2003 r2 offsite secondary domain controller and 2nd WSUS server

[FLATcura]

hey all,

i have a bit of a pickle, im still in the process of doing extensive research, but any tips would be greatly apreciated.

I have a building on the other side of town that is connected via vpn tunnel to my main building. today i installed a dell pe 2850 with server 2003 r2 to be a secondary domain controller and wsus server for that building.

what i did for my main building is use the default domain policy to specify the wsus server for all the machines on the domain.

In the new building, i guess i thought i could just create a OU for the new building and put all computers in that group, create a specific group policy with location specific details.

however none of the machines have shown up in WSUS and all seem to be sticking to the default domain policy, despite me checking the box for "no override"

is my default policy a bad idea? should i create OUs for computers in my main building as well?

thanks

 

[gimp]

where do you have the 2 WSUS policies set?
One at the domain level, and an additional one at the OU level for the secondary building?

Best practice would be to have different OUs for different sites that need different GPO's applied.
Domain level OUs should only be ones that will be the same across the board, regardless of location/OU.

Although there is no reason it should not be working, as a GPO on an OU takes precedence at a GPO set at the domain level.
http://www.petri.co.il/working_with_group_policy.htm

have all the machines have their group policies refreshed?

 

[FLATcura]

thanks for the reply

yes i had one set as the default domain policy telling all computers to use the main buildings wsus server.

up till this point i have (or inherited) separate domains for each building, but i decided to extend the primary domain to both buildings, so the default domain policy wouldn't suffice

so i created an OU, moved the computers from the second building from the "Computers" folder into the new OU, as well as the new users for that building, and created a GP for that OU

i guess it does make sense to have separate OU's

i have gpupdate /force everytime i made even a slightest change

thanks for the link, ill check that out now

 

[XOR != OR]

A couple things;

1) Don't neglect sites and services. Some settings belong more to a site than a specific OU.
2) I assume you lit up two WSUS servers due to bandwidth considerations? Instead of two administration points, take a look at throttling the bandwidth the workstations use for the patches. You can accomplish this via BITS settings ( Computer Policy -> Admin Templates -> Windows Settings -> Network settings...I think ).
3) After enough time has passed to ensure GPO replication to the remote DC, restart a workstation. If the settings still haven't applied, run RSOP.msc and see why ( or Group Policy Results from gpmc.msc ).