How to Setup WSUS on 2003/2008/2008 R2 Server

[cookie_monsta]

If you open up Group Policy Management, expand the menu on the left, then look for 'Group Policy Objects'.

This lists all GPOs in your domain. Locate the GPO you wish to add settings to, right click it and navigate to 'GPO Status'.

Make sure 'Computer Configuration Settings Disabled' is not ticked, otherwise Ccomputer Configuration should be listed.

Hi again Michael,

i have found trhe above as suggested.... and i can confirm the 'Computer Configuration Settings Disabled" is not ticked.

However can you advise where i look or goto for "To enable your workstations to report to your WSUS server, navigate to Computer Config > Policies > Admin Templates > Windows Components > Windows Update"

im on the server.... no probs...looked in WSUS...cant find the above..... getting a lttle lost now..

any advise (other that finding a new profession? lol)

Many thanks in advance..

Cookie

[Michael]

On the same policy you right clicked, right click it again and select 'Edit', then on the left expand:

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update

Enable/Disable the policies as required.

[cookie_monsta]

On the same policy you right clicked, right click it again and select 'Edit', then on the left expand:

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update

Enable/Disable the policies as required.

Cool!! i found eveything.!!! and turns out the WSUS in GPO had already been configured.

Only difference was the server name section... the guide says http://SERVERNAME however i've got http://SERVERNAME:8530 in there...

Ive approved a load of updates etc in WSUS....

however its still informing me that no machines have connected

How do i rectify this?

cheers once again

[Michael]

It just means WSUS (when it was originally installed) wasn't put in the default IIS Site. If you did, then it should just read http://SERVERNAME

As for your workstations, it can take upto 90 minutes (default Group Policy behaviour), or alternatively a reboot can force the update through quicker.

If this still doesn't work, then it's difficult for me to say without knowing more about your Active Directory structure.

[cookie_monsta]

wish this was a straight forward as this should be......good job i shave my head otherwise id be pulling my hair out lol

after checking the WSUS console (or Update Services window as i see on the screen) i highlighted the server and in the middle panel under TO DO is says the following:
"Your WSUS server currently shows that no computers are registered to receive updates"

i have ran gpupdate /force on the server as well as my workstation (running Vista business with SP2) and it still not reporting on WSUS

in terms of the computers within AD, they are listed in one group, then into sub division of the type (i.e. interactive white board and Key Stage group).

The WSUS GPO is at the top of the tree so it should be pushed out to all machines....

cheers again

[Michael]

From what you're saying, yes the policy should be picked up. The best advice I can offer is to create a separate OU and a new policy, then move your workstation object (in AD) into it and experiment with the settings.

[cookie_monsta]

Finally got machines to report to WSUS!!!!

thank you Michael for all your help.... youve been a superstar!!

Now to search the forums for help on creating users ids for the kids via powershell...

and hopefully something in GPO to stop the kids from changing the resolution and stopping screen rotation....... ideas or links are always welcome

[cookie_monsta]

2. You'll have 1 update not approved. It usually catches me out when I've managed to approve an update for some, but not all computers that need it. Double click on one of the 99% machines and scroll through the report to find which update it is and then approve it.

Did this work for anyone?

In WSUS, my Vista machine is showing 100% complete (other XP sp3 machines are showing 98% or 99% complete) however my machine is constantly now telling me there is an update available...

and its always Windows Malicious Removal tool - July 2010 (KB890830) .... and according to the history is installs successfully..... then minutes later it tell me there is another update available Windows Malicious Removal tool - February 2011 (KB890830 again this installs successfully.

But, minutes later again it tells me that july 2010 version is ready for installtion.

i have approved this update many times in WSUS.....and its getting annoying now...

any firm fix for it out there?

Thanks in advance

Cookie

[Davit2005]

Be carefull with Automatic Approval unless you are going to test first. There's nothing worse than an update causing problems or killing all your workstationsn thru a conflict with an app or driver.

[cookie_monsta]

Be carefull with Automatic Approval unless you are going to test first. There's nothing worse than an update causing problems or killing all your workstationsn thru a conflict with an app or driver.

I know what your saying....

our updates are firstly approved at the city council level and then we download them from their approved list on their WSUS server....

i hope they test them first etc...

[cookie_monsta]

ermm Hi....me again....

WSUS is (if you havent gathered already) very very new to me..

I have machines reporting in WSUS.... and even placed them in a group called ARH...

however laptops (set of 12 toshiba laptops) i have switched on today....arent appearing in the unassigned groups....i have waited about 3 hours...

did a gpupdate /force on both the laptops and server....nothing...

only 1 of the 12 has appeared...

however...i have 2 laptops that arent on any lists in WSUS....receiving updates..... #bizarre

any ideas where or what im doing wrong?

Thanks in advance

Cookie

[Michael]

Save this as WSUS.bat and run it on the affected machines. If you're clever about it, set it as a Startup script to run once.

@echo off
TITLE Logistix WSUS Reset Authorisation
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stops the wuauserv service
Echo 2.    Deletes the AccountDomainSid registry key (if it exists)
Echo 3.    Deletes the PingID registry key (if it exists)
Echo 4.    Deletes the SusClientId registry key (if it exists)
Echo 5.    Restarts the wuauserv service
Echo 6.    Resets the Authorization Cookie
Echo 6.    More information on http://msmvps.com/Athif
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

[edutech4schools]

Install the Microsoft Report Viewer Redistributable 2008 (2MB)

Should we go for the 2010 version?

[sted]

Should we go for the 2010 version?

for wsus no point really unless you have a n other app that needs it

[Gaga]

Hello Michael,

Is there a way I can point my clients to the Wsus server with having to do it with GPO's. I work in an environment where I have limited access to AD and Group Policy management. I was hoping to figure out a way to have my 10 other Windows 2003 Servers to talk to the Wsus without having to GPOs.

Your post was very helpful.

Adam