Managing Windows Updates Across Your Network with WSUS

When every company computer downloads updates from the internet whenever it likes, several problems follow. Internet bandwidth gets eaten up during business hours, nobody knows exactly which machines have the latest security patches, and a faulty update can land on every system at the same time.

WSUS (Windows Server Update Services) is a Windows Server role that downloads updates from Microsoft once. You then decide which update gets installed, when, and on which group of computers.

Microsoft has placed WSUS on its list of deprecated features. No new capabilities will be added, but it is still supported for now and updates are still delivered through it. For long-term planning, keep an eye on its status and on Microsoft’s recommended alternatives.

Initial Setup

1. Install the WSUS role on a domain member server, ideally one that does not hold a critical role such as domain controller.
2. Store the update files on a separate disk with enough free space, not on the operating system drive.
3. For the database, Windows Internal Database is enough for most small and mid-sized businesses.
4. In the configuration wizard, select only the products you actually run on your network, such as the Windows and Office versions in use.
5. Under Classifications, select Security Updates and Critical Updates, plus Updates if needed. Leave Drivers out unless you have a real need for them.

Selecting every product and every classification is the most common mistake. The WSUS disk and database fill up quickly and the console becomes sluggish.

Grouping Computers

Place computers in separate groups so updates are rolled out in stages:

• Test: a few computers from different departments plus one non-critical server
• Workstations: user computers
• Servers: servers, with their own install and restart schedule

The best way to assign groups is Client-side Targeting. In the WSUS settings, enable the option to use Group Policy for group assignment, then enter the target group name in the GPO linked to each OU.

Configuring Clients with Group Policy

The following settings are found under Windows Update in Administrative Templates. Their exact names and locations vary slightly depending on the Windows version:

• Specify intranet Microsoft update service location: the server address, for example http://wsus01:8530
• Enable client-side targeting: the group name, for example Workstations
• Configure Automatic Updates: how and when updates are downloaded and installed
• Install deadline and restart settings, so users cannot postpone updates forever

The Monthly Update Cycle

1. When the monthly updates are released, approve them for the Test group.
2. Monitor the computers and the company’s key applications for a few days.
3. If no problems appear, approve them for Workstations and then for Servers.
4. Use WSUS reports to find computers with installation errors or that have not reported in for a while, and fix them.

The Maintenance Everyone Forgets

Without maintenance, WSUS gradually becomes slow and unstable. Decline superseded updates, run the Server Cleanup Wizard regularly, and monitor disk space. Part of this work can be scheduled in PowerShell with a command such as Invoke-WsusServerCleanup -CleanupObsoleteUpdates -DeclineSupersededUpdates.

Checklist

• Only the necessary products and classifications are selected.
• WSUS files are stored on a separate disk with enough space.
• Test, Workstations and Servers groups are defined.
• Clients are pointed to WSUS and to the correct group through Group Policy.
• Each month, updates are tested on the Test group first.
• Cleanup runs regularly and lagging computers are followed up.

If you want to see the security patch status of every computer in one place, ITPlus724 engineers can set up or clean up WSUS and design a monthly update cycle for your company.