WSUS - Best Practice for MAT

[jonnykewell1]

Good Morning everyone,

 

I am currently doing some research into WSUS and best practice for our Multi Academy Trust and figured i'd reach out to Edugeek to see how other Academy Trusts manage it across their sites. I have some questions that i've put together and wondered if you could share your thoughts?

 

Do you have a central WSUS server that deploys to your sites and have you considered it?

Do you just have a WSUS server per site?

Do you cache the updates to your local server or do you pull them directly from the internet?

How do you have your automatic-approval rules configured, Do you have a test classroom / machine that runs the updates first?

Do you have a specific person who regularly checks to ensure it's working and managed properly and consistent?

 

Any other insights or ideas about best practice would be welcomed.

 

Kind regards,

 

Jonny

[3s-gtech]

Our situation is similar but not totally comparable, may be useful though.

 

Central WSUS server

Yes, running as a node

Cached

No automatic approvals other than Defender and Malicious Software Tool

I check it regularly as I manually approve

 

Waiting for @mavhc to come in and tell you that WSUS is dead, peer caching is the future with direct updates. He may be right, but I don't think so yet.

[jonnykewell1]

Thanks for this @3s-gtech , your current setup sounds like the sort thing that I have in mind.

[mavhc]

It's not dead, it's just resting. Look at all the new features! https://docs.microsoft.com/en-gb/archive/blogs/wsus/

 

Depends on what machines you have available, and time to keep them working, vs bandwidth at each site.

 

When I had <100Mbit connections I had 1 central server, and then others set to read the data from the central server, so caching proxies basically

[Duke5A]

Good Morning everyone,

Do you have a central WSUS server that deploys to your sites and have you considered it?

Do you just have a WSUS server per site?

Do you cache the updates to your local server or do you pull them directly from the internet?

How do you have your automatic-approval rules configured, Do you have a test classroom / machine that runs the updates first?

Do you have a specific person who regularly checks to ensure it's working and managed properly and consistent?

 

Any other insights or ideas about best practice would be welcomed.

 

Kind regards,

 

Jonny

 

I run one WSUS instance that caches updates for about 1500 workstations across seven sites. The sites are connected via Gig private fiber, so no worries about having a downstream WSUS install on each site. Security updates are set for auto approval as I don't have time to do testing of any sort (one man shop).

 

I haven't seen a WSUS install out of the box that hasn't needed tweaks done to it's application pool in IIS. The application pool process will keep crashing until raise the limits on resources it's allowed to consume. Been an issue in Server 2016 and Server 2019, might even go back farther to be honest. Can't remember which settings, but can look it up on my install if you need.

[ITGURU]

why does the pool need changing? I've always just used it straight out the box

[3s-gtech]

It’ll work, but the console tends to crash a lot. Changing the pool ups the reliability massively.

[ITGURU]

It’ll work, but the console tends to crash a lot. Changing the pool ups the reliability massively.

what do you change?

[3s-gtech]

https://www.404techsupport.com/2016/03/21/iis-wsus-private-memory/