Solved

WSUS question

Posted on 2011-02-10
5
297 Views
Last Modified: 2012-05-11
We have two locations.
Philadelphia and Harrisburg
For the most part our computers stay in the same location.
However, there are a few employees that take laptops between locations.
I have my PC's for both locations in seperate OU's and I am going to have a group policy for each OU that points to that particular OU's WSUS server.
However, I would like the laptops to be told through group policy to use automatic updates through microsoft. Is this possible and can I monitor the status of their updates?
0
Comment
Question by:steveLaMi
  • 3
  • 2
5 Comments
 
LVL 19

Expert Comment

by:PeteJThomas
ID: 34866005
Slightly off the actual question here, but have you considered site based policy as opposed to an OU based policy?

All I mean is, link the WSUS policy (that points the 'site' to it's respective WSUS server) to the Site in Active Directory Sites & Services. That way, whether or not a client machine goes to one WSUS server or the other will be determined by the subnet it's logging in from, and should therefore always look to the WSUS server that is local to it's current location.

That is how we stop our 'roaming' laptop users from picking up WSUS updates from across our WAN when they're away from their 'home' site.

Does that help, or do you specifically need a way to force these machines to update from the web for another reason entirely?

Pete
0
 

Author Comment

by:steveLaMi
ID: 34866077
It looks when they designed the network they used the same subnet for both locations. However, the IP scheme is different. One is 192.168.0.x and the other 192.168.1.x but both with 255.255.255.0
0
 
LVL 19

Accepted Solution

by:
PeteJThomas earned 500 total points
ID: 34866316
Ok then, you're correct, and a Sites based GPO will not work for you. Though it should be noted that for sites at 2 separate locations (with a WAN in between) that is not ideal, as clients at either physical site could end up authenticating to a domain controller that's at the other site over the WAN, which will make for a slower authentication process...

But that's a different issue - For your laptops to update via MS, you simply need to DISABLE the setting "Specify Intranet Microsoft Update Service Location". If disabled, AU will automatically look to the Windows Update site on the web for updates.

So separate your laptops into a different OU, configure the Updates settings as normal, but just disable the setting I mentioned... You'll still want to configure the behaviour using the "Configure Automatic Updates" setting etc as well.

HTH

Pete
0
 

Author Comment

by:steveLaMi
ID: 34866794
Pete,

Thank you for your help. I did notice that they do have a seperate site for that location and it's DC in sites and services. Hopefully this is what is preventing them from authenticating from a wrong DC. I am going to dig into that further tomorrow. As for the WSUS, thanks again, I am going to use that method.
0
 
LVL 19

Expert Comment

by:PeteJThomas
ID: 34868992
Ah ok that's good, there must be something differentiating between the 2 sites after all! Definitely worth looking into though, especially if you notice slow log ons etc.

Also, that does bring my original comment back into the fold, with Site assigned GPOs managing WSUS settings - Obviously it's your choice as to your preference, but if it is just a case of not wanting the laptops to update over the WAN, site assigned GPOs would accomplish this, with the added benefit of keeping your laptops updating via WSUS, and therefore you're back in control of the updates they receive and can monitor everything etc.

In my eyes that's preferable, and simple to implement (without the need to separate your laptops into a different OU), as all you need to do is have 2 GPOs that point to each WSUS server, and link them to the 2 sites you have defined, instead of linking them to any OUs...

But as I say, whatever you prefer! :)

Pete
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: http://www.codetwo.com/backup-for-office-365/ (http://www.codetwo.com/ba…

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now