I have set up WSUS on a Windows Server 2008 box and I have it working with just my machine reporting to it. Now that I'm ready to make this large scale across the company, I'm trying to figure out what is the best way to actually add and group the client computers. It's set up to use Group Policy to add clients. I created a new group policy object strictly to define the WSUS settings.

My question is, can you apply this to computers based on the User AD object or does it have to be by the Computer AD object? The reason I ask is because in AD we have our 100'ish users grouped by department, however all the computers are just unorganized in Domain\Computers. The task I'm facing is that we don't want all of our computers connected to WSUS (like the programmers, for instance). So in this case can I just use the groups that we've already made that consists of "User" members, or do I need to make a new group for each department and add their respective computers to the group? (i.e. a "Finance-Users" group and a "Finance-Computers" group).


You will need to organize your computers. There's no way to get a user's identity to dictate the WSUS policy; what happens when someone else logs in? Or when nobody's logged in?

Loopback processing allows for computer-linked GPOs to apply to the user, but it doesn't work the other way around.

Set up a domain-wide policy to lock all computers to the WSUS server. Use client-side targeting, and have the global policy target the computers into a group that will not be getting patches regularly approved.

Then, have more specific policies client-side-target into groups that you'll be regularly approving patches for. The programmers may not want you updating their software, but that doesn't mean you shouldn't get them in the inventory to see how far behind they are. The "see no evil" approach is ill-advised.

  • Thank you for the suggestions. That all sounds good. One slightly off topic question: What makes the client update its status with WSUS server? I've pulled all the updates I can with my computer, yet the management console for WSUS says I still need updates. – Safado Apr 13 '11 at 19:37
  • 1
    @Ryan M. The devices check in with the server on a schedule; by default, once every 22 hours (minus 0-20% at random so not everything hits at the same time). There's a group policy setting to control the interval: under Administrative Templates -> Windows Update, "Automatic Updates detection frequency" – Shane Madden Apr 13 '11 at 21:59

You should have your computers organized into OUs in AD for this very reason. I'd start taking a physical inventory, and mapping it like that into AD. Then apply the GPO (it's computer based, not user based) to those OUs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.