.jpg)
How to install and manage your WSUS Server and WSUS Clients
- 1. Install WSUS Server on your Windows Server Open "Server Manager" on your Windows Server. Click Add "Roles and Features". Click "Next". Confirm that "Role-based or feature-based installation" option is selected. Click "Next". ...
- 2. Configuring your WSUS Server Now that you have WSUS Server installed. ...
- 3. Assigning WSUS Clients to your WSUS Server ...
- 4. Start using WSUS Server to Approve and Deploy Updates ...
Full Answer
How do I manage my WSUS server?
Recommended contentStep 1 - Install the WSUS Server Role. ... Deploy Windows Server Update Services. ... Update Management with Windows Server Update Services. ... Step 3 - Approve and Deploy Updates in WSUS. ... Deploy Windows client updates using Windows Server Update Services - Windows Deployment. ... Plan Your WSUS Deployment.More items...•
How do I access WSUS management console?
To open the WSUS console On your WSUS server, click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services.
How do I check my WSUS settings?
Take a look under Computer Configuration > Administrative Templates > Windows Components > Windows Update . You should see the keys WUServer and WUStatusServer which should have the the locations of the specific servers.
How do I change my WSUS settings?
Right-click the WSUS – Auto Updates and Intranet Update Service Location GPO, and then click Edit. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. Right-click the Configure Automatic Updates setting, and then click Edit.
How do I check my WSUS client server?
Run wuauclt /detectnow command on the Windows client/server that have a registration issue in WSUS. You can use the Event Viewer to review the re-registration. In rare cases, you may need to run wuauclt.exe /resetauthorization /detectnow command on the Windows client/server that have a registration issue in WSUS.
How do I connect to WSUS client server?
To point the client computer to your WSUS server In Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update. In the details pane, double-click Specify intranet Microsoft update service location.
How do I troubleshoot WSUS issues?
In this articleVerify that the client is configured correctly.Check for issues relating to BITS.Issues with the WSUS agent service.Make sure the WSUS server is reachable from the client.Rebuild the Automatic Update Agent Store.Check for clients with the same SUSclient ID.
How do I know if WSUS is downloading updates?
log log on the WSUS server, located at %programfiles%\Update Services\LogFiles, which includes the status of the update file. Check for changes in the size of the WSUSContent folder.
How do I find my WSUS URL?
The URL for accessing the WSUS home page is www.microsoft.com/windowsserversystem/updateservices/ downloads/WSUS. mspx or http://go.microsoft.com/fwlink/?LinkId=47374..
What is WSUS and how it works?
WSUS Definition It helps distribute updates, fixes, and other types of releases available from Microsoft Update. You can use WSUS to reliably and securely manage, distribute, and install updates for Microsoft products in an organization's IT network.
Is WSUS still used?
WSUS is still fully supported and many companies rely on it. WSUS helps maintain order: Instead of having all the Windows clients go to the internet and download the updates, you have one or more WSUS servers that centralize the job and give you control on which updates to release to the clients.
How do I switch from WSUS to Windows Update?
How to: WSUS - Bypass to windows updates onlineStep 1: Open CMD with admin privileges. REG ADD “HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU” /v UseWUServer /t REG_DWORD /d 0 /f net stop “Windows Update” net start “Windows Update” ... Step 2: Open windows update.
How do I open WSUS console from command line?
You can go to server manager on a server that has the wsus admin console on it....In the Start menu search bar, type cmd.From the search results, right-click on Command Prompt > Run as Administrator.In the CMD console, type mmc and hit Enter to launch the Microsoft Management Console.
How do I install WSUS admin console?
To install the WSUS 3.0 console only from the UI Double-click the installer file (WSUSSetup-x86.exe or WSUSSetup-x64.exe). On the Welcome page, click Next. On the Installation Mode Selection page, select the Administration Console only check box, and then click Next. Read the terms of the license agreement carefully.
How do I find my WSUS URL?
The URL for accessing the WSUS home page is www.microsoft.com/windowsserversystem/updateservices/ downloads/WSUS. mspx or http://go.microsoft.com/fwlink/?LinkId=47374..
How do I enable WSUS?
