Transition to client side targeting for loose group membership

Question

I need to be able to add multiple overlapping groups without the need of defining a separate GPO for each combination. This rules out the standard "Enable Client Side Targeting" and the basic GPP registry setting as they both overwrite the previous entries in the TargetGroup key.

To this end I came up with the following idea.

Use group policy preferences to define a custom branch of the registry into which a set keys and values are written by GPP. The key name is the group desired, the data is a flag to make it active.

I then have a small executable on each workstation which (on boot, service restart, etc) reads these keys and (if an appropriate value is found) concatenates these into the TargetGroup key.

I could very much use a sanity check; is there any reason this would not work?

Answer 1

This approach works, we also implemented this in WuInstall (http://www.wuinstall.com), maybe this helps you to script client side targeting without havint to write your own executable:

Try WuInstall /install (or whatever) /targetgroup "Your WSUS Target Group"

With the /targetgroup switch, you can specify the group you want to have in the TargetGroup key … WuInstall changes the registry during execution, and then back to the old values.

Of course, Client site targeting needs to be enabled at the WSUS in order for that to work.

Answer 2

I have successfully built and tested a GPO and executable to make this behavior possible.

I rewrote a freely available service that makes this possible as well. Check out the trbdk3-CST project page on SF if interested.