Use WSUS without client configuration

Question

is there any way to let client-PCs use the local WSUS-server without having to configure them?

What we need is a system to update PCs before they are delivered to the users. So the WSUS-server is accessible only within our lab, not later on at the users place.

We'd like to use WSUS because it will fasten up the download very much. And we don't like to modify the clients as those changes might be forgotten to remove and then at the users place no update will be possible.

So the easiest way would be, if one could redirect the normal Microsoft update, but I'm pretty sure that this will not be possible as this update will not be WSUS compliant.

An other option I thought of might be, that the DHCP delivers an extra option telling the clients where to get the updates. But I could not find any information about this, so it looks like that this isn't possible too.

So, is there any way? Or will it be easier to use a little script to change the WSUS-entries automatically?

Regards sc911

Answer 1

If you do not have them on a domain, you could import the relevant settings via a registry file. So to directly answer your question, no you can't. Even in a domain environment you are still configuring them by group policy. Everything takes configuration, I think you are just looking for the simplest way. Running one batch/reg file per machine is going to take less time then setting them up manually.

Reference: Configure Automatic Updates in a Non–Active Directory Environment

Sample:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate]
"ElevateNonAdmins"=dword:00000001
"WUServer"="http://WSUSServer.OrIPAddress:8530"
"WUStatusServer"="http://WSUSServer.OrIPAddress:8530"
"TargetGroupEnabled"=dword:00000001
"TargetGroup"="Workstations"

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU]
; 'Install Updates and Shut Down' option will be available in the Shut Down Windows dialog box if updates are available
"NoAUShutdownOption"=dword:00000000
"NoAUAsDefaultShutdownOption"=dword:00000000
; False (Do not disable AutoUpdate)
"NoAutoUpdate"=dword:00000000
; 4 – Scheduled install (valid only if legal values are also specified for ScheduledInstallDay and ScheduledInstallTime).
"AUOptions"=dword:00000004
; Every day at 8 AM
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000008
"RescheduleWaitTimeEnabled"=dword:00000001
"RescheduleWaitTime"=dword:00000001
"AutoInstallMinorUpdates"=dword:00000001
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RebootRelaunchTimeout"=dword:0000000a
; Allow reboots with logged on users
"NoAutoRebootWithLoggedOnUsers"=dword:00000000
"UseWUServer"=dword:00000001

Answer 2

I use WSUS for the same purpose.

I setup WSUS to download updates. Grouped the computers into "Workstations" and "Servers" then I setup in the domains group policy where the client machines get their updates.

Seems like this is what you want to do.

If you ever need to change the update server or how the clients are getting their updates you just simply modify the GPO.

Here is the location: GPO Domain Policy Expand: Computer Configuration > Administrative Templates > Windows Update

You should configure all that apply, but the specific GPO you must set is: "Specify intranet Microsoft Update Service Location" Here is where you can specify your WSUS server.

Hope this helps.