How to Setup WSUS on 2003/2008/2008 R2 Server

[cookie_monsta]

ermm Hi....me again....

 

WSUS is (if you havent gathered already) very very new to me..

 

I have machines reporting in WSUS.... and even placed them in a group called ARH...

 

however laptops (set of 12 toshiba laptops) i have switched on today....arent appearing in the unassigned groups....i have waited about 3 hours...

 

did a gpupdate /force on both the laptops and server....nothing...

 

only 1 of the 12 has appeared...

 

however...i have 2 laptops that arent on any lists in WSUS....receiving updates..... #bizarre

 

any ideas where or what im doing wrong?

 

Thanks in advance

 

Cookie

Edited September 23, 2011 by cookie_monsta

[Michael]

Save this as WSUS.bat and run it on the affected machines. If you're clever about it, set it as a Startup script to run once.

 

@echo off
TITLE Logistix WSUS Reset Authorisation
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stops the wuauserv service
Echo 2.    Deletes the AccountDomainSid registry key (if it exists)
Echo 3.    Deletes the PingID registry key (if it exists)
Echo 4.    Deletes the SusClientId registry key (if it exists)
Echo 5.    Restarts the wuauserv service
Echo 6.    Resets the Authorization Cookie
Echo 6.    More information on [url]http://msmvps.com/Athif[/url]
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

[edutech4schools]

Install the Microsoft Report Viewer Redistributable 2008 (2MB)

 

Should we go for the 2010 version?

[sted]

Should we go for the 2010 version?

 

for wsus no point really unless you have a n other app that needs it

[Gaga]

Hello Michael,

 

Is there a way I can point my clients to the Wsus server with having to do it with GPO's. I work in an environment where I have limited access to AD and Group Policy management. I was hoping to figure out a way to have my 10 other Windows 2003 Servers to talk to the Wsus without having to GPOs.

 

Your post was very helpful.

 

Adam

[sted]

gpedit locally can do it

you can create a reg file that does it

[Michael]

Hello Michael,

 

Is there a way I can point my clients to the Wsus server with having to do it with GPO's. I work in an environment where I have limited access to AD and Group Policy management. I was hoping to figure out a way to have my 10 other Windows 2003 Servers to talk to the Wsus without having to GPOs.

 

Your post was very helpful.

 

Adam

 

If you import the below reg file, this should allow you to use WSUS without using GPOs:

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://SERVERNAME"
"WUStatusServer"="http://SERVERNAME"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:0000000a
"DetectionFrequencyEnabled"=dword:00000001
"DetectionFrequency"=dword:00000001
"AutoInstallMinorUpdates"=dword:00000001
"IncludeRecommendedUpdates"=dword:00000000
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RebootRelaunchTimeout"=dword:00000078
"RescheduleWaitTimeEnabled"=dword:00000001
"RescheduleWaitTime"=dword:0000003c
"UseWUServer"=dword:00000001

[Michael]

Should we go for the 2010 version?

 

In my testing the Microsoft Report Viewer Redistributable 2010 didn't work with WSUS 3 SP2.

 

I would however recommend the Microsoft Report Viewer Redistributable 2008 SP1 which you can download here

[Michael]

Manage WSUS from a Workstation

 

Requirements: Windows XP SP3, Windows Vista or Windows 7

 

Additional requirements: A 2003, 2008 or 2008 R2 server with WSUS 3.0 SP2 already setup/configured.

 

For your reference, even if you have a 64Bit server running 2008 R2 and a 32Bit Windows 7 workstation, this method will still work. It simply means you're running an x64 version of WSUS on your server and an x86 version of the console on your workstation. There is no difference in the software and/or its options/tools. This may sound obvious, but I have been asked similar questions before!

 

On your workstation:

 

Download/install Report Viewer 2008 SP1 here first.

 

Download/install WSUS 3.0 SP2 here (x86 or x64)

 

When you run Setup, choose Administration Console only

 

You can now access Windows Server Updates Services on Administrative Tools. When you run it first time, you'll be prompted for the SERVERNAME and Port.

 

Enter your SERVERNAME, you don't need the FQDN. If you've installed WSUS using default settings (on your server) leave the port as 80 and leave SSL unticked. Click on Connect and you can now manage WSUS from your workstation. You have access to all tools, just as you would on the server itself.

 

I've used this method for years, but I thought I'd share as I didn't include it with setting up WSUS guides.

[Gaga]

Thanks Michael. I did it through the local group policy. It works Awesome.

