How to Configure Windows Server Update Services (WSUS)
After the WSUS installation, we can configure the Windows Server Update Services WSUS server through WSUS Server configuration wizard. This is a one-time configuration where we will configure some important WSUS options.
Configure Windows Server Update Services
1- Select Tools and then select WSUS Server Configuration wizard.
Note – Before you begin the configuration of WSUS, some important points.
Make sure the server firewall allows the clients to access the WSUS server. If clients have issues connecting to WSUS server, updates wouldn’t be downloaded from server.
The WSUS downloads the updates from upstream server which is Microsoft update in our case. So please ensure that the firewall allows the WSUS server to connect to Microsoft Update.
In case if there is a proxy server in your organization, you should type the credentials for proxy server while configuring WSUS.
2- Click Next.
3- Click Next.
Choose WSUS Upstream Server
This is the important section where we select the upstream server. You get two options.
Synchronize from Microsoft Update – After Selecting this option will download the updates from Microsoft update.
Synchronize from another Windows Server Update Services server – Select this option if you want this WSUS server to download updates from already existing WSUS server. We should specify the server name & the port number (8530) by default. If you want to select the option to use SSL during updates synchronization, make sure that upstream WSUS server is also configured to support SSL.
4- This is the only WSUS server; I will choose Synchronize from Microsoft Update and then click Next.
Proxy Server
5- Specify Proxy server information if you have got one and then click Next.
6- Select Start Connecting button.
7- Once completed, click next.
Choose Languages for Updates
8- Select Download updates only in these languages options. Select the languages for which you want updates and then click next.
Choose Products
9- This is the window where we can select the products for which we want the updates. From the list of products, we can select individual products or product families for which we want our server to synchronize updates. In my case, I will select Windows Server 2019 and Windows 10 1903. Click Next.
Choose Update Classifications
10- Select the required classifications. I am going to select Critical Updates, Security Updates, and Update Rollups. Click Next.
Configure WSUS Synchronization Schedule
11- We should decide on how to perform WSUS sync. Select whether to perform synchronization manually or automatically. Click Next.
12- Select checkbox Begin initial synchronization and then click next.
13- Select Finish, this completes the steps to configure WSUS.
14- Here you can see synchronization status.
WSUS CONSOLE
15- The summary of updates.
16- We have not approved any updates yet, Select All updates.
17- Under source select any and then click refresh.
18- After hitting Refresh button and we will be able to see all updates.
19- Here in this list of all updates there is no way for me to kinda select update and say, deploy right now to machines that are not how WSUS works. What we need to do is approve the update by right-clicking the update and then select Approve.
20- We can’t see any computer/server listed here.
Create WSUS Groups
By default there are 2 WSUS groups.
All Computers: this group registers computer accounts when they contact to the WSUS server and this group you should not populate manually
Unassigned computers: this group is not assigned to other groups by the WSUS Administrator.
1- Select options and then select Computers.
2- I will choose the second setting Use Group Policy or registry settings on computers.
3- To create a new group, right-click on All Computers and then select Add Computer Group.
4- I am going to create only one group Windows10 because I have only one Windows to test WSUS. You can create groups as per your requirements. You can type in whatever name you like and click Add.
5- Here you can see the group (Windows10)
WSUS Group Policy Management
It will give me the abilities to use group policy to assign the correct machines into this group. I am going to open GPO group policy management console in the domain controller and have a look at the different OU’s. I have moved one client machine with windows 10 in Windows10 OU.
1- Select Tools and then Group Policy Management.
2- Now we need to create a new GPO and then will link it to Windows10 OU. Right click on Windows10 OU and select Create a GPO in this domain…..
3- Type GPO name and click ok.
Here is the GPO, once it’s configured and attached, we need to edit the GPO so we can look at, first the specific group policy setting that we will go about configuring the client-side targeting here for WSUS.
4- Right click on GPO name and then select Edit.
5- Select Computer Configuration > Polices > Administrative Templates Policy > Windows Components.
6- Select Windows Update, On your right side, double click on Specify intranet Microsoft update service location policy.
7- Select enable, Here We will type WSUS server name and the port number (8530) that is used for the clients to attach. Click ok
8- Double click to open Configure Automatic Updates policy.
9- Select enable, configure automatic update, schedule install day, and scroll down for more settings.
10- Configure the schedule options and then click ok.
11- Double click on Enable client-side targeting policy.
12- Select enable, type group name and then click ok.
13- We need to run these 3 commands on client machines to update group policy.
gpupdate /force
wuauclt /resetauthorization /detectnow
wuauclt /reportnow
14- We can also verify the intranet update service location on the client computers using Windows registry. In the client computer, open Registry Editor and open “HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate”.
Here you can confirm WSUS values (WUServer and WUStatusServer)
15- Now go back to WSUS server console and press refresh button I will be able to see machines attached to my WSUS server (Windows10).
16- Select All updates, under status select failed or needed and then right click on update you want to install, select approve.
17- Under computer group, right click on your windows/server and then select approved for install.
18- Click ok.
19- The updates will now be made available, and then next time that client hits that maintenance interval we’ve configured in group policy, it’ll go about downloading, installing, and perhaps rebooting the PC in order to support the installation of this Windows update.
Configure Auto Approval Rules in WSUS
If you don’t want to approve updates manually, we can configure auto approval rule in Windows Server Update Services.
To configure Automatic Approvals in WSUS
1- WSUS Administration Console, choose Options and then select Automatic Approvals.
2- Here you can find the default automatic approval rule and if you want it you can edit it and use it. Select New Rule to create a new approval rule.
3- Select when an update is in a specific classification checkbox. Select the classifications. You can also permit the update for computers groups. I am going to choose Windows 10 as that is my test PC group. Last you can set a deadline for the update approval & specify auto approval rule name.
After you configure the rule, click OK.
4- You may find the rule the one you have just created. Select Run Rule If you wish to run this rule.
WSUS Custom View, Reporting and Troubleshooting
Create Custom view
1- To create a new update view, right-click on updates and then select New Update View.
2- Here you can select what you want to include in the view. I am selecting Updates for a specific product. Step 2 Select any product.
3- In the step 2, we can click on any product link and select which product we need to include. I will choose Windows 10, click ok.
4- Specify a name and select ok.
5- The new view is available in the list under Updates. Select it and change the status to any you will be able to see only updates for Windows 10.
Server Cleanup Wizard
1- Select options and select Server Cleanup Wizard.
2- Here we can select what to remove. I will choose everything click next.
3- Begin the process.
4- Click finish.
Configure Windows Server Update Services REPORTING
1- Double click on any update.
2- We need to install Microsoft Report Viewer, here you can find the link to download and install Microsoft Report viewer.
Microsoft SQL Server 2012 CLR Types
3- Double click on download exe fine to began the installation. Click next.
4- Accept license and click next.
5- Click install.
6- Click finish.
7- Double click on any update it will generate an ad hoc report.
8- You can see a description of the update, the approval summary, the status summary.
REPORTS NODE
9- Select reports and then select Computer Detailed Status.
10- Click Run the Report
11- First page shows you the computer, and then the 2nd page will show you the updates for that computer.