Recommended contentStep 1 - Install the WSUS Server Role. Windows Server Update Service (WSUS) topic - Describes how to install the server role using Server Manager.Step 3 - Approve and Deploy Updates in WSUS. ... Step 4 - Configure Group Policy Settings for Automatic Updates.
What is WSUS?
Windows Software Update Services (WSUS) is used by system administrators to manage the distribution of updates and hotfixes that are released by Microsoft for an environment. Currently, the most recent version is WSUS 3.0 with Service Pack 2, and it is available to download. This installation allows you to install the full server installation option or only the console installation (which can be installed on any client or server). It also has the assemblies required to use Windows PowerShell to manage the WSUS server. To determine the version of WSUS, refer to Appendix G: Detect the Version of WSUS on Microsoft TechNet.
Who is the Microsoft scripting guy?
Microsoft Scripting Guy, Ed Wilson, is here. You are in for a treat this week. Boe Prox has written a week’s worth of goodies, and we will share them here.
Can I install WSUS 3.0 with SP2?
You could install WSUS 3.0 with SP2 on your server by using the file specified in the previous download link and running through the UI installation. But c’mon, this is a scripting blog, so surely we can script something out…right? Right!
Can I install WSUS server unattended?
The script I wrote that will allow a local or remote installation of a WSUS server or to install only the WSUS Administration Console is called Install-WSUSServer.ps1.
How to add a computer to a WSUS group?
To add a computer to a group, right-click on a device, and select Change Membership . This will bring up the list of groups we created. Select the desired group and click OK . If you have a substantial amount of computers in WSUS, there are few things you can do to help this process go quicker.
What to do if you don't have a patch management policy?
If you don’t have a patch management policy in place or if it doesn’t cover feature updates, get together with your team and put something together. Since feature updates are new operating system versions, special care should be taken with deployments.
Why do you need to do less testing for OS updates?
Since quality updates don’t introduce significant changes to the OS, less testing is required to ensure system compatibility. On the other hand, you may want to postpone feature update installations or even skip specific feature updates all together depending on your environment.
Introduction
- A WSUS server provides features that you can use to manage and distribute updates through a management console. A WSUS server can also be the update source for other WSUS servers within the organization. The WSUS server that acts as an update source is called an upstream server. In a WSUS implementation, at least one WSUS server on your network mus...
Maintain WSUS while supporting Configuration Manager current branch version 1906 and later versions
Important considerations
Perform WSUS maintenance
- If you are using Configuration Manager current branch version 1906 or later versions, we recom…
For more information about software update maintenance in Configuration Manager, see Software updates maintenance.
Troubleshooting
- 1.Before you start the maintenance process, read all of the information and instructions in this a…
2.When using WSUS along with downstream servers, WSUS servers are added from the top down, but should be removed from the bottom up. When syncing or adding updates, they go to the upstream WSUS server first, then replicate down to the downstream servers. When performing … - 3.WSUS maintenance can be performed simultaneously on multiple servers in the same tier. Wh…
4.Ensure that SUPs don't sync during the maintenance process, as it may cause a loss of some work already done. Check the SUP sync schedule and temporarily set it to manual during this process.
Automating WSUS maintenance
- Back up the WSUS database
Back up the WSUS database (SUSDB) by using the desired method. For more information, see Create a Full Database Backup. - Create custom indexes
This process is optional but recommended, it greatly improves performance during subsequent cleanup operations. If you are using Configuration Manager current branch version 1906 or a later version, we recommend that you use Configuration Manager to create the indexes. To create th…
2.1. Configure network connections
- HELP! My WSUS has been running for years without ever having maintenance done and the clea…
There are two different options here: 1.Reinstall WSUS with a fresh database. There are a number of caveats related to this, including length of initial sync, and full client scans against SUSDB, versus differential scans. 2.Ensure you have a backup of the SUSDB database, then run a reindex… - Running the Decline-SupersededUpdatesWithExclusionPeriod.ps1 script times out when connec…
If errors occur when you attempt to use the PowerShell script to decline superseded updates, an alternative SQL script can be run against SUDB. 1.If Configuration Manager is used along with WSUS, check Software Update Point Component Properties > Supersedence Rules to see how q…
2.2. Configure WSUS by using the WSUS Configuration Wizard
- WSUS maintenance tasks can be automated, assuming that a few requirements are met first.
1.If you have never run WSUS cleanup, you need to do the first two cleanups manually. Your second manual cleanup should be run 30 days from your first since it takes 30 days for some updates and update revisions to age out. There are specific reasons for why you don't want to a… - 2.If you have downstream WSUS servers, you will need to perform maintenance on them first, an…
3.To schedule the reindex of the SUSDB, you will need a full version of SQL Server. Windows Internal Database (WID) doesn't have the capability of scheduling a maintenance task though SQL Server Management Studio Express. That said, in cases where WID is used you can use the Tas…
2.3. Secure WSUS with the Secure Sockets Layer protocol
- Before you start the configuration process, be sure that you know the answers to the following q…
•Is the server's firewall configured to allow clients to access the server? - •Can this computer connect to the upstream server (such as the server that's designated to dow…
•Do you have the name of the proxy server and the user credentials for the proxy server, if you need them?
2.4. Configure WSUS computer groups
- This procedure assumes that you're using the WSUS Configuration Wizard, which appears the fir…
To configure WSUS - 1.On the left pane of Server Manager, select Dashboard > Tools > Windows Server Update Servic…
2.The WSUS Configuration Wizard opens. On the Before you Begin page, review the information, and then select Next.
2.5. Configure client computers to establish SSL connections with the WSUS server
- You should use the SSL protocol to help secure your WSUS network. WSUS can use SSL to auth…
Warning - Securing WSUS by using the SSL protocol is important for the security of your network. If your W…
Important
2.6. Configure client computers to receive updates from the WSUS server
- Computer groups are an important part of using WSUS effectively. Computer groups permit you …
You can create as many custom computer groups as you need to manage updates in your organization. As a best practice, create at least one computer group to test updates before you deploy them to other computers in your organization.
Requirements for Windows client servicing with WSUS
- Assuming that you've configured the WSUS server to help protect the client computers' connecti…
The WSUS server's SSL certificate must be imported into the client computers' Trusted Root CA store, or into the client computers' Automatic Update Service Trusted Root CA store if it exists. - Important
You must use the certificate store for the local computer. You can't use a user's certificate store.
WSUS scalability
- By default, your client computers receive updates from Windows Update. They must be configur…
Important
Configure automatic updates and update service location
- To be able to use WSUS to manage and deploy Windows feature updates, you must use a suppo…
•WSUS 10.0.14393 (role in Windows Server 2016) - •WSUS 10.0.17763 (role in Windows Server 2019)
•WSUS 6.2 and 6.3 (role in Windows Server 2012 and Windows Server 2012 R2)
Create computer groups in the WSUS Administration Console
- To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, …
Use the WSUS Administration Console to populate deployment rings
- When using WSUS to manage updates on Windows client devices, start by configuring the Confi…
To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment - 1.Open Group Policy Management Console (gpmc.msc).
2.Expand Forest\Domains\Your_Domain.
Use Group Policy to populate deployment rings
- You can use computer groups to target a subset of devices that have specific quality and featur…
To create computer groups in the WSUS Administration Console - 1.Open the WSUS Administration Console.
2.Go to Server_Name\Computers\All Computers, and then click Add Computer Group.
Automatically approve and deploy feature updates
- Adding computers to computer groups in the WSUS Administration Console is simple, but it coul…
In this example, you add computers to computer groups in two different ways: by manually assigning unassigned computers and by searching for multiple computers.
Manually approve and deploy feature updates
- The WSUS Administration Console provides a friendly interface from which you can manage Win…
To configure WSUS to allow client-side targeting from Group Policy - 1.Open the WSUS Administration Console, and go to Server_Name\Options, and then click Comp…
2.In the Computers dialog box, select Use Group Policy or registry settings on computers, and then click OK.
Steps to manage updates for Windows client
- For clients that should have their feature updates approved as soon as they’re available, you ca…
To configure an Automatic Approval rule for Windows client feature updates and approve them for the Ring 3 Broad IT deployment ring This example uses Windows 10, but the process is the same for Windows 11. - 1.In the WSUS Administration Console, go to Update Services\Server_Name\Options, and then s…
2.On the Update Rules tab, click New Rule.