We help IT Professionals succeed at work.

WSUS Options and GPO settings

in WSUS I would like to know if I select approve for Installation for  a group of computers, but in GPO I will select the setting #3  AUtoDownload and notify for install.
Would approve for Installation in WSUS make any sense? in other words when does WSUS Approve for Installation will make sense?

thanks
Comment
Watch Question

Toni UranjekConsultant/Trainer

Commented:
Hi!

Every update has to be approved first in WSUS, after that client with setting #3 will download update and notify user that update is ready to install. If you don't approve updates, client won't even begin to download them.

HTH

Toni

Author

Commented:
In WSUS does it make any difference if it's approved for detection or approved for installation?
Toni UranjekConsultant/Trainer

Commented:
Of course, first setting will only detect if updates are installed on client computers. If they are not such update will be marked as needed. When you approve update for install, clients will start downloading updates.

Author

Commented:
<<<When you approve update for install, clients will start downloading updates.>>>
3 - Auto download and notify for install

<<<When you approve update for install, clients will start downloading updates.>>>

I guess the client wouldn't download the updates if this policy is applied:
2 - Notify for download and notify for install


In my case this policy is applied:
3 - Auto download and notify for install
what happens for the servers which is my concern is if the approve for installation is selected and 3 - Auto download and notify for install, it will still install the updates in the server and if the update needs a reboot it will reboot the server, it did this several times, this is why I changed it to Approve for Detection and left the 3 - Auto download and notify for install.


Toni UranjekConsultant/Trainer

Commented:
If you approve updates for install and you have selected option #3, approved updates will be downloaded and you will end up with notification baloon or later with yellow shield icon in notification area of taskbar. You will have to double click this icon to start installation. Actualy I'm using exactly the same setting on computer I'm typing this post right now for exactly the same reason - to avoid automatic restarts. ;)

Author

Commented:
I know if a user is logged on to the machine it doesn't automatically restart, but if there is noone logged on it will reboot if the updates require that.

can you please tell me how you set up your WSUS and GPO settings for your servers?

Author

Commented:
with GPO #3 settings updates will be downloaded to the client regardless if approve for detection or approve for install is select?
Toni UranjekConsultant/Trainer

Commented:
No updates will be downloaded by clients if they are not approved for install.

I use exactly the same option #3 Auto download and notify for install, for servers, for client computers updates are automatically installed also. These are settings which I use with my customers. For my network I always go with "Auto download and notify for install" for W2K/XP/W2K3 computers, currently I patch Vista manually because I did have some problems after I've applied updates to Vista.

This is not a recommendation and it doesn't mean that you should do it the same way, I'm jst telling you how I do it.

Author

Commented:
I have checked approve for installation in WSUS options, and selected a group named Test(it has 2 computers WXP)
in The GPO I select #4 download and schedule install.

the 2 computers are showing 18 needed and 19 Needed,  and under the Approval column they show Install.
but it seems like the updates don't get installed. though there is no update that requires reboot.
Toni UranjekConsultant/Trainer

Commented:
And when are your updates scheduled to install?

Author

Commented:
<<<And when are your updates scheduled to install?>>>

where can I see that?
Consultant/Trainer
Commented:
When you select: Auto download and schedule the install, you must also set the day and time for the recurring scheduled installation. This is configured in your WSUS GPO.

You can also configure: Allow Automatic Update Immediate Installation
This policy specifies whether Automatic Updates should automatically install certain updates that neither interrupt Windows services nor restart Windows.


Explore More ContentExplore courses, solutions, and other research materials related to this topic.