WSUS assistance - Downloading and installing only on demand

[ITPonds]

Hi

I am implementing WSUS and would like some ideas. I have installed WSUS on a 2012 R2 box with a test group of PCS. I have now been requested to only have workstations download updates then install out of hours I am strugling to get this to work.. WSUS seems to download approved updates when the 'detection frequency' occurs but I can't risk any workstation at all performing this in 'office hours' the only way I can think of doing this is to set the Automatic updates GPO option to Option 2, Notify of download and notify of install. Then roll out a scheduled task to run a script on each client that downloads and installs as per the scheduled task time. I attempted this but my scripting skills aren't the best! Does anyone have any ideas or have come across this scenario? I would say this is quite similar to what most schools/colleges do for the servers also.

Any sample scripts would be great also..

Thanks - Mark

[Domino]

It's doable with just the GPO settings.

 

For instance the settings below will install updates at the time listed when they're released. Manually releasing updates means you can be sure the day the reboot will happen.

 

[ITPonds]

But if a batch of updates are approved doesn't the clients download when the GPO detection frequency occur? The main priority is that I need to ensure the clients do not download updates during the day at any point. Even if the detection frequency is at the maximum which is at 22 hours there is still a risk that a computer may fall out of sync if you know what I mean and the frequency kicks in during day time.. I may be mistaken..

[LeMarchand]

It's doable with just the GPO settings.

 

Do you need to do anything with the power settings to achieve this? Would be a lot easier that my thoughts about waking them up at weekends for updates.

[ITPonds]

Yeah, well I was thinking of waking them with a scheduled task shortly before initiating a download and install. Do you know any scripts that can check, download and install ?

[Domino]

Why is the downloading of updates an issue? They'll only install at the given time, but it'll mean they're staged and ready.

 

WSUS doesn't appear bandwidth heavy from our experience.

[LeMarchand]

I've checked my GPO and it already had the "Enable Wake Up" policy set. I think I need to do a power option so that they only hibernate - or is that the default?

 

Not worried about when the updates are downloaded. but it's a PITA if a child reboots a machine and then has to wait an age for it to apply updates during school hours.

[Domino]

I think you can disable the "restart and install updates option" -then they should only install in the configured time frame?

[LeMarchand]

I think you can disable the "restart and install updates option" -then they should only install in the configured time frame?

 

I've just been through all the options and think they're set to achieve what I want. It's never easy the way MS describe these things! In my case, I don't think the machines are being woken up (as they are on "full" shutdown?). Will have to play some more!

[Domino]

I don't think it does a WOL for shutdown machines, only for sleep or hibernate.

 

A scheduled WOL from another product might be an option, or have the machines sleep

[LeMarchand]

I don't think it does a WOL for shutdown machines, only for sleep or hibernate.

 

A scheduled WOL from another product might be an option, or have the machines sleep

 

Last time I tried I couldn't WOL from Shut Down (IIRC) so I think fiddling with the power options is what I need to do. Will try mid week.

[ITPonds]

Hey Domino, we have one or two sites were the link is quite slow so I don't want to risk any machines downloading during school time and taking up all the bandwidth. I may be being over cautious but it's happened before unfortunately, it'd give me piece of mind If i know the clients are only downloading 'out of hours'