Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies. Only from Platform Scholar.
Course Of The Month
Become a Premium Member and unlock a new, free course in leading technologies each month.
Solved
WSUS for remote clients
Posted on 2010-09-07
We have WSUS 3.0 and all of our clients are on the domain, including our remote clients. None of our clients have local admin privledges. our AU policy is GPO based and updates need to be approved on the WSUS before installationon the clients. I want to know how our remote employees receive their updates from the WSUS or from the internet.
1.How do the remote clients communicate with the WSUS for downloads, through the VPN? How does that work, once the update is approved, the client logs onto the VPN and they are told by he WSUS what updates are aproved and then they download/install those updates from the internet or the WSUS?
2. How can I configure the remote clients to communicate with the WSUS while they are not on the VPN? At leasst to communicate what they are approved to download then download it from the internet directly?
Thanks!
1.How do the remote clients communicate with the WSUS for downloads, through the VPN? How does that work, once the update is approved, the client logs onto the VPN and they are told by he WSUS what updates are aproved and then they download/install those updates from the internet or the WSUS?
2. How can I configure the remote clients to communicate with the WSUS while they are not on the VPN? At leasst to communicate what they are approved to download then download it from the internet directly?
Thanks!
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
2
2
7 Comments
You have to look at it this way. Think of your PC as actually being in your network when it is connected to the VPN. That is the best way to look at it. So when your laptop is connected via the VPN, it will download the updates from the WSUS server, depending on how your settings are. As far as your clients communicating via the WSUS server when not connected to the VPN, I don't think this is realistic as far as security is concerned. Do you have a firewall set up protecting your network?
I understand that while on the vpn the clients are on the network, but since a client may only be on for a few minutes and not long enough to download/install updates and to save bandwith I would like them to update via the internet if possible.
Do you know for sure if while on the vpn the clients are actually downloading the updates from the WSUS or are only notified of the approvals and then downloading from the internet?
Also, I think it should be possible to update via the WSUS through the internet. Of course we have a firewall.
Thanks!
Do you know for sure if while on the vpn the clients are actually downloading the updates from the WSUS or are only notified of the approvals and then downloading from the internet?
Also, I think it should be possible to update via the WSUS through the internet. Of course we have a firewall.
Thanks!
Definitely the computers will download the updates via the WSUS server when connected through the VPN. How often do you push out updates via WSUS? There should be a setting in which you can set PC's to download the updates directly from the internet. I will have a look on my WSUS server. We are currently running our updates through our SCCM server though so I need to familiarize myself with the WSUS console.
Active today
WSUS defaults to download updates and then the update client pulls the updates from the WSUS server. VPN or not, the client will do whatever the group policy says for it to do. Windows doesn't have any logic built in to say "hey, I'm on a VPN so I should go straight to the internet."
What you can do is create a separate WSUS group policy to have updates downloaded directly from the internet and then apply that policy to a security group with the remote machines. That policy will *always* be in effect though, so even when laptops are on the internal network, they will download updates from the internet and thus you will want to be aware of the impact on your bandwidth with such a solution in place.
For the second part, since WSUS is reliant on group policy, while it is technically possible to publish a WSUS server and have machines download it, they would not get any updated group policy settings and thus would be very limited. Having them connect via VPN solves other problems besides just updates. My current recommendation for such setups is to look at deploying DirectAccess. This allows a VPN to be setup *before* logon, so group policies work, WSUS works, and DA is very firewall friendly. This would be better than publishing a WSUS server.
-Cliff
What you can do is create a separate WSUS group policy to have updates downloaded directly from the internet and then apply that policy to a security group with the remote machines. That policy will *always* be in effect though, so even when laptops are on the internal network, they will download updates from the internet and thus you will want to be aware of the impact on your bandwidth with such a solution in place.
For the second part, since WSUS is reliant on group policy, while it is technically possible to publish a WSUS server and have machines download it, they would not get any updated group policy settings and thus would be very limited. Having them connect via VPN solves other problems besides just updates. My current recommendation for such setups is to look at deploying DirectAccess. This allows a VPN to be setup *before* logon, so group policies work, WSUS works, and DA is very firewall friendly. This would be better than publishing a WSUS server.
-Cliff
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Back in July, I blogged about how Microsoft's new server pricing model, combined with the end of the Small Business Server package, would result in significant cost increases for many small businesses (see SBS End of Life: Microsoft Punishes Small B…
Experts-Exchange users below are the steps you can follow to upgrade your Lync server to latest CU's or cumulative updates.
Note: Perform it during non-production hours.
Step 1: Backup your lync and SQL server database. Follow below article:
h…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses
Earn Certification
HTML5 Specialist - Certification
Free withPremium
Course of the Month3 days, 23 hours left to enroll
630 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.