Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are considering implamenting WSUS at work. The biggest question is using groups. If a machine is made a member of two different groups, and one group is approved for an update and one is not, will that machine be approved for that update? Most products from microsoft use the philosophy of 'most restrictive', but I can find no evidence of this in WSUS.

share|improve this question

WSUS computer groups are not the same as AD groups. In WSUS a computer can only belong to one group at a time. So Group:Computer is 1:M (one-to-many)

This differs from AD where Group:Computer is M:M (Many-to-Many). You can put many computers into a group, and any computer can belong to many groups at any one time.


  • WSUS groups are, despite the above, in a heirachy. If you approve an update 'up the tree' it will usually inherit to the child groups and end up being approved for all computers underneath. However, this can be controlled in WSUS on a per-update basis, if you wish.

  • It's possible to configure a system such that : AD group membership results in WSUS Group Policy application which then results in a computer being placed into a particular target group. Only 1 WSUS target group will end up being applied and this is determined by the usual group policy inheritance order.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.