I've just installed a "Windows Server Update Services" (WSUS) server in my company to provide updates to the Windows Server machines. Now I want to set a GPO in the servers OU to force them to get updates from the WSUS, but I'm not able to get it working. What I have done is:
- Created a GPO called "WSUS" with the required settings (which are under "Computer Configuration" > "Windows Components" > "Windows Update") at the keys "Specify intranet Microsoft update service location", "Configure Automatic Updates" and "Enable client-side targeting".
- Created an Organizational Unit of first level called "MyServers" and move my servers from the "Computers" container to this OU.
- Created a group called "MyServersGroup" inside that OU containing the computers inside "MyServers" (the OU and the group contain the same servers).
- Linked the GPO to the "MyServers" OU and, at the Security filters, added the "MyServersGroup" with the "Read" and "Apply group policy" permissions (I did not delete the "Autenticated users" group).
- Ran the "gpupdate /force" command in my Domain Controller server and then in one of my servers inside the "MyServers" OU, lets call it FileServer.
And the policy does not apply.
Instead of showing that policy applied, when I run "GPResult /F /H report.html" in the FileServer machine, the only policy applied is the "Default Domain Policy", which has some settings inside the "Computer Configuration" section but not at the keys I configured. That GPO is linked to the domain root, affecting only to the "Authenticated users" group.
In the report.html file the "WSUS" string does not even appear as the "Winning GPO" is always the "Default Domain Policy". Why can't my policy be applied? I don't understand why is this happening...
Edit: Now I have removed the "MyServersGroup" and configured the "Group Policy Modelling Wizard". It shows the WSUS policy being applied along with the default one, but in the FileServer the policy isn't applied yet (I ran the gpupdate in case it was necessary).