Solved

Managing remote laptops via WSUS 3..0

Posted on 2009-07-13
11
550 Views
Last Modified: 2012-06-27
Hi ,

We have setup WSUS 3.0 SP1 in our internal LAN .There are absolutely no issues with the updates propagating across the clients in LAN .. But i have a scenario where some of the users are Roaming. I dont want them to recieve s the updates from WSUS when connected thro' VPN cos' as you know it clog the Bandwidth . I want them to directly connect to Microsoft Update Server and download the updates.

Is there any ways to achieve this ?

Thanks for the help in advance
0
Comment
Question by:Arisglobal
  • 5
  • 4
  • 2
11 Comments
 
LVL 1

Expert Comment

by:unluckynelson
ID: 24840352
Do they connect onto VPN through ISA server?
If so you can simply create a firewall rule to block the WSUS access on ISA...
0
 
LVL 3

Author Comment

by:Arisglobal
ID: 24840655
No We dont have ISA Server. Can we block the ports on the Firewall box which isn't ISA Server?
0
 
LVL 47

Expert Comment

by:dstewartjr
ID: 24840689
You will need to setup another WSUS server and configure it to NOT store updates locally and point your laptops to this server.
0
 
LVL 3

Author Comment

by:Arisglobal
ID: 24840825
Thanks for the reply dstewartj I had this idea before  but i dont wanna have 2 WSUS servers running. its kinda complicated and have to look after both the servers
0
 
LVL 47

Expert Comment

by:dstewartjr
ID: 24840918
This will be the the only way, It's a all or nothing. You could just put these laptops in another GPO that only uses windows updates,but you wont be able to control these updates(I.E. Approvals)
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 1

Expert Comment

by:unluckynelson
ID: 24840942
The transmission protocols and ports used are HTTP 80 and HTTPS 443. So you could block those ports to the server from the VPN IP Pool....
Unfortunately these are also web ports so you can't block them across the board...
0
 
LVL 3

Author Comment

by:Arisglobal
ID: 24841135
If I configure these laptops for another GPO when the roaming users are back to the office.. they still continue recieve the updates from Windows Updates .

Can't we run any script wherein it checks for the IP ADDRESS  of the local Machine if it points to LAN the registry should point to WSUS server or else to windows updates
0
 
LVL 47

Accepted Solution

by:
dstewartjr earned 500 total points
ID: 24841350
Create a .reg file with your settings for WSUS and one for Microsoft.
Then use a startup script similar as below.
Modify the gateways below to match your environment, if you have more just add more lines.
 



set GW=

for /f "tokens=2 delims=:" %%a in ('ipconfig ^| find "Gateway"') DO SET GW=%%a

if %GW%== 10.63.106.2 regedit /s \\server\share\WSUS.reg    

if %GW%== 10.63.106.130 regedit /s \\server\share\Microsoft.reg

Open in new window

0
 
LVL 47

Expert Comment

by:dstewartjr
ID: 24841617

 
 The below would be all you need to set it to use Microsoft  Updates.
 

Windows Registry Editor Version 5.00
 

[-HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\]

 
 

 
 

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\]
 
 

"UseWUServer"=dword:00000000

Open in new window

0
 
LVL 47

Expert Comment

by:dstewartjr
ID: 24848944
So a "B" cause you didnt like the answer???
0
 
LVL 3

Author Comment

by:Arisglobal
ID: 24848984
I'am forced to accept the answer cos' u know most of the users using Laptop will nvr shutdown their laptops put in hibernation or standby .. i have to schedule the script as the job for each ..and moreover i don't prefer scripting . Was thinking is there anyways goaround without using scripts .. But the when architecture is something like this.. i'm forced to accept it
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Patch Management is administrated by page 129 of  the following document:     http://support.dell.com/support/edocs/software/smdmc/11/en/ug/ug.pdf However, there are issues with Patch Management with FTP (for instance, a slow Internet connectio…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now