Link to home
Start Free TrialLog in
Avatar of steveLaMi
steveLaMiFlag for United States of America

asked on

WSUS question

We have two locations.
Philadelphia and Harrisburg
For the most part our computers stay in the same location.
However, there are a few employees that take laptops between locations.
I have my PC's for both locations in seperate OU's and I am going to have a group policy for each OU that points to that particular OU's WSUS server.
However, I would like the laptops to be told through group policy to use automatic updates through microsoft. Is this possible and can I monitor the status of their updates?
Avatar of PeteJThomas
PeteJThomas
Flag of United Kingdom of Great Britain and Northern Ireland image

Slightly off the actual question here, but have you considered site based policy as opposed to an OU based policy?

All I mean is, link the WSUS policy (that points the 'site' to it's respective WSUS server) to the Site in Active Directory Sites & Services. That way, whether or not a client machine goes to one WSUS server or the other will be determined by the subnet it's logging in from, and should therefore always look to the WSUS server that is local to it's current location.

That is how we stop our 'roaming' laptop users from picking up WSUS updates from across our WAN when they're away from their 'home' site.

Does that help, or do you specifically need a way to force these machines to update from the web for another reason entirely?

Pete
Avatar of steveLaMi

ASKER

It looks when they designed the network they used the same subnet for both locations. However, the IP scheme is different. One is 192.168.0.x and the other 192.168.1.x but both with 255.255.255.0
ASKER CERTIFIED SOLUTION
Avatar of PeteJThomas
PeteJThomas
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Pete,

Thank you for your help. I did notice that they do have a seperate site for that location and it's DC in sites and services. Hopefully this is what is preventing them from authenticating from a wrong DC. I am going to dig into that further tomorrow. As for the WSUS, thanks again, I am going to use that method.
Ah ok that's good, there must be something differentiating between the 2 sites after all! Definitely worth looking into though, especially if you notice slow log ons etc.

Also, that does bring my original comment back into the fold, with Site assigned GPOs managing WSUS settings - Obviously it's your choice as to your preference, but if it is just a case of not wanting the laptops to update over the WAN, site assigned GPOs would accomplish this, with the added benefit of keeping your laptops updating via WSUS, and therefore you're back in control of the updates they receive and can monitor everything etc.

In my eyes that's preferable, and simple to implement (without the need to separate your laptops into a different OU), as all you need to do is have 2 GPOs that point to each WSUS server, and link them to the 2 sites you have defined, instead of linking them to any OUs...

But as I say, whatever you prefer! :)

Pete