WSUS Server, General Info ?'s

T

trckn4life

Limp Gawd
Joined
Sep 5, 2006
Messages
213
I'm wondering about some general information regarding setting up and planning patch management with a WSUS server.

First off I have a few groups of users at work and a power policy was just instituted and everyone is to shut off their computers at the end of the day (other than certain exceptions). Any suggestions on how to work around this for getting them updates?

For some computer labs when they were left on I would using Deep Freeze have them setup to run updates in the early morning on Saturday.

How can we differentiate between groups? Can I give certain users the ability to (have downloads already there), but let them choose when to install?

We know we don't want forced reboots when a user is on the computer, or they should have the ability to make it wait till later. Any general suggestions or knowledge bases? Please school me on this, as I am new to setting up a WSUS.
 
Are you running Active Directory? WSUS doesn't control those type of things. You can setup different groups to control which groups get which updates and set install by dates for those groups. Controling when the computer gets updates, which group it's a member of, and what it does when it downloads the updates is a client-side setting. If you're running AD, you can control it all via a Group Policy.
 
well, right now we have a Server 2003 server as our PDC. The clients login on this domain and I have another server 2003 box that is an antivirus server and I would also like to set it up to use as a WSUS because right now some systems are set to update at certain times and others are not.

But, the lab machines are a whole other story. We are also using group policies but mostly to keep certain users from being able to browse the network, access the run command and command prompt, etc.

But I will say that I am not verry familiar with pushing out updates via WSUS or by group policies. In fact in some instances it would be nice to be able to publish software and make it available to certain users (through add/remove), I know it can be done but I'm not certain as to how. But, at the moment windows updates are my larger concern. But, anyway to automate it or make it simpler to for our users, that would be great.

I'm trying to get away from having to go and install updates/software etc individually on computers.
 
WSUS v3.0 SP1 is fairly simple to install and setup. Just download it and install on your second server. Set it up to sync daily with MS Update and pick what updates you want to install, etc. There is a basic critical update approval policy which will go out and grab all the important stuff automatically.

You have to configure group policies to point your client computers to the WSUS server to get the updates. You can specify the time, automatic reboot, wake from suspend, etc, from the policy and create different ones for each group of computers you have. You can then assign the computers to groups in WSUS and specify different patch approvals, etc.

I would just go ahead and start playing with it, you're not going to break anything. The settings in AD, if memory serves, you need to set are COMPUTER SETTINGS'>WINDOWS COMPONENTS> WINDOWS UPDATES

 
Thanks for the help. Maybe if I can find some time at work today I will try to get it installed and play around with it a little bit. Thanks.

I know that as of now we want to stay away from IE 7. We have run into too many websites that it has trouble on. That would definitely be one to exclude for now.
 
trckn4life said:
I'm wondering about some general information regarding setting up and planning patch management with a WSUS server.

First off I have a few groups of users at work and a power policy was just instituted and everyone is to shut off their computers at the end of the day (other than certain exceptions). Any suggestions on how to work around this for getting them updates?

For some computer labs when they were left on I would using Deep Freeze have them setup to run updates in the early morning on Saturday.

How can we differentiate between groups? Can I give certain users the ability to (have downloads already there), but let them choose when to install?

We know we don't want forced reboots when a user is on the computer, or they should have the ability to make it wait till later. Any general suggestions or knowledge bases? Please school me on this, as I am new to setting up a WSUS.
Click to expand...

yes

yes

no you don't have to force reboots


Wake on lan is the only thing i can think of for people who shut down. Wsus 3 is remarkably easy to use, we have it here, although for the most part it is just to block auto-updates from downloading.
 
Ok, I got the WSUS setup on Friday. I started doing some approvals, there are a Lot! I have not had a chance to add any clients as of yet. I'm hoping to work on this some today. :) Thanks
 
Don't forget about the default automatic approval setting you can do under options. That will take care of all the critical patches. :)

 
trckn4life said:
Thanks for the help. Maybe if I can find some time at work today I will try to get it installed and play around with it a little bit. Thanks.

I know that as of now we want to stay away from IE 7. We have run into too many websites that it has trouble on. That would definitely be one to exclude for now.
Click to expand...

On the contrary, if you can possibly get IE7 to work with those sites, you should install it. Depending on the site, that may not be possible, but the enhanced security in IE7 isn't something to ignore if you can help it.
 
You must log in or register to reply here.
Back
Top