WSUS Basics

[GC Email Manager]

I am new to WSUS. I installed it perfectly fine. It sis downloading updates.
I have a few basic questions:

1. I installed an XP x64 VM with SP3 from Server 2003 x64. I saw Windows XP
64-bit Edition Server 2003 as an option for updates and figured this was the
match because when I look at the OS in system properties for that VM it says
"Microsoft Windows XP x64 Edition Version 2003 Service Pack 2". However I
found some obscure website that said the WSUS XP 64-bit Edition Server 2003
was for Itanium editions. So then I unchecked that product and selected XP
x64. Which is the right version for my XP Pro x64 VM?

2. I can't believe I'm having a hard time managing WSUS. Basically all my
machines are patched except one last update prior to me installing WSUS. I
wanted it this way so I could see at least one update available to apply via
WSUS. However the screen is a bit confusing to me (using WSUS 3.0 SP2). I
want the following:

a. don't download updates for anything except Office 2007, Server 2008,
Server 2003, XP x64, Vista, Windows Defender, and IE 8 updates. No machine
has any previous version of anything else (OS, software, browser, etc). It
seems that WSUS is downloading tons of updates that I will never push out.
Our WsusContent folder is almost 7 GB!!!

b. find a way to sort the updates ready to be deployed. I created a group
for each OS type as each PC (vista, xp, windows7) is in it's own sub-OU in
AD. I created a WSUS GPO for each of these with client side targeting enabled
and pointing to the appropriate group in WSUS. The computers are in the
correct WSUS groups. BasicallY i want to click on a filter for XP PCs and see
the new updates that are ready to be deployed.

c. understand the process for applying updates. I tried reading the help
file but it isn't so much step by step as it is a description. Basically I
want to (1) see updates ready for an application (or OS), (2) tell WSUS to
download it to the WSUS server, (3) pick a group of PCs and approve that
update for that group of PCs, (4), and let the PCs download this copy from
the WSUS server. I still want the users applying the update when they are
ready, not forcing it upon them yet. I have created the GPO for all PCs to
pull from the WSUS server and that GPO seems to be working fine.

d. set a time for when WSUS deletes old updates. I don't want it holding on
to update files (taking up HD space) for a long period of time since we know
any new machines won't be on our network without being manually updated
first. Especially since there are so few updates needed, why is it taking
huge chunks of disk space and downloading updates that none of my PCs need?

e. learn how to schedule updates and reboots for an exact time (like at 3am
to install and then reboot).


Every blog I read seems that WSUS seems so simple to people. So either it's
been a long week or they're all geniuses. I still can't find anything that
explains what the "Installed/Not applicable" column means and other columns.

[Lawrence Garvin [MVP]]

Post by GC Email Manager
1. I installed an XP x64 VM with SP3 from Server 2003 x64. I saw Windows XP
64-bit Edition Server 2003 as an option for updates and figured this was the
match because when I look at the OS in system properties for that VM it says
"Microsoft Windows XP x64 Edition Version 2003 Service Pack 2". However I
found some obscure website that said the WSUS XP 64-bit Edition Server 2003
was for Itanium editions. So then I unchecked that product and selected XP
x64. Which is the right version for my XP Pro x64 VM?

The "obscure website" may or may not be correct . . . but "Windows XP x64
Edition" is definitely the correct product category for your "XP x64" VM.

Post by GC Email Manager
2. I can't believe I'm having a hard time managing WSUS.

Some do . . . usually there's a correlation between those who have, and
those who have not, reviewed the product documentation in the TechNet
Library.

http://technet.microsoft.com/en-us/library/dd939796(WS.10).aspx

Post by GC Email Manager
a. don't download updates for anything except Office 2007, Server 2008,
Server 2003, XP x64, Vista, Windows Defender, and IE 8 updates. No machine
has any previous version of anything else (OS, software, browser, etc). It
seems that WSUS is downloading tons of updates that I will never push out.
Our WsusContent folder is almost 7 GB!!!

