Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two WSUS v3 servers, our company has a single domain AD that spans two sites, and each site has one WSUS server. The stub site's WSUS server is configured as a replica. Settings, groups, updates etc. all appear to propagate fine from the primary server to the replica. - For ease, I'll call the servers wsus-primary and wsus-replica.

I've used GPOs to configure all the settings, including client group targeting.

Groups have been configured on wsus-primary, and have replicated to wsus-replica.

On the wsus-primary console, all appears well with clients that connect directly to it, however all the clients from the remote site (that normally talk to wsus-replica) appear in the group 'Unassigned Computers', despite the group policy results wizard showing they are picking up the policy that sets the correct group name.

On wsus-replica, I can only see the clients from the remote office, and they also appear as 'Unassigned Computers'.

Clients at the stub office are configured to communicate with 'http://wsus-replica:80', clients at the main office are configured to communicate with 'http://wsus-primary:80' (both for detecting updates and statistics).

What am I doing wrong? How can I get the clients that talk to wsus-replica to appear in the correct groups? Any clues as to what I'm doing wrong, or where to start troubleshooting?

I've ran wuauclt.exe /detectnow more times than I care to mention, but they just don't want to budge into the correct group.

The WindowsUpdate.log file doesn't give any clues, but does show it is communicating fine with the server.

Other info:

  • wsus-primary is Win 2008 R2 - was previously Win 2003 R2, and showed the same problem then
  • wsus-replica is Win 2003 R2
  • clients are a mix of Win XP / Win 7 (mostly Win XP)
  • wsus-replica has about 1Gb of files to download from wsus-primary - this wouldn't stop the groups updating, would it?
share|improve this question
up vote 2 down vote accepted

Check target options at the WSUS-replica server: wsus console - replica server - options - computers.

There is must be "Use GPO or registry", if you want to use group policy for targetting

share|improve this answer
Thank you. Spot on. – Bryan Mar 4 '10 at 9:51

good answer! Worked for me.

  1. Ensure you can ping down upstream servers
  2. Double check all your settings within the Options within WSUS
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.