We're introducing WSUS inside our network in one bigger location but our company have mutliple small offices. Our people move a lot so I would like them to use WSUS when inside main location and in other places where WSUS will be available and Windows Updates from Microsoft directly when they are roaming in our small satellite sites.

I found out that if I would like clients to use WSUS based on location they are in you have to use more or less following steps:

  1. Enable Round Robin and Netmask Ordering in the properties of your DNS server.
  2. Choose a DNS name for WSUS. For instance, wsus.example.com
  3. Create an A record in DNS for each WSUS server. Call them all wsus.example.com or whatever you have chosen as the DNS name. Give each new A record an IP address of each WSUS server.
  4. Use the DNS name you have created, wsus.example.com or equivalent, to configure group policy or otherwise distribute the WSUS server setting to the clients.
  5. Clients will now use the round robin in DNS to resolve the nearest WSUS server.

Could I use this methodology and add a new DNS record (wsus.example.com) in our small offices where WSUS is not available and point it to http://windowsupdate.microsoft.com? Will clients wanting WSUS server recognize it as Remote WSUS and get updates from Microsoft thinking it's their WSUS server? Or will it simple fail? (hope that's not too confusing).

Is there any other solution I could use for this?

Edit. We came up with another idea. If we point updates.microsoft.com in our DNS to WSUS will clients use WSUS when being locally or clients will not treat wsus as Windows Updates from Microsoft? This would actually be nice solution if it works..

  • 1
    can't you set up GPO based on the location ? – Steve B Jan 19 '12 at 10:58
  • Is there a way other then having GPO per OU ? – MadBoy Jan 19 '12 at 11:04
  • 1
    Certainly; in his case, using Sites and Services would be most suited. – adaptr Jan 20 '12 at 11:32

Why such convoluted circumventions ?

Just create a group policy that sets a WSUS server and apply it only to the computers in the subnet/site that you want to use WSUS for.

| improve this answer | |
  • We have OU's called by cities lets say Katowice, Warsaw. What if user from Katowice visits Warsaw where there's no WSUS around (but VPN tunnel works). It will download everything thru VPN link won't it? I don't think there's a way to apply GPO to only subnet, and different gpo for If there is I will gladly get to know about it? – MadBoy Jan 19 '12 at 11:38
  • Hrrms. I've just read that I could assign GPO using Sites and Services which would be the good way to go. Say if I specify subnets in Sites and Services and apply GPO there will it work so that when users move around between locations it will take users IP and use correct WSUS server or WU? – MadBoy Jan 19 '12 at 11:43
  • Take care that this GPO needs to apply to the computer! – adaptr Jan 20 '12 at 11:32
  • Thanks. I asked another question based on this one serverfault.com/questions/351829/… – MadBoy Jan 20 '12 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.