all the resource to a different node, stop the cluster service & install the patch to this node. After completion of one node, repeat the same for other nodes. It creates huge service outage. From Windows Server 2012, Cluster Aware Update is introduced which automated patch update process for Failover Cluster nodes & minimize the service outage.

 Task performed by CAU :

·           Cluster role is moved to another node. By default, CAU selects the node which runs least roles to install the patch first.

·           The node where patch being installed, put into “Maintenance mode”.

·           Install the patch  & restart the node, if required.

·           Being the node “Out of Maintenance mode”.

·           Restore the Cluster Role.

·           Proceed for the next node

 CAU run in two different modes :

§   Remote-updating Mode: Update co-ordinator runs at the separate computer, which is       not a cluster node.

§   Self-updating Mode: Update co-ordinator runs on one of the cluster nodes. Cluster Aware updating role needs to install on both nodes.

Pre-requisite/Recommendation:

·           The cluster must be healthy – role must move from one node to another.

·           The cluster must have a quorum. Cluster name should resolve by DNS.

·           Disable automatic update on cluster nodes & you can achieve this my GPO setting – “Do not connect to any Windows Update Internet connections” (Enabled it for nodes) (Pix-03).

·           Don’t schedule automatic update for cluster nodes.

·           From WSUS end, identify the cluster nodes & approve the required updates. Recommending different Computer Group for update co-ordinator & cluster nodes.

·           Review any preferred owner settings for clustered roles. Configure these settings so that when CAU completes, it attempts to return clustered roles to the nodes that they were running on before the updating began.

·           Install KB2803748 on Windows 2012 Update Co-ordinator server to mitigate the MMC bug of Windows 2012 Server.

·           Internet connection is not required for Co-ordinator as well as cluster nodes. The only internet for WSUS is sufficient for CAU: Remote Updating Mode.

·           Remote Server Administration Tools (RSAT) for Failover Clustering Feature need to install on Update co-ordinator server.

In Windows 2012 Server: Add Roles & Features > Features > Remote Server Administration Tools >Feature Administration Tools > Failover Clustering Tools >Failover Cluster Management Tool must be selected. After completion of this, you can get “Cluster Aware Update” features under the Tools menu of the Server Manager Dashboard. (Pix-01 & 02).

Pix-01: Installation of RSAT – Failover Cluster

Pix-02: Cluster-Aware Updating

Pix-03: GPO Settings for WSUS & CAU

In this case, we’ll consider only CAU: Remote Updating mode. The setup is as below diagram (Pix-04). AD server also acts as Update Co-Ordinator server & RSAT for Failover Clustering tools is installed on this server. WSUS server is not in domain & connected with internet. Failover Cluster – “FO-Cluster” has two nodes- W2012-N1 & W2012-N2. Windows FW for all server is disabled.

Pix-04: Diagram - CAU Implementation

Now Go to Tools menu from Update co-ordinator server > Cluster-Aware Updating > Select the Cluster from drop-down menu > Click on “Analyze Cluster Updating Readiness” to check the CAU readiness. If the test is showing proxy error or recommending to install CAU role on a cluster node, ignore it. Because we are going to implement CAU: Remote-updating Mode. If you look into the result, you get various information about pre-requisite for CAU. (Pix-05)

Pix-05: CAU - Analyze Cluster Updating Readiness

 Now click on “Preview Updates for this cluster” from Cluster-aware Updating window. Select “Microsoft.WindowsUpdatePlugin”, it will connect to WSUS to check which updates are required for the cluster nodes.

In my scenario from WSUS, I have approved 6 updates to Cluster Nodes (W2012-NODES: Computer group for Cluster Nodes) (Pix-06). Now I can check the same if I run “Preview updates for this cluster” from Cluster-aware Updating Window (Pix-07)

Pix-06: Updates approve to Cluster nodes from WSUS

Pix-07: CAU preview showing Updates for nodes

Now Apply updates to this cluster, it’ll ask a few configurations, you can go with a default value. By default, CAU start updating the nodes which run fewer server roles (in this case W2012-N2).

Pix-08: CAU - Apply updates to this cluster

Pix-09: CAU - Node updating is going to start

As roles are running at Node-1, the update will start at Node-2 first. Check CAU logs from Cluster-Aware Updating console (Pix-10). Before that Node-2 would be in maintenance mode. You can also check from Cluster Management console, show W2012-N2 in “Pause” (Pix-11)

Pix-10: CAU Console: Node-2 Updating start

Pix-11: Cluster Management Console - Node 2 in maintenance mode

After successfully update of Node-2, it restarts automatically. After restart node come out from Maintenance mode to normal mode & Update status is changing to “Succeeded” (Pix-12). After that Node-1 will be in Maintenance mode & start updating. After that node will be restart & change its status to “Succeeded”. Server Roles in Node-1 which was transferred to Node-2 before start updating Node-1 will restore to Node-1 again automatically. But Quorum will stay at Node-2.

Pix-12: Node-2 is updated successfully

Pix-13: CAU-Remote Updating successful

Tag : Cluster-Aware Updating, CAU, WSUS, Windows Server 2012,    Patch Deployment