Setup a server to host Windows updates for all LAN devices

Question

Background: I have a really slow internet connection (the highest download speed I've seen on it is 3.5Mbps, though I only pay for 3Mbps), and Windows 10 does updates all the freaking time. Like, so much. This obviously bogs down my connection regularly. I also have ~7 machines on my LAN that are updating on this basis. All-in-all, I'd say about 50% of my internet traffic is Windows Updates.

This brings me to my question: is it possible to setup a local server (I already have two local Hyper-V host servers) that can download and serve all these updates to my LAN PC's, so that the LAN PC's can use it, and it can download all these updates once instead of each LAN PC downloading it's own set of updates?

Both of these Hyper-V servers are Windows Server 2012 R2, though I can upgrade them easily if necessary.

Also, I'm willing to serve updates for any Windows OS on the local LAN, though obviously Windows 10 is the highest priority, but I have devices with all of the following versions:

• Windows 10
• Windows 8.1
• Windows 7
• Windows Server 2012 R2
• Windows Server 2012
• Windows Server 2008 R2
• Windows Phone 10 / Windows 10 Mobile

If any/all of these can be supported, that would be awesome.

Note: creating an active directory domain is not possible. Two of these PC's are laptops that are already members of other domains (work related) and cannot be modified as such.

Answer 1

In terms of serving updates locally and managing which updates are downloaded and made available, then WSUS is the answer you're looking for. The restriction is that WSUS itself only serves content to those machines which request it, it doesn't control which machines on the network do so. Put another way, you GET updates from WSUS, not the other way round.

In an AD environment the easiest option to tell machines to use your WSUS server is via Group Policy, but since you're not in an AD environment that's not possible.

Outside of AD your options are to configure it on each individual machine using either local group policy, or via the registry. Details of the settings and both methods are available here - https://support.microsoft.com/en-gb/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s - but crucially you will need admin permissions to set them up, which may be an issue if they're already domain joined to a work network.

I don't think there's any easy way to block any guest machines on your network from connecting to Windows Update, or force them to connect to your WSUS server without changing the configuration on them. The IP addresses used for Windows Update are hard coded into Windows, so you can't just redirect requests for certain addresses to another IP. From what I remember it doesn't even use any special port numbers to connect, so without blocking guests from accessing the internet entirely from your connection, or only allowing specific connections to be made, you can't stop their machines from connecting to Windows Update.

The only real option I can think of to control guests usage would be to setup QAS and bandwidth limits on your connection, and then restrict their download speed. That way allowing them enough bandwidth to have basic access, but without being able to use it all to get updates.

Answer 2

The lancache project redirects HTTP requests to Windows Update by manipulating DNS queries and caches the files locally. Changing the group policy on each computer is not necessary. http://lancache.net/docs/containers/monolithic/