Setup a Windows Server Update Service (WSUS server) Guide

So you want to setup a centralised update server so your network isn’t being flooded with windows updates? well I have just the Guide for you.

Firstly you need the following before we can begin:

• A server (in this case a Windows 2003 server would be fine)
• Microsoft Internet Information Services (IIS) 6.0 or later
• Windows Installer 3.1 or Later Download Here
• Microsoft .Net framework 2.0 Download Here (note having version 3, 3.5 or whatever doesn’t count you need 2.9)
• Microsoft Report Viewer Redistributable 2005 Download Here
• Microsoft Management Console 3.0 Download Here
• SQL Server 2005 SP1 or Later (or express which is free) Download Here

 Step 1)

Install all the Perquisites above, and then download WSUS from http://connect.microsoft.com/directory/

Note: you will need a Windows live account

Once its downloaded run the setup and select the following when prompted:

• Full Server Installation Including Administration Console
• Store updates Locally (unless you want them on another file store in which case select the other option)
• Use an existing database server on this computer (default) 
• Create a Microsoft Server Updates Service Website with port 8530 
• leave the "the server should inherit settings from the following server" blank unless you already have another server you want to mirror and cluster your WSUS server with (which I doubt you will)
• continue to follow the prompts

Step 2)

Once the install is complete you will be prompted to configure the WSUS server, use the following:

• No proxy server
• Start connecting
• Synchronize automatically at 12:45pm (lunch time) twice per day
• Select Launch the WSUS administration console and Begin initial Synchronisation
• Wait for the Initial synchronisation this takes roughly 30-50 minutes

once done, load the ISS manager, select Websites > WSUS administration. Right click and select permissions, add ANONYMOUS LOGON.

Step 3)

• Load the WSUS Management Console, select Options then click Change update File and Language, select “Download update files to the server when updates are approved”, ensure on the language tab, its set to English.
•  Load the WSUS Management Console, select Options then click Change update File and Language, select “Download update files to the server when updates are approved”, ensure on the language tab, its set to English.
   
• On the main console create the relevant Groups e.g. Desktops, Servers, Test and No update,

 

Selection options and Automatic Approvals, make a new rule for servers , specify the following criteria:

• When an update is in Critical, Security, Updates,
• When update is in SQL server, IIS, etc. for all known Microsoft products
• Approve this update for Servers

Do the same for desktops except changing for products like office, Silverlight, etc.

Machines will slowly appear under all computers, move them into their relevant groups.

Step 4)  

Group Policy (GPO)

Logon onto your Domain Controller and load the Group Policy Management Console, Right click on the Group Policy Object Container and select Create a new Policy for each of the groups you created earlier.

after that edit the settings of each policy to what you deem appropriate for your setup, in my case :

Automatic updates are at lunchtime, they automatically download and install but they won’t restart the machine without user approval

the intranet location should be http://yourwsusservername:8530

Enable client Side Targeting for the appropriate Group name (that’s important!!)

Enable no auto restart with logged on users.

repeat this for each policy ( again e.g. servers, desktops, tests etc.) different groups might have different policies, e.g. you might want your desktops just to restart whenever (I doubt it but hey) but you would never want your servers to do that!

now the last bit

On the GPO management console, right click the Organisational Unit that contains the workstations group, and link an existing GPO, select the desktop policy, repeat this step for servers.

Note: there can issues with the WSUS policy being linked to a Child OU, it is recommended to apply it only to the TOP level OU.

Any issues or feedback leave me a post 
Jobs a Good un!
Dan