WSUS assistance

Posted on 2009-02-19
Last Modified: 2012-05-06
Ladies and Gentlemen, I have a moderate dilema with WSUS. I have multiple clients that I support. I would like to set up a WSUS at my office. This part is not a big deal. What I would like is to have all my clients poll my WSUS server so as to download only updates that I approve. In concept I could do a part of this through GPOs. However, my understanding is that it would only work properly if the WSUS was on their networks. I want to avoid that, because some of their servers are not the best. The other way I saw was to make registry entries to change the Windows Update server to point to mine. Again, that is not advisable. Mainly because doing that would involve accessing well over 200 machines. Can anyone tell me of a proper configuration for WSUS at my main office to have all of my clients access?
Question by:mehherc
    LVL 6

    Expert Comment

    Almost half of getting  WSUS becomes worthless unless your pipe to the clients is 100Mbit or better.
    LVL 1

    Author Comment

    My clients all have T-1 or better internet connections. Their internal network is all 100 meg. So bandwidth for them and my main office is not a problem.
    LVL 6

    Accepted Solution

     OK, here are the issues I see with that you want to do:

    WSUS is used to control patch approvals. It is also used as a way to save bandwidth, so the patches are only downloaded once over a slow link (T-1) then pushed to lots of machines over fast link (Gbit, etc...) Setting up WSUS requires the machines to point to the WSUS server, so Automatic Updates and BITS service can pull the patches. Modification choices are either via GPO or scripts. Now to your scenario:

    WSUS over slow link:

    #1 T1 will choke. Imagine patch Tuesday, MS issues 3 XP patches for a total of 30Mb. You approve the patches at your WSUS. Now you have 200+ machines downloading those files within 24 hours. Do the math how much bandwidth YOU need.  
    #2 Open ports or establish VPN for communication between servers and WSUS, lots of work.
    #3 Modify all servers via GPO or script, something you don't want to do
    I hope I made it clear that no matter what you will need to modify the servers whether WSUS is here or there. You can setup a cascading WSUS server structure, but that requires a WSUS server at each location, something you don't want.
    LVL 1

    Author Closing Comment

    I was afraid of that. I was just hoping my logic was flawed. I guess I wasn't. I was just hoping you guys here would have a convenient catch-all shortcut. I guess I will have to put in 8 low-ish end servers at each location for WSUS. Oh well. I guess no way around spending a couple of bucks. LOL. Thanks for confirming my fears. (:-D)

    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    Join & Write a Comment

    Consider a situation when you deploy a seemingly harmless software package to your network without testing and therefore without fully knowing the implications of your actions. I was recently involved in just this situation when a corporate IT netwo…
    The environment that this is running in is SCCM 2007 R2 running on a Windows 2008 R2 server. The PXE Distribution point is running on its own Windows 2008 R2 box. This is what Event viewer showed after trying to start the WDS service:  An erro…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now