Solved

Windows Update Group Policy for DC and SBS Servers

Posted on 2008-10-02
7
490 Views
Last Modified: 2012-05-05
Hello,

I am trying to confirm that what I am doing is correct and if not to ask for some direction.

The default domain policy says that all systems are to update windows and install automatically. This includes the DC and servers. I don't want this for obvious reasons. I want to be able to download but wait for manual installation on the DC and Servers.

To set this up, I did a Block Inheritance at the Domain Controllers and SBSServers OU's and configured their respective poilicies accordingly.
Is this correct?

Thanks in advance.
0
Comment
Question by:cepolly
  • 3
  • 3
7 Comments
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
Comment Utility
If you do this it will Block ALL policies except those applied directly to the OUs in question - if that what you want then its fine.
0
 
LVL 1

Author Comment

by:cepolly
Comment Utility
Yes it is. We don't have too many policies that we have implemented.

However, you bring up a good point.
Are there policies inherent to SBS 2003 that I may be blocking inadvertantly?

0
 
LVL 18

Assisted Solution

by:sk_raja_raja
sk_raja_raja earned 400 total points
Comment Utility
when i have this same issue,

1.Block inheritance on the DC and server OU and this will block all the policies
2.Create a new policy for updates and link to the DC ans erver OU's
3.Then again link the other policies you need to apply to these ou's

I would suggest linking the GP's is the best way to do this.

0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 18

Assisted Solution

by:sk_raja_raja
sk_raja_raja earned 400 total points
Comment Utility
in simple you can link the GP's anywhere in the OU...even if you specify block inheritance and say for example it is going to block GP1 and GP2.... then still you can link the GP2 on the same ou and this policy will be applied.

Other workaround you can try is,create a new update policy with settings and link it to the dc and server ou and the enforce the newly create policy....this will work only if your parent policy from top is not enforced.....
0
 
LVL 1

Author Comment

by:cepolly
Comment Utility
Looks like the linking was the problem. As soon as I removed the linkage, the policies took.

Now if I relink, will I lose the settings that I want? Will the newly link GPO take precedence?
0
 
LVL 18

Accepted Solution

by:
sk_raja_raja earned 400 total points
Comment Utility
i dont understand your query..can you be more clear.

just relink the policy and dont enforce
link the newly link gpo and enforce it

hence the settings on the new gp will take precedence....
0
 
LVL 1

Author Comment

by:cepolly
Comment Utility
You didn't understand what I said exactly but you answered it. :-)

I understand. Thanks for the help.

0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now