Let's not be confused between the product categories you select for
synchronization and the UPDATES you approve for installation. Frankly, 7GB
isn't that much content, and sounds about right for two server operating
systems, two desktop operating systems, office, defender, and IE8 --
particularly if you've also chosen to synchronize service packs.

Post by GC Email Manager
b. find a way to sort the updates ready to be deployed. I created a group
for each OS type as each PC (vista, xp, windows7) is in it's own sub-OU in
AD. I created a WSUS GPO for each of these with client side targeting enabled
and pointing to the appropriate group in WSUS. The computers are in the
correct WSUS groups. BasicallY i want to click on a filter for XP PCs and see
the new updates that are ready to be deployed.

You'll need to create a Custom Update View in order to see a selection of
updates filtered by product category, update classification, or target
group.

See "Viewing The Updates" in the WSUS Operations Guide for more information
on creating custom update views:
http://technet.microsoft.com/en-us/library/dd939874(WS.10).aspx

Post by GC Email Manager
c. understand the process for applying updates.

This would be found across these three documents:
[a] the WSUS Overview
http://technet.microsoft.com/en-us/library/cc708429(WS.10).aspx
specifically the section "WSUS and the Update Management Process"
http://technet.microsoft.com/en-us/library/cc708520(WS.10).aspx

[b] the Step By Step Guide
http://technet.microsoft.com/en-us/library/dd939822(WS.10).aspx
specifically Step 7: Approve and Deploy Updates
http://technet.microsoft.com/en-us/library/dd939909(WS.10).aspx

[d] the Operations Guide
http://technet.microsoft.com/en-us/library/dd939842(WS.10).aspx
specifically the section "Managing the Updates"
http://technet.microsoft.com/en-us/library/dd939899(WS.10).aspx

Post by GC Email Manager
d. set a time for when WSUS deletes old updates.

This you cannot do. This functionality is interactive only.

For more information on maintaining the WSUS server in this scenario,
see the section "Using the Server Cleanup Wizard" in the WSUS Operations
Guide
http://technet.microsoft.com/en-us/library/dd939856(WS.10).aspx

Post by GC Email Manager
why is it taking
huge chunks of disk space and downloading updates that none of my PCs need?

The answer to this question is found in understanding the architecture and
functionality of the WSUS environment.

Post by GC Email Manager
e. learn how to schedule updates and reboots for an exact time (like at 3am
to install and then reboot).

This is the default behavior of the Windows Update Agent; but to the same
point, understanding the architecture and core functionality of the WUAgent
will help.

Post by GC Email Manager
Every blog I read seems that WSUS seems so simple to people.

Truly ... it is. But it does presume a certain familiarity with
understanding Automatic Updates and the Windows Update Agent (both of which
have existed for over ten years), and then understandinfg that WSUS is just
a local "extension" of the Microsoft Automatic Updates functionality.

Post by GC Email Manager
I still can't find anything that
explains what the "Installed/Not applicable" column means and other columns.

This is all covered in the aforementioned section "Managing the Updates" in
the WSUS Operations Guide.

HINT: Don't overthink the thing. It is actually a very simple product.
"Installed/Not Applicable (Percentage)" means exactly what it suggests..
it's the percentage of machines where that update is either Installed or Not
Applicable. (i.e. 100% - that number, is the percentage of systems that do
not have this update installed and could/should have it installed.)

In addition, you may find this series of webcasts that I've done over the
past several months to be of great assistance in understanding the basic
functionality of WSUS:

"Top WSUS Operations Issues Solved" (May 2009)
https://www.eminentware.com/cs2008/media/p/216.aspx

"Top WSUS Diagnostics Problems Fixed!" (June 2009)
https://www.eminentware.com/cs2008/media/p/245.aspx

"Improving Your WSUS Deployment" (August 2009)
https://www.eminentware.com/cs2008/media/p/272.aspx

"Insite WSUS v3.0 SP2: Important Features, Tips & Tricks" (October 2009)
https://www.eminentware.com/cs2008/media/p/360.aspx

"Group Policy & Microsoft WSUS Best Practices" (January 2010)
https://www.eminentware.com/cs2008/media/p/536.aspx