Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to configure a GPO that will allow the members of an OU to get Updates from the WSUS server

Posted on 2013-06-10
6
Medium Priority
?
792 Views
Last Modified: 2013-06-11
I'm a member of the domain admins group in a windows 2008 R2 domain, and would like to configure a GPO so that the members of an OU receives its updates from the WSUS server. However, when I log on to the DC as the domain admin and open the group policy management console I do not see any templates related WSUS. How can I create a new GPO within the domain that is linked an OU so that the members of the OU receives their MS updates from the WSUS server?
0
Comment
Question by:cheyliger
6 Comments
 
LVL 84

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 1600 total points
ID: 39236670
I've used this for years

wsus.bat

@============ START Script Code===========
@echo off
::
Echo Save the batch file as "WSUS.bat". This batch file will do the following:
Echo 1.    Stops the Automatic Update Service (wuauserv) service.
Echo 2.    Imports WUA settings for workstations in workgroup to detect/download/install updates from WSUS.
Echo 3.    Starts the Automatic Update Service (wuauserv) service.
Echo 4.    Force update detection.
Echo 5.    More information on http://msmvps.com/Athif
REM INSTRUCTIONS:
REM Place both the files (WSUS.reg and WSUS.bat) in same location (single folder)
REM Double-click WSUS.bat to import WSUS.reg which contains Windows Update Agent (WUA) settings. 
REM for WUA in a workgroup environment. In this sample, WSUS.reg and WSUS.bat 
REM are placed in 'c:\'.

REM Author:- Mohammed Athif Khaleel :- Date April 30, 2006
Pause
Net Stop "wuauserv"
Echo Importing WSUS.reg
%windir%\Regedit.exe /s C:\WSUS.reg
Echo WSUS.reg imported succesfully
Net Start "wuauserv" 
Echo Forcing update detection
wuauclt /detectnow
Pause

Open in new window


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://SERVER2008R2:8530"
"WUStatusServer"="http://SERVER2008R2:8530"
"TargetGroupEnabled"=dword:00000001
"TargetGroup"="IT Department"
"ElevateNonAdmins"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:0000000a
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"AutoInstallMinorUpdates"=dword:00000001
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RebootRelaunchTimeout"=dword:0000003c
"RescheduleWaitTimeEnabled"=dword:00000001
"RescheduleWaitTime"=dword:0000000f
"DetectionFrequencyEnabled"=dword:00000001
"RebootWarningTimeoutEnabled"=dword:00000001
"RebootWarningTimeout"=dword:0000001e
"UseWUServer"=dword:00000001
"NoAUShutdownOption"=dword:00000000
"NoAUAsDefaultShutdownOption"=dword:00000000

Open in new window

0
 
LVL 80

Assisted Solution

by:arnold
arnold earned 400 total points
ID: 39236671
Windows update settings are under the computer configuration, administrative templates, windows components, windows update.
There is intranet URL and client target.
Which mode is your wsus setup GPO/registry or you have to move clients into their group on the WSUS?

http://technet.microsoft.com/en-us/library/cc720539(v=ws.10).aspx

I breakup the update settings
Top level define the Intranet URL

Each OU then gets the client targeting, and update settings.
0
 
LVL 84

Accepted Solution

by:
David Johnson, CD, MVP earned 1600 total points
ID: 39236685
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 47

Expert Comment

by:Donald Stewart
ID: 39237862
"How to configure a GPO that will allow the members......" ???


WSUS policies are computer based, not user based
0
 

Author Comment

by:cheyliger
ID: 39239244
Arnold, your link works fine too but Ve3ofa (link from Petri) was more concise is more relevant in windows 2008 R2. In addition I will be looking more closely at script which he also provided.
0
 
LVL 80

Expert Comment

by:arnold
ID: 39239686
A GPO sets all the parameters within the registry such that no script that modify the registry are needed and I've found that modifying registry under some circumstance prevents the application of a GPO that tries to make changes to those registry entries.
i.e. you setup a GPO to alter the intranet URL, but you previously made the registry changes to point to an intrante URL.  The one set by GPO on a system will change the next time the GPO refresh occurs. The one manually set may not change at all as it is fixed and not GPO dependent even if it references the same information as the prior version of the GPO.

As to the point assignment.  Thanks for the explanation, but none was needed. It is completely up to the asker to assign points as they determine which was helpful to them in resolving/addressing their issue.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes how to set permissions to allow a limited-permissions user to start and stop a particular System Service.   It is always best to give users only the permissions that they need to perform their job, so tweaking particular permi…
Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question