WSUS

[itgeek]

Hi,

 

We have an old unmanaged wsus server that is still active. I want to deploy a new wsus server on our new 2019 box. Has anyone done this and will I need to migrate the files (I don't want to) or can I just spin up a new server and then change the location the computers are pointing to?

 

Thanks

[willtech]

I usually spin up a new server and change the gpo to point to the new server.

[3s-gtech]

No need to migrate, if you don't want to. Make sure you have the categories fairly tight so it doesn't download everything (mine only downloads on approval).

[jezi55]

Just recently done this (server died so re-built 2019), just change your GPO settings to reflect new server, download the correct definitions as 3s-gtech recommends and you should be good to go!

[eddyc]

Just recently done this (server died so re-built 2019), just change your GPO settings to reflect new server, download the correct definitions as 3s-gtech recommends and you should be good to go!

 

I also recently did this and jumped to Server 2022 in the process. Dare I say it, the server actually seems to respond in a timely manner.

[Koldov]

can I just spin up a new server and then change the location the computers are pointing to?

 

Yes (I've done this a couple of times - even put it on a VM once). As has been mentioned, keep your 'Products and Classifications' small and work up until you are sure you're getting everything you need, download and deploy only on approval, keep doing a weekly 'Server Cleanup Wizard'.

 

Then once you are happy, change the GPO to point to the new server for a test selection, then roll out and you should be golden!

[robjduk]

Just to add if I may (not affiliated btw) I bought a copy of AJTek's WSUS maintenance software. It costs next to nothing and tidies the database every night. I think my WSUS is around 200mb nowadays because let's be honest, the built-in tools just don't really work. Worth checking out...

 

https://www.ajtek.ca/

[MartinT]

Seconded for the AJTek maintenance software if you don't want the server to grow in size until it eats all of the available space.

[DaveTheTech]

Echoing the comments above, Keep on top of the clean up tasks.

Out of curiosity, does WSUS run better when used with SQL?

 

I had more luck using PS scripts to run the clean up, rather than the inbuilt tool.

 

I also had a approve updates for those needed in this container.

So I could approve needed updates for IT, Pilot group, workstations and then laptops, which we ran during half term.

Edited June 27, 2022 by DaveTheTech

[Koldov]

Is the AJTek script $60 per year?

 

I'm no WSUS guru for sure and so I'm always looking to improve the WSUS server (for free) and recently looked into a few things and why completely random updates keep hanging around (for years)...

 

From here (old post and mainly relating to W7/2008R2 SP1 systems so might not all be relevant):

 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/b02c04ef-a8ae-4568-aaff-fe182e854b29/wsus-declining-superseded-updates?forum=winserverwsus

 

Something interesting to note:

 

*VALID* updates are never deleted.

 

What WSUS considers as valid is a bit more complicated I think....

 

The Server Cleanup Wizard does not do that. The SCW declines superseded updates, only if:

 

The newest update is approved, and

The superseded updates are Not Approved, and

The superseded update has not been reported as NotInstalled (i.e. Needed) by any computer in the previous 30 days.

 

[sNIP]

 

At a minimum, the WSUS Admin must manually remove approvals from superseded updates so they will be eligible for declination by the Server Cleanup Wizard. (Note: As long as the WSUS Admin is removing the approval, it's trivial to go ahead and decline the update instead. The only advantage to using the SCW is that you also ensure a newer update is approved and that no client system is still reporting that update as needed.)

 

It seems there doesn't appear to any mechanism natively in WSUS to 'unapprove' or decline superseded updates and SCW needs that to remove them.

 

Looking at the wording:

 

1) Delete updates that are 'expired' and have not been 'approved' for 30 days or more and delete older update revisions that have not been approved for 30 days or more.

 

2) Delete update files that aren't needed by updates (see point 1 for why they won't be deleted).

 

3) Decline updates that aren't approved (see point 1) and have been expired by Microsoft (things like 'bad' updates I guess?).

 

4) Decline updates that have not been approved for 30 days or more, are not currently needed by any clients and are superseded by an approved update...

 

Seems quite likely that SCW is actually NEVER going to clean-up much.... for some reason...

