Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 308
  • Last Modified:

WSUS question

We have two locations.
Philadelphia and Harrisburg
For the most part our computers stay in the same location.
However, there are a few employees that take laptops between locations.
I have my PC's for both locations in seperate OU's and I am going to have a group policy for each OU that points to that particular OU's WSUS server.
However, I would like the laptops to be told through group policy to use automatic updates through microsoft. Is this possible and can I monitor the status of their updates?
0
steveLaMi
Asked:
steveLaMi
  • 3
  • 2
1 Solution
 
PeteJThomasCommented:
Slightly off the actual question here, but have you considered site based policy as opposed to an OU based policy?

All I mean is, link the WSUS policy (that points the 'site' to it's respective WSUS server) to the Site in Active Directory Sites & Services. That way, whether or not a client machine goes to one WSUS server or the other will be determined by the subnet it's logging in from, and should therefore always look to the WSUS server that is local to it's current location.

That is how we stop our 'roaming' laptop users from picking up WSUS updates from across our WAN when they're away from their 'home' site.

Does that help, or do you specifically need a way to force these machines to update from the web for another reason entirely?

Pete
0
 
steveLaMiAuthor Commented:
It looks when they designed the network they used the same subnet for both locations. However, the IP scheme is different. One is 192.168.0.x and the other 192.168.1.x but both with 255.255.255.0
0
 
PeteJThomasCommented:
Ok then, you're correct, and a Sites based GPO will not work for you. Though it should be noted that for sites at 2 separate locations (with a WAN in between) that is not ideal, as clients at either physical site could end up authenticating to a domain controller that's at the other site over the WAN, which will make for a slower authentication process...

But that's a different issue - For your laptops to update via MS, you simply need to DISABLE the setting "Specify Intranet Microsoft Update Service Location". If disabled, AU will automatically look to the Windows Update site on the web for updates.

So separate your laptops into a different OU, configure the Updates settings as normal, but just disable the setting I mentioned... You'll still want to configure the behaviour using the "Configure Automatic Updates" setting etc as well.

HTH

Pete
0
 
steveLaMiAuthor Commented:
Pete,

Thank you for your help. I did notice that they do have a seperate site for that location and it's DC in sites and services. Hopefully this is what is preventing them from authenticating from a wrong DC. I am going to dig into that further tomorrow. As for the WSUS, thanks again, I am going to use that method.
0
 
PeteJThomasCommented:
Ah ok that's good, there must be something differentiating between the 2 sites after all! Definitely worth looking into though, especially if you notice slow log ons etc.

Also, that does bring my original comment back into the fold, with Site assigned GPOs managing WSUS settings - Obviously it's your choice as to your preference, but if it is just a case of not wanting the laptops to update over the WAN, site assigned GPOs would accomplish this, with the added benefit of keeping your laptops updating via WSUS, and therefore you're back in control of the updates they receive and can monitor everything etc.

In my eyes that's preferable, and simple to implement (without the need to separate your laptops into a different OU), as all you need to do is have 2 GPOs that point to each WSUS server, and link them to the 2 sites you have defined, instead of linking them to any OUs...

But as I say, whatever you prefer! :)

Pete
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now