2
votes

I use WSUS for a while and my folder's structure is not that good. I would like to know how to set it up to have the best usage.

For now, here how my setup is:

Computers

     Unassigned Computers

          Company Name

                 Site 1 (Subfolders: W2K - W7 - WXP)

                 Site 2 (Subfolders: W2K - W7 - WXP)

                 Site 3 (Subfolders: WXP)

                 Site 4 (Subfolders: W2K - W7 - WXP)

     Servers (Subfolders: W2K3 - W2K8)

I'm having hard times to spread the updates in a uniform way. I'd like to know how you guys setup your WSUS folder's structure for best performance and spare more times.

3 Answers 3

Reset to default
2
votes

We have 38 Remote locations all running the same OS version. I just have 1 folder for each store, 1 for testing, and 1 for my main office, and 1 for my servers. Seems to run fine like this. It makes it easy to spot network issues if 1 store starts falling behind on updates. To roll out new updates, I filter all updates by needed and not approved. I will usually approve them for my testing group to make sure nothing breaks. If they are OK, I will send them out to the rest of the world.

1
vote

At my sites, we use client-side targeting in AD group policies.

Because WSUS and WUAU know which updates go with which computers, there is no need to encode things like the OS into the group name.

And since we have WSUS servers at each location, and location information is already encode in the DNS/HOST names of each system, there's no need to encode location information into the group, either.

What is most important to us is the update behavior of the group.

So, in our WSUS the computers are grouped by the update behavior caused by the group policy that drives that groups WSUS behavior.

So our groups are:

Normal, Download-Only, Auto-Restart, Servers

Normal:

  • for workstations, both desktop and laptop.
  • Patches install daily, but no restarts or prompts while user is logged in.

Download-Only:

  • for developers, others who require knowledge and control of patch install timing
  • patches are downloaded, user is prompted to allow install and to restart

Auto-Restart:

  • for kiosks, multi-function-devices, digital signage drivers-- anything unattended and ignored that does auto-logon.
  • patches download, install, and restart as needed (for kiosks, MFDs, digital displays)

Servers:

  • Exactly like Download-Only, but Servers get their own OU in AD

It works for us.

0
votes

I' ll tell about our WSUS env.

We have 4 sites country-wide connected via 0,5 - 3 MBits vpn and about 200 client computers and 20 servers in all sites. Windows XP and Windows 2003 only.

We have only two groups at WSUS - Workstations and Servers. Workstations have auto-install policy, servers - only auto-download.

We have no problems with WSUS.

Not the answer you're looking for? Browse other questions tagged or ask your own question.