At my sites, we use client-side targeting in AD group policies.
Because WSUS and WUAU know which updates go with which computers, there is no need to encode things like the OS into the group name.
And since we have WSUS servers at each location, and location information is already encode in the DNS/HOST names of each system, there's no need to encode location information into the group, either.
What is most important to us is the update behavior of the group.
So, in our WSUS the computers are grouped by the update behavior caused by the group policy that drives that groups WSUS behavior.
So our groups are:
Normal, Download-Only, Auto-Restart, Servers
- for workstations, both desktop and laptop.
- Patches install daily, but no restarts or prompts while user is
- for developers, others who require
knowledge and control of patch
- patches are downloaded, user is prompted to allow install and to
- for kiosks, multi-function-devices,
digital signage drivers-- anything
unattended and ignored that does
- patches download, install, and restart as needed (for kiosks,
MFDs, digital displays)
- Exactly like Download-Only, but
Servers get their own OU in AD
It works for us.