 

Cheers,

[TechSupp]

Dragging this back up again, sorry. I had set up a WSUS server (ran dhcp, ad, etc etc) that worked just fine untill the server itself started playing up so we had a new server to run AD, DHCP ect except WSUS. We had the old server demoted from a domain controller to a plain old PC running Server 2003, now the question is can I still run WSUS on the PC running Server 2003 and have the WSUS group policy manage the clients on the new 2008 R2 server? Trying to fix the original 2003 install at the moment but cant figure out if its truly broken or not possible to run it in this way or not which is why it wont play ball?

[Davit2005]

It is poss to have WSUS on a completely different server not a DC. It is then possible to setup the basic settings within group policy and get the clients pointing to computer groups. It is also possible to override the client targeting for particular OU's by just changing the targetted group if necessary :-)

 

On a connected note, Anyone know how to point SCCM to a different WSUS if WSUS has broken? Cheers

[Michael]

You can install WSUS on a DC or Member Server.

 

You can of course setup GPOs so workstations know where to download updates and when to apply updates, but WSUS by default will place computers in the Unassigned group. To my knowledge, there isn't a GPO to specify which group computers should go into.

 

All is not lost however. Once computers have reported to WSUS, you can then move them into groups you've created in WSUS, and then target updates accordingly.

 

Targetting is useful for testing purposes, but also for very large networks with 1000+ workstations. Using a combination of different GPOs, different sets of workstations would/could update at different times. This can be a lot of work initially, but BITS delivers updates intelligently, keeping network traffic as low as possible.

[plexer]

You can apply wsus groups via gpo.

 

Ben

[TechSupp]

Well, managed to breathe life in to the WSUS server again and I can confirm now that a WSUS server can be on its own and the clients can be told where it is via our DC server GPO, very happy now! Funny how little things like that keep you going. My main problem was getting the original install uninstalled, had to use the MS cleanup utility to get rid of it then reinstall it. Clients started replying to it fairly quickly as well after it was synchronised. Happy bunny now.

[Michael]

You can apply wsus groups via gpo.

 

Ben

 

Which GPO allows you to do this? Please share, as it's something that could prove useful!

[Michael]

Well, managed to breathe life in to the WSUS server again and I can confirm now that a WSUS server can be on its own and the clients can be told where it is via our DC server GPO, very happy now! Funny how little things like that keep you going. My main problem was getting the original install uninstalled, had to use the MS cleanup utility to get rid of it then reinstall it. Clients started replying to it fairly quickly as well after it was synchronised. Happy bunny now.

 

Glad you got it all sorted. WSUS is definitely worth setting up. I've started work on a new network recently with no WSUS whatsoever, so god knows yet how out-of-date everything is! Frightening to find networks like this

[Michael]

@plexer - Are you referring to the following GPO:

 

Computer Config > Policies > Admin Templates > Windows Components > Windows Update - Enabled - Enable client-side targetting?

 

So if I specify a target group, will it actually move the computer object in WSUS to that group, or will it just tell the workstation to read information from that target group? It's not very clear.

[MYK-IT]

@plexer - Are you referring to the following GPO:

 

Computer Config > Policies > Admin Templates > Windows Components > Windows Update - Enabled - Enable client-side targetting?

 

So if I specify a target group, will it actually move the computer object in WSUS to that group, or will it just tell the workstation to read information from that target group? It's not very clear.

 

The computer object will be moved into the corresponding WSUS Computer Group.

The computer group will also be created automatically if it does not already exist.

[Michael]

Thanks! I'll certainly have to try this out!

[edutech4schools]

Following the instruction at the start of this thread it goes over automatic approvals. Do the automatic approvals just apply to all computers including any in the unsigned computers folder? or only computers that have been moved out of this folder?

[SHimmer45]

you can set auto approval rules for "all pcs" or specific groups of machines you moved them into different folders, just by adding or editing the rules and clicking the specific groups you want.

[Mcshammer_dj]

My system has 7 groups with a combination of auto approval and no approval. This allows me to test on some test VM's before rolling to all networks

[jdell]

I have followed your 2008 instructions and have managed to set the WSUS up and its downloaded all of the updates I need however no PC's sho up in the manger I have made the GPO and it is working on the client PC as there settings have all cahnged to reflect the GPO. However I still see no PC's.

 

To explain the system I may be missing a trick so this might help ;

 

2003 R2 DC's x 2

WSUS is installed on a member server 2008 Enterprise.

All client PC's are Xp or 7.

GPO is on the forest root and is applied to all PC's and is as you stated.

 

On client PC's if you try and run windows update is gives a red cross and an error.

 

Any ideas what I am doing wrong

 

Thank you in advance.

[Michael]

It can take a number of hours to download all updates. By looking on the WSUS homepage, you can see the progress.