Correct GPO setting to use Internal WSUS with MS update servers

Question

We have a single WSUS server that our former sr sys admin spun up but never really did much with it other than to auto approve all security and critical updates.

In reviewing the setup, I am trying to make the changes below but am not sure of what specific settings I need to set:

1) change the update source from locally stored to store on MS update servers
2) have clients get update approvals from internal WSUS server but download the update files from MS update servers (majority of our windows users are in a different country)

I've gone through a lot of the online resources but can't make out the exact settings. so far I have the following settings:

1) Update Source and Proxy Server: Synchronize from Microsoft Update
2) Update Files and Languages: Do not store update files locally; computers install from Microsoft Update

This all seems good but in our GPO we have the "Specify intranet Microsoft update service location" enabled with http://{wsus_server_name:port} specified for both the "Set the intranet update service for detecting updates" and "Set the intranet statistics server". My question is are these settings sufficient to do what I want it to do? That GPO seems to suggest that the clients will be reaching out to our internal WSUS server for updates. Now i don't know if that means it will reach out to the internal server to see what updates apply to it and is approved to be installed AND THEN it will reach out to MS update servers to pull down the updates or if I need to set the GPO settings to point to the MS update servers.

I looked at this How to connect clients to INTERNAL WSUS server but download the approved updates from Microsoft? but just wanted clarification and confirmation if my settings are correct.

Answer 1

That GPO seems to suggest that the clients will be reaching out to our internal WSUS server for updates. Now i don't know if that means it will reach out to the internal server to see what updates apply to it and is approved to be installed AND THEN it will reach out to MS update servers to pull down the updates or if I need to set the GPO settings to point to the MS update servers.

You've got it right in the first part of this quote. Everything you stated is right. You set the clients to get their updates (in this case, technically the approval and control) to the internal WSUS server. You set the setting on the WSUS server to " Update Files and Languages: Do not store update files locally; computers install from Microsoft Update" to make sure the clients download the BITS from the Windows Update servers instead of the WSUS server caching them.

Now, that said, you do have the option to deploy WSUS proxies internally that would hold and cache the files. But yes, your logic is correct and you are on the right track for what you are trying to do.