WSUS is a Windows Server 2012 and Windows Server 2012 R2 role service that allows you to manage and deploy Microsoft operating system and application updates. Rather than having each computer in your organization connect over the Internet to acquire software updates, you can configure a server with the WSUS role installed to acquire these updates, and then to serve as a central distribution point. You can also integrate the WSUS role with Configuration Manager and with VMM, topics that are covered later in this section.
Configuring the WSUS server
Once you’ve installed the WSUS server role, you need to run the WSUS Server Configuration Wizard to configure how the WSUS server functions. The WSUS Server Configuration Wizard allows you to configure WSUS server settings. Running this wizard involves performing the following steps:
1. Choose whether the WSUS server will synchronize with Microsoft update, or synchronize with another WSUS server. If you synchronize with Microsoft update, the WSUS server will obtain updates from Microsoft’s servers through the Internet. If you choose to synchronize with another WSUS server, you can choose to synchronize updates from that server, or configure the WSUS server as a replica, in which case you will synchronize approvals, settings, computers, and groups from the server. You configure replica servers in scenarios where you want to deploy multiple WSUS servers, but have them all use the same settings. Figure 1 shows a WSUS server configured to synchronize as a replica. When you configure a WSUS server as a replica, you don’t need to choose languages, products, or classifications.
FIGURE 1 Windows Server Update Services Configuration Wizard
2. Next, you configure whether the WSUS server will use a proxy server during synchronization. If required, you can configure proxy server credentials.
3. The next step requires the WSUS server to synchronize with either Microsoft Update, or the upstream server. This allows the WSUS server to obtain a list of update types, language options, and products that the WSUS server will provide.
4. Once synchronization has completed, select whether to download updates in all languages, or updates in a specific language. Most organizations will only require updates in their local language. Figure 2 shows a configuration where only English is selected as the language.
FIGURE 2 Update Services Configuration
5. On the Products page, select the products for which the WSUS server should obtain updates. To minimize the number of updates that will be downloaded, you should select only products that are used in your organization. Figure 3 shows the selection of updates for several System Center 2012 R2 products.
FIGURE 3 Product Selection
6. On the Classifications page, select which update classifications you want the WSUS server to synchronize. Figure 4 shows updates of all the classifications selected.
FIGURE 4 Choose classifications
7. The final step to take in configuring a WSUS server is to choose how often the WSUS server synchronizes, and to choose whether to perform an initial synchronization. The default is to have the WSUS server synchronize manually.
After deployment, you can modify the WSUS server’s settings. For example, you might change the products, languages, or update classifications that the WSUS server uses when obtaining updates. You can also configure an “approvals only” WSUS server. An “approvals only” WSUS server is one where clients contact the WSUS server to determine which updates are approved for installation, but download the update files themselves from the Microsoft update servers on the Internet.
Creating computer groups
You approve updates in WSUS on the basis of computer groups. This allows you to approve an update for deployment to one group, such as a test server group, whilst not deploying the update to every computer in your organization. You can assign computers to computer groups manually, or by using Group Policy. You should create the computer groups on the WSUS server prior to configuring WSUS computer group assignment through Group Policy. You’ll only be able to manually assign computers to groups that have contacted the WSUS server for updates.
To create computer groups on the WSUS server, perform the following steps:
1. In the WSUS Server console, expand the Computers group, and then the All Computers group.
2. On the Actions pane, click the Add Computer group.
3. On the Add Computer Group dialog box, enter a name for the computer group. Figure 5 shows a computer group named Melbourne Infrastructure.
FIGURE 5 Add Computer Group
Once you’ve created the group, you can manually assign computers that have contacted the WSUS server to the group by moving them from the Unassigned Computers group. Computers assigned to groups through Active Directory will automatically be added to the appropriate group.
Group Policy settings
In domain environments, you use Group Policy to configure computers with the address of the WSUS server, as well as other configuration settings. Windows update related group policies are located in both the Computer Configuration and User Configuration nodes. Figure 6 shows Windows update related group policies.
FIGURE 6 Windows update policies
You use the Specify Intranet Microsoft Update Service Location policy to configure a computer with the address of the WSUS server. Figure 7 shows this policy configured so that the computer subject to this policy will use the update server at http://mel-wsus.tailspintoys.internal on port 8530, which is the default port used by WSUS on Windows Server 2012 and Windows Server 2012 R2.
FIGURE 7 Local WSUS server
You assign computers to WSUS computer groups using the Enable client-Side Targeting policy. Figure 8 shows this policy configured for membership of the Melbourne Infrastructure WSUS computer group.
FIGURE 8 Client-side targeting
Approving updates
You can choose to manually approve WSUS updates, or configure auto-approval rules. You approve updates on a per-computer group basis. When you approve an update, you can have that update apply to the computer group and any computer groups that are nested members of that computer group. You can also choose to apply an update to a computer group, and exclude any computer groups that are nested members of that group.
To manually approve an update, perform the following steps:
1. In the Updates node of the WSUS console, locate the update that you want to approve for distribution, as shown in Figure 9.
FIGURE 9 Update Services
2. On the Actions pane, click Approve.
3. On the Approve Updates dialog box, select the computer groups for which the update is approved. Figure 10 shows an update that is approved for the Melbourne Infrastructure group, but not approved for the Melbourne DHCP Servers group.
FIGURE 10 Approve Updates
Rather than manually approve updates, you can configure automatic approval rules so that new updates are automatically approved based on their properties. A default automatic approval rule, which is not enabled, will automatically approve critical and security updates to all computers that report to the WSUS server. To configure an automatic approval rule, perform the following steps:
1. In the Options node of the WSUS console, click Automatic Approvals.
2. On the Automatic Approvals dialog box, shown in Figure 11, click New Rule.
FIGURE 11 Automatic Approvals
3. On the Add Rule dialog box, select from the following options:
- Update Classification
- Update Product
- Approval Deadline
- Computer Groups
4. Figure 12 shows a rule that will automatically approve critical updates, security updates, update rollups, and updates for Windows Server 2012 R2 if a computer is a member of the Melbourne Infrastructure group, with an installation deadline of 7 days after the approval.
FIGURE 12 Add Rule
Verifying update deployment
You can verify update deployment and computer compliance either by viewing the properties of individual computers, or by viewing information on a per-update basis. Figure 13 shows that computer Mel-demoserver requires 59 updates and has 69 updates either installed or not applicable. It is important to note that the WSUS server doesn’t scan a computer to determine what updates are installed. Instead, the client computer contacts the WSUS server and provides information about which updates have been installed. The WSUS server then uses this information to determine which updates need to be installed given the current configuration of the WSUS client.
FIGURE 13 Update status
The WSUS server also provides the following reports, shown in Figure 14, that you can use to determine the update status of computers that report to the WSUS server:
- Update Status Summary
- Update Detailed Status
- Update Tabular Status
- Update Tabular Status For Approved Updates
- Computer Status Summary
- Computer Detailed Status
- Computer Tabular Status
- Computer Tabular Status For Approved Updates
- Synchronization Results
FIGURE 14 Report
