Pointing Clients to Wsus on Windows 2003 Server

[Gaga]

Hello Everyone,

Is there a way I can point my clients to the Wsus server without having to do it with GPO's. I work in an environment where I have limited access to AD and Group Policy management. I was hoping to figure out a way to have my 10 other Windows 2003 Servers to talk to the Wsus without having to GPOs.

Your answers would be very helpful,
Adam

[pete]

If domain-wide group policies don't specify WSUS settings (or windows update settings), then whatever you set in local group policy (using gpedit.msc) as a local admin will stick. Be aware you won't be able to override domain-wide settings that are explicitly set to something.

To achieve the same in Regedit, add or edit:

HKLM\Software\Policies\Microsoft\Windows\Windows\WindowsUpdate\WUServer

and

HKLM\Software\Policies\Microsoft\Windows\Windows\WindowsUpdate\WUStatusServer

with a value of http://wsus.domain.whatever or https://wsus.domain.whatever

[Gaga]

Thank you for the quick response Pete. I just checked on gpedit.msc and I do NOT have the regitry entries. I will go ahead and create them and see what happens.
Actually, I do have the entries on the Server that hosts Wsus but not the clients. Did you mean that also clients must have these entries?

Adam

[pete]

Thank you for the quick response Pete. I just checked on gpedit.msc and I do NOT have the regitry entries. I will go ahead and create them and see what happens.
Actually, I do have the entries on the Server that hosts Wsus but not the clients. Did you mean that also clients must have these entries?

Adam

Any machine that should be pulling updates from your chosen WSUS server needs those settings. (The WSUS server always sets itself to update from itself).

To check where (if anywhere) your machines have been getting patches from, look in c:\windows\windowsupdate.log

[Gaga]

Awesome. I'll try that.

Thanks again Pete

[Gaga]

I fixed it. The problem was with IIS' authentication settings. Here is what I did.


"Check in the IIS Manager to see what authentication type is enabled on the directories that are part of the WSUS Server. Windows Integrated Authentication needs to be enabled on the "SimpleAuthWebService", "Content", "ClientWebService", "ReportingWebService" and the "SelfUpdate" folders. After correcting this, all my clients are making successful connections and downloading approved updates, as well as reporting to the server that the client exists and is using the Windows Server Update Services server."

Source: VerifyWUServerURL() failed with hr=0x800710dd - WSUS Support Forums

I hope this helps other people in the future.

Adam