WSUS server advice

[Halfmad]

Hi guys,

 

I'm just curious, had some problems with windows updates applying that we dont' want at the moment and looking for a way of controlling it.

 

We've got 50+ Server 2003 domains scattered across many, many buildings, some with 10Mb connections, others just on 1Mb broadband.

 

What I was hoping to do was have a central WSUS server that could control the updates for all sites, is that feasable (at least in theory?)

 

The alternative as I see it is to have the local domain server handle WSUS, only problem I see there is having to monitor/manage 50+ servers as the domains are all separate.

[powdarrmonkey]

What I was hoping to do was have a central WSUS server that could control the updates for all sites, is that feasable (at least in theory?)

 

That's exactly what WSUS is designed for. It will fetch the appropriate updates from Microsoft, wait for you to approve them, and then distribute them to the machines as you specify. Takes a few hours to fetch the first cache, but you only have to do that once.

 

As you have so many sites and domains, I would have strategically placed child servers in your WSUS topology, much as you would have multiple domain controllers, to minimise bandwidth (each caches, so slow links are more efficient).

[dhicks]

That's exactly what WSUS is designed for. It will fetch the appropriate updates from Microsoft, wait for you to approve them, and then distribute them to the machines as you specify. Takes a few hours to fetch the first cache, but you only have to do that once.

 

Hmm, the WSUS server I've just set up reckons it's going to be a week downloading updates...

 

--

David Hicks

[Halfmad]

That's exactly what WSUS is designed for. It will fetch the appropriate updates from Microsoft, wait for you to approve them, and then distribute them to the machines as you specify. Takes a few hours to fetch the first cache, but you only have to do that once.

 

As you have so many sites and domains, I would have strategically placed child servers in your WSUS topology, much as you would have multiple domain controllers, to minimise bandwidth (each caches, so slow links are more efficient).

 

Cheers mate, thought I'd be able to but was a tad worried about bandwidth, guess it doesn't matter either way where the server is as it'll have to do it either locally or via our internal networks which both work over the same connections obviously.

 

When I've got time I might actually get 5mins to sit down and organise the whole thing, before my boss turns it into a project that lands on my desk

[Michael]

As already mentioned, WSUS does exactly that - allows you to specify what product(s) and also what type of updates you want to apply (hotfixes, security updates, service packs etc). You can also schedule the downloads to happen over night so it won't affect slower internet connections (especially 1Mbps) during the day.

 

In an ideal world you need one server which synchronises with Microsoft (this should be your fastest connection or where the most machines are located). Child servers need to be setup at the weaker points (where internet connections are 1Mbps) - so the updates are distributed within your LAN which would normally be 100Mbps or 1000Mbps.

 

In the longterm, I would then eventually (budget providing) have a WSUS server at each site so the update process is fully managed and controlled. The spec for WSUS isn't too high, but (generally speaking) the more machines you have, the more power you'll need. If you're clever about it, you could also specify groups of machines to "check in" to their local WSUS server at certain times to minimise load.

Edited September 18, 2008 by Michael

[ricki]

HI

 

Have a look at this How to Cheat at Managing Windows ... - Google Book Search

 

Its got loads of information that you might find helpful

 

Richard