1

I'm currently designing a new WSUS environment where we are looking to have multi level approvals.

We want to have a top level WSUS where the security team approves updates which then sync to downstream WSUS servers for each team(Infrastructure,Dev etc) to then approve/decline their own subset.

Problem is that in autonomous mode the downstream server syncs all patches from the upstream regardless of approval. In replica mode we would lose the functionality to give each team the ability to decline any updates they think would have an adverse affect.

What I'm looking for is something in between. Has anyone got a set up like this or know how it could be achieved?

  • When you say the server sync all patches from the upstream regardless of approval, it should only be sync'ing information about the updates. The binaries aren't actually downloaded until the update is approved, assuming you haven't changed that setting in the "Update Files and Languages" options. – Matthew Wetmore Jan 6 '17 at 3:02
  • Thanks that's all fine, however i was hoping not to download the metadata about non approved updates from the top level server. Any thoughts? – Joe Spirit Jan 20 '17 at 10:10
  • I believe the only way to avoid getting non-approved updates is to not sync those categories/classifications in the first place at the upstream server (USS). Through the API, the USS can delete metadata for specific updates - but I don't 100% trust the results of that. The metadata includes scan content for knowing whether updates are applicable, which is part of the administrator's workflow for knowing which updates should be approved... So cutting off that flow can make your process tricky. – Matthew Wetmore Jan 20 '17 at 18:17
  • Here is an option for you: Security team evaluates updates and identifies the KBs they want to put into the pipeline. They have a WSUS server that is set to manually sync (effectively not sync at all). As KBs are identified, the security team imports KBs from the WU catalog into this stand-alone WU server, that then acts as the USS for your pipeline. This is a more manual process, but would achieve your goal. – Matthew Wetmore Jan 20 '17 at 18:22
  • There is a significantly trickier variant on this where the USS is sync'ed to WU thus getting all the metadata for categories/classifications... Once you identify desired updates, approve them and ensure all content has been downloaded. Use the WSUS API to delete non-approved updates. Export the DB and WSUSContent folders, then import them into a USS that doesn't sync from WU. There are a lot of moving parts to this solution, and is not attempted lightly. We've done this here as part of a commercial solution and took a while (and several people) to get right. – Matthew Wetmore Jan 20 '17 at 18:25
0

There are two main options, each with an "easier" and a "harder" way to accomplish the goal depending on your requirements and networking environment.

  1. Downstream servers can see all available updates, but clients cannot install them until approved upstream.

This option relies on your upstream server (USS) being set to not download content until updates are approved. The downstream server (DSS) syncs from the USS as normal, and receives metadata about available updates. This enables clients to scan and determine whether updates are applicable. Administrators at the DSS can see Needed updates and can Approve the updates before or after the updates are approved on the USS. However, until the USS Approves the updates the content will not be available and clients will not be able to install them.

An alternative to this approach is to treat this as an air-gap scenario and periodically export the parent WSUS instance's metadata and binary content and import it to a stand-alone instance for the final destination. Updates are imported without approvals, so the branch office can make final determinations.

  1. Absolutely no content from non-approved updates flowing to the downstream server.

The best approach for this is to have a stand-alone server for the downstream clients. On the primary WSUS server, updates are evaluated and KBs for approval are noted. The branch-office WSUS server can then import KBs from the Windows Update catalog by KB number directly.

A difficult-to-implement alternative to this approach is sync'ing the USS to WU and getting all the metadata for categories/classifications. Once you identify desired updates, approve them and ensure all content has been downloaded. Use the WSUS API to delete non-approved updates. Export the DB and WSUSContent folders, then import them into a USS that doesn't sync from WU. There are a lot of moving parts to this solution, and is not attempted lightly. We've done this here as part of a commercial solution and took a while (and several people) to get right.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.