Some Computers on My Domain Aren't Pulling Updates from the WSUS Server

Question

I am a computer tech for a local school district - and I'm really still just a college student myself, so maybe you guys could help me out.

Today we had very little bandwidth, so we called our ISP. They responded back with a list of IP addresses on our domain that had all been connection to Microsoft update.

Is there some way I can manage the way Windows fetches updates?

Also is there some way I can apply those Windows update settings to all the machines on the domain?

Thanks in advance for the help!

Answer 1

Yes and yes.

First I'd suggest blocking access to the Windows Update IPs at the firewall (except the WSUS box) and logging which clients are misconfigured (useful for finding out of compliance boxes after you've setup the GPO). Make sure you check the log periodically.

Next setup a GPO that's applied to every computer in the domain to configure them to use the WSUS server. Microsoft has a nice article on setting this up. If you have any issues getting this configured, feel free to ask a specific question.

Answer 2

Yes, you can configure computers on an Active Directory domain to pull updates from WSUS by using Group Policy.

Managing the WSUS Automatic Updates Client (technet.microsoft.com)

If you are preparing workstations using an imaging tool, and the workstation connected to WSUS at least once before having an image taken, be aware that this can confuse the WSUS server, and your clients won't appear in the WSUS console.

Resolving the duplicate SUSClientID issue (blogs.technet.com)

Answer 3

Use group policy.

It's pretty much the only answer.

Here's a technet article to help:
http://technet.microsoft.com/en-us/library/cc720539%28WS.10%29.aspx