4

Background: I have a really slow internet connection (the highest download speed I've seen on it is 3.5Mbps, though I only pay for 3Mbps), and Windows 10 does updates all the freaking time. Like, so much. This obviously bogs down my connection regularly. I also have ~7 machines on my LAN that are updating on this basis. All-in-all, I'd say about 50% of my internet traffic is Windows Updates.

This brings me to my question: is it possible to setup a local server (I already have two local Hyper-V host servers) that can download and serve all these updates to my LAN PC's, so that the LAN PC's can use it, and it can download all these updates once instead of each LAN PC downloading it's own set of updates?

Both of these Hyper-V servers are Windows Server 2012 R2, though I can upgrade them easily if necessary.

Also, I'm willing to serve updates for any Windows OS on the local LAN, though obviously Windows 10 is the highest priority, but I have devices with all of the following versions:

  • Windows 10
  • Windows 8.1
  • Windows 7
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Phone 10 / Windows 10 Mobile

If any/all of these can be supported, that would be awesome.

Note: creating an active directory domain is not possible. Two of these PC's are laptops that are already members of other domains (work related) and cannot be modified as such.

2
  • 5
    is it possible to setup a local server (I already have two local Hyper-V host servers) that can download and serve all these updates to my LAN PC's, so that the LAN PC's can use it, and it can download all these updates once instead of each LAN PC downloading it's own set of updates? - Yes it is. It's called WSUS.
    – joeqwerty
    Jun 23, 2016 at 16:04
  • @joeqwerty While that helps me figure out what to use for the update management, I would also like to redirect all Windows Update requests to my local server, so that strangers cannot come along and do updates over the internet at my house. (Or, block Windows Update completely.) Jun 23, 2016 at 18:03

2 Answers 2

3

In terms of serving updates locally and managing which updates are downloaded and made available, then WSUS is the answer you're looking for. The restriction is that WSUS itself only serves content to those machines which request it, it doesn't control which machines on the network do so. Put another way, you GET updates from WSUS, not the other way round.

In an AD environment the easiest option to tell machines to use your WSUS server is via Group Policy, but since you're not in an AD environment that's not possible.

Outside of AD your options are to configure it on each individual machine using either local group policy, or via the registry. Details of the settings and both methods are available here - https://support.microsoft.com/en-gb/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s - but crucially you will need admin permissions to set them up, which may be an issue if they're already domain joined to a work network.

I don't think there's any easy way to block any guest machines on your network from connecting to Windows Update, or force them to connect to your WSUS server without changing the configuration on them. The IP addresses used for Windows Update are hard coded into Windows, so you can't just redirect requests for certain addresses to another IP. From what I remember it doesn't even use any special port numbers to connect, so without blocking guests from accessing the internet entirely from your connection, or only allowing specific connections to be made, you can't stop their machines from connecting to Windows Update.

The only real option I can think of to control guests usage would be to setup QAS and bandwidth limits on your connection, and then restrict their download speed. That way allowing them enough bandwidth to have basic access, but without being able to use it all to get updates.

1

The lancache project redirects HTTP requests to Windows Update by manipulating DNS queries and caches the files locally. Changing the group policy on each computer is not necessary. http://lancache.net/docs/containers/monolithic/

1
  • 1
    Looks promising, haven't thought about that organizers of such events came up with a tailored solution to their problem that is more than just squid. Thanks, I'll look into it.
    – LiveWireBT
    Sep 22, 2021 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.