We help IT Professionals succeed at work.

How to add manually downloaded files to WSUS and use it in workgroup isolated area.

Omar Soudani
Omar Soudani asked
on
163 Views
Last Modified: 2018-12-12
Hello all,

I have multiple computers in a workgroup environment (50 PCs) all not connected to the internet. I have downloaded the updates and I have the execution files, the question is can I use WSUS to push the updates to all PCs? How do I add the downloaded updates to WSUS.
Comment
Watch Question

Shaun VermaakSenior Consultant
CERTIFIED EXPERT
Awarded 2017
Distinguished Expert 2019

Commented:
No, you need to let WSUS download its own files and those can be pushed via WSUS by Configuring update registry values ons those workgroup computers
David Johnson, CDSimple Geek from the '70s
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
updates from wsus is a pull operation not a push operation. The simplest way is to create a registry file and merge the file

Step 1: Create a *.reg file (wsus-client.reg) containing this:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate] 
"AcceptTrustedPublisherCerts"=dword:00000001 
"ElevateNonAdmins"=dword:00000001 
"TargetGroup"="Workstations" 
"TargetGroupEnabled"=dword:00000000 
"WUServer"="http://your-WSUS-server:port" 
"WUStatusServer"="http://your-WSUS-server:port"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU] 
"AUOptions"=dword:00000004 
"AUPowerManagement"=dword:00000001 
"AutoInstallMinorUpdates"=dword:00000001 
"DetectionFrequency"=dword:0000000a 
"DetectionFrequencyEnabled"=dword:00000001 
"IncludeRecommendedUpdates"=dword:00000001 
"NoAUAsDefaultShutdownOption"=dword:00000001 
"NoAUShutdownOption"=dword:00000001 
"NoAutoRebootWithLoggedOnUsers"=dword:00000001 
"NoAutoUpdate"=dword:00000000 
"RebootRelaunchTimeout"=dword:0000000a 
"RebootRelaunchTimeoutEnabled"=dword:00000001 
"RescheduleWaitTime"=dword:0000000a 
"RescheduleWaitTimeEnabled"=dword:00000001 
"ScheduledInstallDay"=dword:00000000 
"ScheduledInstallTime"=dword:00000003 
"UseWUServer"=dword:00000001

Open in new window


Step 2: Edit the lines:
-
 "WUServer"="http://your-WSUS-server:port"; and 
- "WUStatusServer"="http://your-WSUS-server:port"; 
to match the IP address (or FQDN) of your WSUS server. IMPORTANT: remove the ";" from the end of that lines!

Examples: 
"WUServer"=" http://WSUS.company.com:81 " 
"WUStatusServer"=" http://WSUS.company.com:81 "

"WUServer"=" http://192.168.0.1 " 
"WUStatusServer"=" http://192.168.0.1 "

"WUServer"=" http://intranet.local:8080 " 
"WUStatusServer"=" http://intranet.local:8080 "

The first key is named WUServer. This registry key holds a string value which should be entered as the WSUS server’s URL.

By default, in Windows Server 2012, WSUS 4.0 uses port 8530. However, WSUS 3.0 uses port 80, by default 
(How to Determine the Port Settings Used by WSUS - https://technet.microsoft.com/en-us/library/bb632477.aspx)

The other key that you will have to change is a string value named WUStatusServer. The idea behind this key is that the PC must report its status to a WSUS server so that the WSUS server knows which updates have been applied to the PC. The WUStatusServer key normally holds the exact same value as the WUServer key.

Open in new window


Source: https://community.spiceworks.com/how_to/2267-deploy-wsus-to-clients-without-ad-domain-gp-using-the-registry

See the source for a remove-wsus.reg and further reading
Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT
Top Expert 2015

Commented:
There is a way to integrate existing downloaded packages into WSUS, but it is tedious, and for MS Windows Updates just not worth the effort.

Set up WSUS so it does not approve updates automatically,
apply to all clients what a group policy would do in a domain (the stuff David posted), with some changes as you like,
and  wait for at least two days, until enough machines have reported to WSUS.
Then approve what you want to get installed.
Machines being online should get the updates within the next two days after the update has been completed downloading.

You can try to force clients to report/check/download updates "immediately", but only on the machine itself:
net stop wuauserv
net start wuauserv
REM pre-W10:
wuauclt /detectnow
REM W10:
UsoClient /StartScan

Open in new window

This doesn't work all the time, though.
Senior Consultant
CERTIFIED EXPERT
Awarded 2017
Distinguished Expert 2019
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions