1

I want to set up WSUS on our network to manage updates. My intention is to update one ‘pilot’ client machine each week, let it run for a week and then deploy to all clients if that goes ok.

The problem is how to manage updates to the server itself. We only have one server (it’s a small charity and money is an issue) so a pilot installation is not practical. Any thoughts?

Thanks

Patrick

6 Spice ups
2

WSUS will only control what updates can be installed it won’t push / control the install of the updates. Which sounds like what your after?

1 Spice up
3

Thanks for the info about WSUS. That relates to how client machine updates are handled.

The real question for me is how best to handle updates to the server itself. Automatic download and install is one option but that’s risky. I was interested to hear about what strategies other are using for their server updates.

4

Install MSSQL Server Express (that way you can backup the database on a regular basis automatically) from there install WSUS. Have that syncronize with Windows Update 1x/day (or whatever may be necessary).

from there all you need to do is setup a GPO to have all computers point to WSUS server

5

Depends on what you class as “risky”, I have this setup on some of my servers for Saturday at 1am which means they reboot do all there bits etc and are back up early sat, if something broke i have 2 days to resolve.

On others we manually install the updates and test every monday morning at 7am.

Most of the time windows updates are fine, you will find that one time they break something but unless you install them manually and test everything everytime on a cloned server you won’t prevent it. In the case of 1 small server auto updates are probably fine :slight_smile:

4 Spice ups
6

I use WSUS to split my computers and servers into groups.

When I see updates available, I approve them for the test server and test desktop groups. If those devices show no issues for the rest of the week, I then approve the updates for the live server and live desktop groups over the weekend

+added+

In your case where you only have one server, you could create a virtual test server and apply the updates to that.

I also take a snapshot of the test server beforehand, just in case.

5 Spice ups
7

Run almost exactly the same way & in two years we haven’t had a single patch/update related problem.

2 Spice ups
8

For servers, I approve updates, but manually install them. ie when logging on, the servers task bar shows updates to be installed/downloaded.

For user PC, updates are automatically downloaded and installed. I find in normal practice, it takes at least 3 days before updates are installed.

Day 1) Updates are approved

Day 2) On start up, computers talk back to WSUS and acknowledge approved updates. Computers may install updates at 4pm, and then finish installing.

Day 3) On startup, final settings are completed.

Computers may install updates at 4pm, and then finish installing - this is the bit that sometimes doesn’t happen when expected, and can take a few more days, there is no user interaction with this.

9

What is your workflow for doing this in WSUS? Is it something like this:

  1. Approve the updates for the test groups only from “All Updates, Unapproved”

  2. Create a new Update Group with “Updates are approved for a specific group,” selecting your test groups

  3. Later approve the updates approved for the specific group for all computers

Just wondering what the best process is to make sure you don’t miss approving any updates for all machines after you’ve approved them for any group and they disappear from “All Updates.”

10

  1. Select All Updates. Approval: Unapproved, Status: Failed or Needed. Approve for test groups

  2. Wait a few days.

  3. Select All Updates. Approval: Any Except Declined, Status: Needed. Approve for live groups

1 Spice up
11

I use WSUS to update all the desktops. I update the servers manually.

12

Many thanks for all your help.

Sadly, Server 2008R2 does not support restore points, so in what seems to be the unlikely event of a problem with an update, I’ll have to go back and manually uninstall. Rather than allowing daily installs, I think I’ll go for weekly, based on the assumption that the lower the frequency of changes, the easier it will be to pin problems down.

As for WSUS updates, I like the idea of having 1 test PC in a separate group & rolling out the changes to the others after a week.

Thanks again!

Pat