Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use WSUS for a while and my folder's structure is not that good. I would like to know how to set it up to have the best usage.

For now, here how my setup is:


     Unassigned Computers

          Company Name

                 Site 1 (Subfolders: W2K - W7 - WXP)

                 Site 2 (Subfolders: W2K - W7 - WXP)

                 Site 3 (Subfolders: WXP)

                 Site 4 (Subfolders: W2K - W7 - WXP)

     Servers (Subfolders: W2K3 - W2K8)  

I'm having hard times to spread the updates in a uniform way. I'd like to know how you guys setup your WSUS folder's structure for best performance and spare more times.


locked by HopelessN00b Jan 21 '15 at 17:43

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as primarily opinion-based by HopelessN00b Jan 21 '15 at 17:43

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

We have 38 Remote locations all running the same OS version. I just have 1 folder for each store, 1 for testing, and 1 for my main office, and 1 for my servers. Seems to run fine like this. It makes it easy to spot network issues if 1 store starts falling behind on updates. To roll out new updates, I filter all updates by needed and not approved. I will usually approve them for my testing group to make sure nothing breaks. If they are OK, I will send them out to the rest of the world.


At my sites, we use client-side targeting in AD group policies.

Because WSUS and WUAU know which updates go with which computers, there is no need to encode things like the OS into the group name.

And since we have WSUS servers at each location, and location information is already encode in the DNS/HOST names of each system, there's no need to encode location information into the group, either.

What is most important to us is the update behavior of the group.

So, in our WSUS the computers are grouped by the update behavior caused by the group policy that drives that groups WSUS behavior.

So our groups are:

Normal, Download-Only, Auto-Restart, Servers


  • for workstations, both desktop and laptop.
  • Patches install daily, but no restarts or prompts while user is logged in.


  • for developers, others who require knowledge and control of patch install timing
  • patches are downloaded, user is prompted to allow install and to restart


  • for kiosks, multi-function-devices, digital signage drivers-- anything unattended and ignored that does auto-logon.
  • patches download, install, and restart as needed (for kiosks, MFDs, digital displays)


  • Exactly like Download-Only, but Servers get their own OU in AD

It works for us.


I' ll tell about our WSUS env.

We have 4 sites country-wide connected via 0,5 - 3 MBits vpn and about 200 client computers and 20 servers in all sites. Windows XP and Windows 2003 only.

We have only two groups at WSUS - Workstations and Servers. Workstations have auto-install policy, servers - only auto-download.

We have no problems with WSUS.


Not the answer you're looking for? Browse other questions tagged or ask your own question.