 

Also mentioned here:

 

https://social.technet.microsoft.com/Forums/en-US/24a1f880-61ff-459f-ac87-ffcf464eed91/how-to-delete-decline-update-from-wsus-server?forum=winserverwsus

 

is a PS script which I have amended with the suggestion in the final post:

 

[reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null

# Run From LocalHost
$updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer()

$updateServer.GetUpdates() | ForEach-Object {
   if (($_.IsSuperseded -eq $true) -and ($_.IsApproved -eq $true)) {
           $_.Decline()
           $title = $_.Title           
           Write-Host "Declining update: $title"
   }
}

$cleanupManager = $updateServer.GetCleanupManager()

$scope = New-Object "Microsoft.UpdateServices.Administration.CleanupScope"
$scope.CleanupUnneededContentFiles = $true

$result = $cleanupManager.PerformCleanup($scope)

$space = $result.DiskSpaceFreed

Write-Host "Freed $space bytes."

 

I thought I would run it on the off-chance it would do some good (and reading through the code thought it at least wouldn't do much damage) and it deleted an embarrassing amount of stuff the Clean-Up Wizard hadn't for whatever reason. YMMV & UAYOR obviously!

 

It has ignored anything without a 'superseded' marker and there are still a few Office updates from as far back as 2015 hanging around (we are using Office 2016 though) and some other Windows updates from previous years for some reason (I might be brave and decline them manually though as I'm thinking as long as I've got the latest CU/SSU what else would I need?).

 

I have actually toyed with the idea of choosing the options to not store the files locally at all and let them use WU (I'm presuming everything else would still work the same, so not actually sure what benefit there is having them on the local network if there were only a small (ish) amount of machines and had a decent internet connection?)....

[DaveTheTech]

$approvedupdates = Get-WsusUpdate -UpdateServer $WSUSserver -Approval Approved -Status InstalledOrNotApplicableOrNoStatus
$superseded = $approvedupdates | ? {$_.Update.IsSuperseded -eq $true -and $_.ComputersNeedingThisUpdate -eq 0}

 

I have the above for the conditions to remove unneeded updates. I suppose running the above would not remove any updates that are still needed. Where as the posts above would?

[Koldov]

$approvedupdates = Get-WsusUpdate -UpdateServer $WSUSserver -Approval Approved -Status InstalledOrNotApplicableOrNoStatus
$superseded = $approvedupdates | ? {$_.Update.IsSuperseded -eq $true -and $_.ComputersNeedingThisUpdate -eq 0}

 

I have the above for the conditions to remove unneeded updates. I suppose running the above would not remove any updates that are still needed. Where as the posts above would?

 

Yes, there was a discussion about that... the author seemed to think that it was negated by the fact that the update in question would have been superseded and therefore that 'should' mean that it is no longer needed (the superseding update should have replaced it).

Edited June 28, 2022 by Koldov

[DaveTheTech]

Ah gotcha, that makes sense.

Thanks for explanation

[robjduk]

Is the AJTek script $60 per year?

 

Yes thats the one. Bloody magic software.

[KK20]

Have you thought about not putting WSUS back and migrating to a WUFB instead? Ive recently taken the plunge and have a couple of IT labs doing WUFB on a test for a few months. So far so good, I intend decommissioning the WSUS by the end of this year. We are W10 though so im not going to have a way of testing a feature update with it.

[Koldov]

I have recently migrated my WSUS to a VM and this time round made some changes.

 

I cleaned up our WSUS and chose to have updates delivered by WU instead of hosting the update files locally. I installed the WSUS role on the Hyper-V machine and set it to be a downstream server of our main WSUS and let it sync overnight (not sure how long it took but it was irrelevant), then changed it after the sync to be a main WSUS server. Changed the GPOs (we use item level targeting) to point to the new WSUS and am just waiting for the last few computers to register before removing the old WSUS instance (though not really necessary).

 

This means there is minimal impact to the server in terms of storage and as I will be releasing updates manually (no auto-approval due to the last few messed up CUs) I can release to certain OUs to ensure the network isn't swamped (small school so I doubt that would happen anyway).

 

As far as I can tell now, the only benefit WUfB has, is being able to deliver updates outside of the school network (which although tempting isn't really an issue) and although it has been mentioned elsewhere about WUfB being able to detect driver issues once fully paired with creating an Azure and using Update Compliance etc. I wasn't really up for doing all that just to go WUfB but I felt I need more control than just a few GPOs to manage it so I remained with WSUS.

Edited July 6, 2022 by Koldov