Tag Info

Hot answers tagged

16

Does the server have to run Windows 2003 Server, or will Windows XP Professional work? Yes, Windows Server is required. Where do I download the WSUS packages from? Microsoft's website: WSUS 3.0 How can I configure my computers to look for updates from my server instead of the internet? There's a deployment guide & a step-by-step guide that explains ...


9

WSUS supports updates for Forefront antivirus from Microsoft for antivirus updates. As far as I know it does not support the downloading of 3rd party AV updates. You obviously need WSUS setup on one of your servers. If you use Active Directory you can use Group Policies to apply the settings to your workstations. If you do not have AD then you will have ...


9

I would just like to get on my auto-reboot soapbox for a second: it's been my experience that automatically/forcing a reboot is generally a bad idea. We system admins often have somewhat of a complex about making sure the latest patch has been applied the second it's installed because OMG until then the system is unpatched. However, you must realize that ...


8

We auto install then delay the restart for the install for 30 mins - prompts the user to reboot now and if there is no response in 30 mins then it reboots the machine. There was some initial grumbling but that have gotten used to it. If they are in the middle of something they can click "reboot later" to delay the reboot until a good time. But they will be ...


7

If it is set using a Group Policy, you probably cannot override the setting (that's the whole point of Group Policies), but you should be able to visit the Windows Update website and still download updates yourself, you just won't get the prompts and reminders of new updates. You really should open a ticket with your Corporate IT department and work with ...


7

It is possible to get non domain clients to pull their updates from a WSUS server, however this involves some registry hacks on the client machine. As they are not on your domain, you can't use group policy to do this remotely. This will also cause problems with the students machines when they are used off the network, at home over the break for example. ...


7

I think the most workable and least intrusive solution is to change the Configure automatic updating setting to 3 - Auto download and notify for install. That will not interrupt the user, and the option to Install updates and Shut Down will be automatically selected on the shutdown menu. Periodically run a report of computers needing updates and wave a big ...


7

If you really do not have control over containers and GPO settings, then you're out of luck. The system is designed to prevent local admins from changing that kind of thing. I have users in the exact situation you are, so we've had to create processes to allow exceptions to the everyone-must-apply-updates-at-$DateTime rules. We have a group of OU's for ...


7

You can in WSUS 3, your replica server needs to be configured to store updates locally. An option will be available to store updates locally, download files from Microsoft Update, but do not download from the upstream server. Mentioned here screenshot below:


7

I assume you're deploying settings using Group Policy? If so, I believe this page contains the information you're after: http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx Specifically, the setting: Remove Links and Access to Windows Update If this setting is enabled, Automatic Updates receives updates from the WSUS server. Users who ...


7

Take a look here: http://support.google.com/installer/bin/answer.py?hl=en&answer=146164 That gives you information on configuring GPOs to disable the built-in auto-updating feature of Chrome, etc. Then take a look here: http://www.google.com/apps/intl/en/business/chromebrowser.html That is the "Chrome for Business" page. There is a link on that page ...


7

The updates are stored in a cache in C:\Windows\SoftwareDistribution. By deleting the contents of the cache I was able to remove that update. First Windows Update service needed to be stopped. I wrote a batch file to stop the service delete the cache on all servers. The process works as follows. Create .txt file with all the server name individually on ...


7

One can "simply" connect to the WSUS database and run queries against it: Start SQL Management Studio with elevated privileges. Connect to \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query using Windows Authentication. These tables seem to be of interest regarding your question: tbUpdate Holds information about single updates tbTargetGroup Holds information ...


7

This powershell script does exactly what your initial request was. Examine one computerGroup and find updates not approved for one or multiple other computer groups. Note You will need to run this either on a WSUS server or a machine that has the WSUS Admin tools installed. Configuration Set $targetComputerGroup to the Computer Group you want to use as a ...


7

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer


6

The Configure a Disconnected Network to Receive Updates chapter in the WSUS documentation describes the officialy supported way to use WSUS in a disconnected environment. You need to have a second WSUS installation which can download updates from Microsoft servers. First you need to synchronize the metadata on the connected WSUS server; then you must make ...


6

Yes, it's entirely possible, you just need to modify the registry entries outlined in this technet article


6

That update was superseded by KB2656351. Superseded updates are marked as "Not Applicable" if they were not installed before the superseding update was introduced into the environment, since that update contains this fix in addition to new ones.. When looking at the update itself, the WSUS console should tell you that it is superseded and what the ...


6

No offense meant, I know you were simply trying to answer your own question and post for the SF community, but I would say you are doing it wrong. You should setup your Receive connector as a proper relay, with the permissions tab set to Exchange Server not Anonymous and your Authentication Tab set to Externally Secured. Then lock the Receiver down to only ...


6

Yes, temporarily disabling Update Rollups is the way to do it. You won't really be missing out on anything - it will still download the update rollups metadata, it just won't automatically approve them. Once the IE9 metadata has downloaded to your WSUS server, you can switch the auto-approval of update rollups back on if you so desire (personally the only ...


6

AFAIK the only option is to set a specific time. That being said, I think you're not fully aware of the implications of having ALL the servers doing automated installs/reboots. What if there is a faulty patch wich breaks the kernel or similar.. do you really want to come to work in the morning and finding all your servers in a boot loop? I suggest you ...


6

Server-side targeting - Easy for small numbers of clients, doesn't require that clients can process group policy (i.e. aren't domain members, typically). Administratively burdensome for large numbers of clients or for clients that change roles and need to have their client group membership dynamically updated. For non-domain-joined clients this is the ...


6

I don't think it's a specific number of computers issue, it's an automation and security issue. WSUS gives you a much more fine grained control over what updates are deployed, when they are deployed, and to whom they are deployed. It also allows you to essentially force your users to install the updates (by setting deadlines). If these kinds of things are ...


6

Or you might put an WSUS Server on the internet (And "authorize" it) and solve the problem of the everchanging ip-adress. The Internet (tm) \------------------------/ | | | ...


6

The German mag c't once wrote a script called WSUSOffline to apply WSUS updates without internet connection. I never used those but you can find it here http://www.wsusoffline.net/


6

Yes just configure the machine to receive updates from your WSUS, and it should do that right away (or you can provoke it by running wuauctl /detectnow). There should be no dependency on having a domain except for pushing the configuration with group policy.


6

Non-Microsoft packages would be fantastic if enough people supported it. All the other standard desktop applications that self update at different times (particularly Adobe Acrobat) are becoming an increasing blight on the desktop environment, causing much user confusion and system instability. If the vendors could get together and agree a single update ...


6

i'm using the script already mentioned by Oskar with psexec to patch a bunch of servers. if a server has a borked WU Agent i use this script: net stop bits net stop wuauserv reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /f rd /s /q %WINDIR%\SoftwareDistribution gpupdate /force wuauclt /resetauthorization /detectnow


6

The Windows Update client can be configured to perform installations at odd hours. Combined with a solution to do Wake-on-LAN you can get update deployment to occur outside of normal hours fairly easily. (We use some scripts to do this, but there are probably off-the-shelf solutions, too.) WSUS has been exceedingly reliable for me. I'm particularly fond of ...


5

Shavlik's NetChk Protect could be a good option for you. The company has a close relationship with Microsoft and its underlying technology powers Microsofts own Baseline Security Analyzer product. Whilst Microsoft's MBSA only supports patching Microsoft products NetChk Protect support products from many other vendors.



Only top voted, non community-wiki answers of a minimum length are eligible