You can integrate WSUS with VMM as a way of centrally managing updates for your organization’s virtualization servers and VMM infrastructure servers. Integrating WSUS with VMM allows you to:
- Collect updates together in baselines
- Determine update compliance.
- Remediate update compliance.
- Automatically evacuate VMs off of host cluster nodes that require a reboot to install updates.
Configuring WSUS with VMM
While it’s possible to deploy the WSUS role on the computer that hosts VMM, Microsoft recommends that WSUS be deployed on a separate computer. You should run the WSUS Configuration Wizard to perform preliminary WSUS configuration, and perform a synchronization prior to integrating with VMM. You can run the WSUS Configuration Wizard and perform a synchronization using the default settings.
To integrate WSUS with VMM, perform the following steps:
1. In the Fabric workspace of the VMM console, click the Update Server Node under Infrastructure, as shown in Figure 1.
FIGURE 1 Update Server
2. On the Ribbon, click Add Resources, and then click Update Server. This will launch the Add Windows Server Update Services Server dialog box.
3. In the Add Windows Server Update Services Server dialog box, provide the following information, as shown in Figure 2, and then click Add.
- Computer Name The FQDN of the WSUS server.
- TCP Port The WSUS server’s TCP port. By default, this is port 8530 (or port 8531 if using SSL) when you deploy WSUS on computers running Windows Server 2012 or Windows Server 2012 R2.
- Credentials An account with local Administrator privileges on the WSUS server. You can also use a Run As account for this task.
FIGURE 2 Add Update Server
4. Once the installation completes, verify that the update server is listed when the Update Server node is selected. The Agent Status is set to Responding, and Synchronization Result is listed as Succeeded, as shown in Figure 3.
FIGURE 3 Update Server
5. To check which updates are available, in the Library workspace, select Update Catalog under Update Catalog And Baselines, and verify that updates are listed, as shown in Figure 4.
FIGURE 4 Update Catalog
After the initial synchronization is performed to gather the current list of available updates, VMM will not perform subsequent synchronizations automatically. This means that you need to either perform them manually, or configure a scheduled task using the Start-SCUpdateServerSynchronization Windows PowerShell cmdlet. To trigger a synchronization using the VMM console, perform the following steps:
1. In the Fabric workspace of the VMM console, select Update Server under the Servers\Infrastructure node.
2. Select the WSUS server that you want VMM to synchronize.
3. On the ribbon, click the Synchronize icon.
To trigger synchronization from the Virtual Machine Manager Command Shell, issue the following command, where WSUSServerName is the name of the WSUS server.
SCUpdateServerSynchronization WSUSServerName
Update baselines
An update baseline is a collection of software updates. You can use update baselines as a way of assessing computers and applications to determine whether or not they are up-to-date. A computer that has all of the updates that are in an update baseline collection installed is said to be compliant. A computer that does not have all of the updates that are in an update baseline collection installed is said to be non-compliant.
You assign baselines to computers performing the following VMM roles:
- Host group
- Individual hosts
- Library servers
- PXE servers
- Update server
- VMM Management server
Figure 5 shows the Assignment Scope page of the Update Baseline Wizard.
FIGURE 5 Assignment Scope
Assigning an update baseline does the following:
- When you assign a baseline to a host group, the baseline will apply to all stand-alone hosts and host clusters that are members of the group. The baseline also applies to any stand-alone costs and host clusters that are members of child host groups.
- When you move a host or host cluster between host groups, the host or host cluster will use the update baseline associated with its new host group.
- If you assign a baseline to a host or a host cluster directly, the host or host cluster will use that update baseline when moved between host groups.
To create a new update baseline, perform the following steps:
1. In the Library workspace of the VMM console, click Update Baselines under Update Catalog And Baselines.
2. On the ribbon, click Create, and then click Baseline. This will launch the Update Baseline Wizard.
3. On the General page of the Update Baseline Wizard, provide a name and description for the baseline.
4. On the Updates page of the Update Baseline Wizard, click Add. This will launch the Add Updates To Baseline dialog box. You use this dialog box to add updates to the baseline. Figure 6 shows a security update for Windows Server 2012 R2 selected for addition to the baseline. Select all of the updates that you want to have in the baseline, and click Add.
FIGURE 6 Add Updates To Baseline
5. On the Updates page of the Update Baseline Wizard, shown in Figure 7, review the list of updates in the baseline, and then click Next.
FIGURE 7 Updates
6. On the Assignment Scope page, select the servers, host clusters, and host groups to which you wish to assign the baseline. You don’t have to assign the baseline at this time. You can do it after you have created the baseline.
7. Complete the wizard to create the update baseline.
To assign computers to a baseline, edit the properties of the baseline and select the host groups, hosts, or infrastructure server to which you want the baseline to apply. Figure 8 shows the TailspinToys Baseline update baseline being assigned to the Example-Host-Group host group.
FIGURE 8 Assign
Update compliance
After assigning an update baseline, you can perform a scan to determine the compliance status of the computers subject to the baseline. A compliance scan checks whether each update in the baseline is applicable to the computer and, if the update is applicable, whether that update is installed. After a compliance scan, each update will have one of the following statuses:
- Compliant
- Non Compliant
- Error
- Pending Reboot
- Unknown
The unknown status often applies when hosts are moved between host groups, when updates are added or removed from baselines, or when computers are added to the scope of the baseline. Viewing compliance properties will provide additional information.
To scan a computer to determine whether or not it is compliant, perform the following steps:
1. In the Fabric workspace of the VMM console, select the server on which you want to perform the compliance check.
2. On the Home tab of the ribbon, click Scan.
3. On the Home tab of the ribbon, click Compliance Properties to view the compliance state of the computer. Figure 9 shows the compliance state of Hv-host-a.tailspintoys.internal against the TailspinToys Baseline.
FIGURE 9 Compliance Properties
You can use the Compliance Properties dialog box to exempt a particular computer from a specific update. Figure 10 shows two updates exempted from a particular baseline for host Hv-host-a.tailspintoys.internal.
FIGURE 10 Exemption
To create an exemption, select those updates you want to exempt from the baseline, and click Create. This launches the Create Exemption dialog box. When using this dialog box, provide notes that explain why the computer or computers in question have been exempted from the updates being applied, as shown in Figure 11.
FIGURE 11 Create Exemption
Update remediation
Remediating a computer applies updates that are relevant but have yet to be applied to a computer. To remediate a computer, select the update baseline under the computer Compliance view in the Fabric workspace, as shown in Figure 12, and then click Remediate on the ribbon.
FIGURE 12 Non Compliant
On the Update Remediation dialog box, shown in Figure 13, select whether to restart servers to complete update installation. If you are applying updates to Hyper-V cluster nodes, you can also select whether virtual machines will be evacuated from the node, or placed into a saved state.
FIGURE 13 Update Remediation
