gshaw Posted January 28, 2010 Posted January 28, 2010 At the moment I'm just using WSUS for clients as I didn't want any chance of servers auto rebooting (I know the policy suppresses most but it seems some updates might over-rule that setting?) Anyways I was thinking of going to WSUS for servers as well but just wondering what way you have yours set up? As it stands I made a Computer Group for workstations and use GPO targeting to get them in there When I approve updates I usually approve them for that group only (rather than All Computers), maybe I should've gone for All Computers with hindsight actually I like to have the separate Groups for ease of management as the WSUS console is crowded at the best of times So if I add another group for Servers, what's the best way to re-approve the updates that need to go on there? Would it be view all updates then Approve to everything or is there another method?
ZeroHour Posted January 28, 2010 Posted January 28, 2010 One thing to remember is to break up your servers auto reboot policies (if you decide to use them) into one per dc. I wish wsus could stagger reboots on servers but the only way I can see how to do it is to make a fresh GP/setup each server to reboot at different times. I use wsus for some servers here internally but not all.
timzim Posted January 28, 2010 Posted January 28, 2010 (edited) Put servers in a separate group and set policy not to auto-reboot. Don't auto approve though - test ALL updates before approving...we didn't test the IE8 upgrade properly and ended up with entire suites of unuseable computers. Gaaah! Edited January 28, 2010 by timzim I am an idiot and can't read posts properly
gshaw Posted January 28, 2010 Author Posted January 28, 2010 (edited) For our teaching ones I just push out critical updates via SMS and don't rock the boat until half \ summer breaks... especially important on our machines as one program button out of place would mean bad things for training courses! As for reboots... anyone remember "no more reboots for software" when XP was released... looks like the future never quite made it! Edited January 28, 2010 by gshaw
pete Posted January 28, 2010 Posted January 28, 2010 Servers auto-download patches I approve, but I install manually. Server patches don't get deadlines set either. (Deadline forces the install regardless if it's after the deadline). Snapshot a couple of test vms, install patches and let it percolate for a bit. Check on the mailing lists and forums to ensure the patch doesn't do anything adverse. Provided all is well it gets pushed out to other servers.
FN-GM Posted January 28, 2010 Posted January 28, 2010 Its all done manually. We then have total control then.
DMcCoy Posted January 28, 2010 Posted January 28, 2010 Mine are set to download only. R2 still happily schedules an install time and reboots for some updates however
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now