Chapter 10 – Windows Update & WSUS

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 10 – Windows Update & WSUS

Learning Objectives

Configure Windows Update and Windows Server Update Services (WSUS) using Group Policy for enterprise environments.

1. GPO Path

Computer Configuration → Administrative Templates → Windows Components → Windows Update

2. Windows Update Overview

Windows Update delivers quality, security, driver, and feature updates. Enterprises typically manage updates with WSUS or Microsoft cloud services.

3. What is WSUS?

WSUS allows administrators to download, approve, and deploy Microsoft updates from an internal server, reducing Internet bandwidth and providing update control.

4. Configure Automatic Updates

Choose update behavior such as Auto download and schedule install, Notify only, or Allow local admin to choose.

5. Specify Intranet Microsoft Update Service

Configure the WSUS server URL (for example: http://wsusserver:8530) for update detection and statistics reporting.

6. Client-Side Targeting

Assign computers to WSUS computer groups automatically using Group Policy.

7. Delivery Optimization

Configure peer-to-peer download behavior, bandwidth limits, and caching to reduce WAN usage.

8. Recommended Enterprise Settings

Enable automatic updates, use WSUS for production, schedule installation outside business hours, enable restart notifications, and test updates before broad deployment.

9. PowerShell

Get-WindowsUpdateLog
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
Get-Service wuauserv

10. Useful Commands

gpupdate /force
gpresult /h report.html
wuauclt /detectnow (legacy)
wuauclt /reportnow (legacy)

11. Troubleshooting

Verify WSUS URL, confirm DNS resolution, check Windows Update service, review Event Viewer, inspect WindowsUpdate.log, verify GPO application, and reset SoftwareDistribution if necessary.

12. Best Practices

Approve updates in stages, maintain pilot groups, synchronize regularly, decline superseded updates, back up WSUS, and monitor update compliance.

13. Interview Questions

What is WSUS? Difference between Windows Update and WSUS? Explain client-side targeting. How do you troubleshoot clients not receiving updates?

14. Practical Lab

Deploy a WSUS GPO, configure the intranet update service, run gpupdate /force, start a scan with UsoClient StartScan, and verify update reporting.

Common WSUS Policies

Policy

Recommendation

Purpose

Configure Automatic Updates

Enabled

Central update control

Specify intranet Microsoft update service

Enabled

Use WSUS server

Enable client-side targeting

Enabled

Assign WSUS groups

No auto-restart with logged on users

Enabled

Reduce user disruption

Automatic Updates detection frequency

Configured if needed

Scan interval

Allow non-admin notifications

As required

User awareness

Delivery Optimization

Configured

Bandwidth savings

Feature update deferral

Organization policy

Controlled rollout

Microsoft Learn References

Manage Windows Updates

Windows Server Update Services (WSUS)

Windows Update Group Policy Settings

Delivery Optimization

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more