All,
I am asking this question for a second time:
We have a single 2K3 AD Domain with 500 - 800 clients. Does anyone have any suggestions as to how to schedule the ALL clients to update once within a 30 day period?
and
... "These articles should help you out
http://windowsitpro.com/ar
http://technet.microsoft.c
http://technet.microsoft.c
is not considered an answer.
We have the WSUS application installed( 2K3 server with a 2005 SQL Database in a Simple Installation scenario) . We are about to rollout to our test environment.
If any real experts need additional information, I will be engaged and ready to deliver.
Thank you all in advance,
Naerwen
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I'm sure you have considered this already, but are you aware of the implications and stress you're putting on your network when rolling multiple updates to 800 machines at once? You are essentially putting GBs of data on the wire.
For medium size businesses and above, it is recommended to spread out WSUS among OUs. For example, one OU will have a GPO to update machines at 8am. Another will have a GPO set to run at 9am, and so on.
Pzozulka,
Yes I have considered this. In fact, that is the point of my question. I have so many workstations spread out all over my state (70 locations) that I am a bit overwhelmed with scheduling the updates. We, have at least, a T1 or better to each location. Additionally, each location only has, at most, 7 workstations. The bulk of the workstations are at the main office and a few other satellite offices.
Those things said, my latest tasking order in all this is to come up with the OU structure and scheduling within the GPOs.
Thank you,
Naerwen
In your situation, I would structure my OUs based on geographical locations at the parent level. Then sub-OUs (i.e. Sales, Marketing, etc.) as child OUs.
As a side-note, structuring OUs based on geographical locations can also be useful to allow delegations. For example, you hire a new Network Admin for 1 of the offices in your state, but you don't want to give him Full Admin rights to control your entire AD structure. In this situation, you could allow Delegations to that new Admin for only his "GEOGRAPHICAL OU".
Getting back to main point.
Your parent OUs, as I mentioned earlier, should be based on your geographical locations. This way, you can assign Group Policy settings to have machines Automatically install updates at 8am for OU A, 9am for OU B.
The AD structure does not need to be the same with the OU Structure...
If he has the servers so dpred... and in some location he do not have bandwitch... is better to create groups with 1-2 computers form evry location.. so the bandwitch will not all be used.. when patches are sent to the computer...
All,
For the remote facilities, I have selected an OU structure that is semi-geographical (I.E Northern Area, Southern Area, Easter .... etc) . I have been doing some throughput tests and found that I should be OK ... for the most part to the, even, to the most remote location (which acutally has an OK connection).
Now, regarding my "main office and a few other satellite offices" ... I am running a few throughput tests now. I will let this thread know the results when I am done.
I would still like to hear ideas on HOW to schedule the 500 - 800 clients so they update once a month.
Thank you,
Naerwen
Ok, here's hopefully a better idea(sorry for the duplicate info)
Using the script on this page http://www.vbshf.com/vbshf
you could use a scheduled task that runs once a month
Here's another idea, if you set your wsus to synchronize manually(download updates from microsoft) and use this script in a scheduled task once a month http://www.peetersonline.n
Then your clients will only get updates once a month.
I doubt you have an extra server at each location, so you probably don't have the option to roll out WSUS to each site. I assume, from what I'm seeing above, you have a VPN or something connecting each site Point to Point? I'm also going to assume all your workstations are on the Domain and authenticate to AD across the WAN?
The good news is, you have under 10 computers per location. I'm guessing since the offices are small, people are gone at night. I'd suggest you use your WSUS server to push out your GPO's for When and how to apply the updates, but have each computer grab it direct from Microsoft (Except the location that has the WSUS server, use that server to push it just there). Have your WSUS synchronize daily and push the updates out whenever it makes the most sense. So, if no one is in the office past 5pm, push it out at 6 when no one's on, or on a weekend if no one's there.
As for the AD structure, I'd recommend a top level OU ("Computers"), and have each site listed under that. I really wouldn't make any further sub OU's, as that'll become a nightmare if you ever drill down in the OU's, or run scripts, etc. Also, since this is across your WAN make sure you keep your Users and Computers in seperate top level OU's, then set the computer GPO's to only process the Computer portion (Saves bandwidth and time).
You'll want to configure bits to use no more than 10mbps during working hours (8-5pm) so updates never affect bandwidth during operating hours. After hours, let it go. You didn't mention if your workstations where XP or Vista. If they're Vista, great news.... Bits is able to pull updates from other Vista machines to save even more bandwidth.
I've implemented a similar setup (although not quite so many sites) and it's been working pretty well. If you need more detailed explanations let me know.
deadite,
Apologies....
I assume, from what I'm seeing above, you have a VPN or something connecting each site Point to Point?
>>>Yes. We have T1 connectivity (or better ... 1 or 2 are a fractionals but that's it.) connecting the remote location to our main office.
I'm also going to assume all your workstations are on the Domain and authenticate to AD across the WAN?
>>>Yes. That is correct. AD authentication occurs over the WAN links at the main office.
I'm guessing since the offices are small, people are gone at night.
>>>Yes. The staff are gone for the evening.
You'll want to configure bits to use no more than 10mbps during working hours (8-5pm) so updates never affect bandwidth during operating hours. After hours, let it go. You didn't mention if your workstations where XP or Vista. If they're Vista, great news.... Bits is able to pull updates from other Vista machines to save even more bandwidth.
>>> I found this: http://technet.microsoft.c
Thank you,
Naerwen
This is the article on configuring Bits
http://technet.microsoft.c
I would like to thank EVERYONE who participated in this discussion. All answers given were VERY informative. My decision on the points spread is based on whether or not the answer was used in someway for the implementation. I would also like to add, that we have successfully found a schedule for the first 100+/- clients and are now moving forward with the rest. Again, thank you all.
Business Accounts
Answer for Membership
by: BytyPosted on 2009-08-11 at 08:11:21ID: 25069962
You can approve the updates with Deadline... and at that date the patches WILL BE FORCE to be installed. If a computer is not on at that date the first time it will be started the patches will be depolyed!