Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an isolated enviornment of a few hundred servers in which we use WSUS to push updates too. We have thousands of updates which to manage and push to devices testing along the way to ensure the update will not break anything. What are the best practices that you all follow in your enteprise networks to ensure an update does not go out to all the machines that will break something? We currently have ours broken into customized groups for each type of machine. There is one "Test Group" which has one PC of each type which we apply updates to for error checking. Is this a similar procedure others follow or is their an easier safer way to manage the thousands of WSUS updates?

share|improve this question
up vote 5 down vote accepted

In environments where you have a discrete set of configurations to manage (i.e. not a bunch of end-user desktops) you're already following the accepted best-practice.

  1. Create a canary group to get updates early.
  2. Run each configuration through acceptance trials after updates are applied.
  3. Promote updates to the general population once they've passed acceptance trials.

For really large populations, there is an additional tier between the first group and the everyone group, which is there to discover update problems that only show up occasionally. Whether or not your setup is big enough for that is up to you to decide.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.