up vote 2 down vote favorite
share [g+] share [fb]

Can anyone suggest a tool/method to simulate various scenarios when using WSUS? Or am I asking the impossible? I'm curious to know if I deploy X number of patches over slow links is there any way of determining when all of the machines on the other end of the wire will be updated?

link|improve this question
71% accept rate
feedback

4 Answers

up vote 2 down vote

Virtual machines in a test environment that allows you to implement rate-limiting (to simulate various link speeds) is the best solution. But, as Andrew noted, there are considerable costs associated with this.

Another approach might be to simply break out your pencil and perform some back-of-the-napkin calculations. What's the link speed, how large is the set of patches, can they be multicast, how many machines on the remote end, and so on. Once you've considered these variables you might decide that it's simpler to deliver a single set of patches to a second WSUS server on the far end and move on with life.

Not knowing anything about how your network is engineered makes this a difficult question to answer concisely.

link|improve this answer
1  
Thank you, I suspect a "napkin" design plan will be where I go. The number of clients out on the other end are few enough (90, 40, and 60 at three remote sites) for me not to have too much concern. I'm just looking to validate what I know from experience in similar environments. – Mitch Jun 13 '09 at 18:43
You should add that info to your original post. Deploying a WSUS server at each site with 30 or more systems should be a standard policy. Anytime your site becomes large enough that the SA staff cannot patch all systems in a day, you should be using a patch management server. – Joseph Kern Jun 13 '09 at 19:14
"Deploying a WSUS server at each site with 30 or more systems should be a standard policy" based on what? Is there a "suggested/recommended" clients per WSUS? – Mitch Jun 13 '09 at 19:24
That's my own thought. I don't remember seeing a standard number of clients per WSUS ... his main concern is bandwidth, and the time needed to transfer patches over slow links ... – Joseph Kern Jun 13 '09 at 19:40
A more concise way of putting what I was thinking :) – Andrew H Jun 14 '09 at 14:31
feedback
up vote 0 down vote

If you're concerned about bandwidth and remote WSUS servers isn't an option, then you can also tune your BITS settings in a GPO for those sites; the clients may get the patches slower but better than not at all.

link|improve this answer
feedback
up vote -1 down vote

You know what the obvious answer to this is - virtual machines.

However I think your question is a bit more complicated than that, right?

Can you define what is a slow link? Are we talking dial-up?

Do you have a bunch of mobile users, and you want to know when they would all be updated? But you don't know when they will connect and over what speed links?

Apart from doing a dry run, which is very costly in time, there isn't an easy way to model this. Perhaps it would be better for management to insist that these machines connect for a certain period within which patches can be deployed?

link|improve this answer
Thanks, yes, virtual would be my first thought but I'm certain this will work (I've installed WSUS in production environments before) but would like simulate the deployment to three sites on the end of 10 mb/sec connections. I'm confident it will work but would like be able to present some sort of testing evidence to show it will work and on what time frame. This is more to satisfy the doubters and a few who don't trust BITS. – Mitch Jun 13 '09 at 18:40
Mitch, how about getting an individual or failing that, a VM set up on each site and do a controlled experiment? You can then take that data to your management as evidence. Other than that, I should have mentioned just modelling the problem in a rough way - hopefully they will go for it. I mean, either the people at the other end need the updates or not, right? That's a management issue. – Andrew H Jun 14 '09 at 14:33
feedback
up vote -2 down vote

Why have Virtual Machines become the knee-jerk reaction to administration problems?

VMs are not magic pixie dust to sprinkle over your problems.

You should figure out how long it takes to download a certain sized file over the link. Nice round numbers are convenient, let's make it 1GB.

  1. Time how long the upload/download takes (N)
  2. Time how long 2 upload/downloads take (N+1)

Make a guess.

In this case your deployment of WSUS is interesting, usually WSUS is deployed on the local end of a slow link. There are really only two reasons to deploy WSUS: management and bandwidth. Putting WSUS on the distant end of a link is really no different (bandwidth wise) from downloading all your patches from Microsoft. Every client has to access the same slow link.

Have you considered deploying another WSUS server at the local end of your link?

If this is a branch office, and you do not want/cannot deploy a WSUS server. Consider doing patches starting Friday evening and letting them roll throughout the weekend.

link|improve this answer
The "plan" calls for WSUS servers at each of six locations. I think that's overkill for the number clients supported. My thought is one WSUS for the lot, I'm certain the local sites will update with no issue. I just don't see that deploying a WSUS server for the small number of users, the satellite sites, is efficient. – Mitch Jun 13 '09 at 19:22
2  
I only read three sites in his comment. Is it too much to ask that each office has a domain controller and a WSUS? You can centralize email and some file servers, but logins and patch management should always be available. Have you had good results with a single WSUS, over slow links? – Joseph Kern Jun 13 '09 at 19:45
Because virtual machines are great simulation tools, they are cheap (no need to get ESX crazy to run a simulation there are plenty of free VMs to do the job), and easy to use. so usually when somebody talk about simulating something Virtual Machines come in at the top of the list. – GNUix Jun 13 '09 at 23:57
Well, it's hard to find a 'free VM' with XP or Vista installed. Every installation is an activation. I just assume, in all my answers, OP doesn't have VLKs. – Joseph Kern Jun 14 '09 at 0:30
"VMs are not magic pixie dust to sprinkle over your problems." Nice invective. I didn't answer the question naively, this seemed like an appropriate response to this problem. The OP mentioned "simulate", now unless we get into some truly interesting programming to simlulate some windows machines and patchy networks, why not use the standard solution, a virtual one? – Andrew H Jun 14 '09 at 14:37
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.