Information Systems:Windows Update and WSUS - Revision history

Gurneetk: /* Approve and deploy WSUS updates */

2022-06-30T22:37:45Z

Approve and deploy WSUS updates

Gurneetk at 19:37, 30 June 2022

2022-06-30T19:37:34Z

Norwinu: Norwinu moved page Information Systems:Microsoft Windows Update to Information Systems:Windows Update and WSUS

2021-07-13T06:01:53Z

Norwinu moved page Information Systems:Microsoft Windows Update to Information Systems:Windows Update and WSUS

Norwinu: /* Feature Updates */

2021-07-13T06:01:01Z

Feature Updates

Norwinu: /* WSUS Computer Groups */

2021-07-13T05:59:36Z

WSUS Computer Groups

Norwinu: Add more info.

2021-07-13T05:54:41Z

Add more info.

Norwinu: Add category

2021-07-13T05:31:12Z

Add category

Norwinu: Norwinu moved page Information Systems:Windows Updates to Information Systems:Microsoft Windows Update

2021-07-13T05:30:01Z

Norwinu moved page Information Systems:Windows Updates to Information Systems:Microsoft Windows Update

Norwinu: Create article

2021-07-13T05:29:51Z

Create article

New page

==Overview==
uniPHARM has enough PCs and servers to warrant centralized management where possible. WSUS is used to achieve this centralized management for Windows updates. [[Information Systems:WSUS|Refer to this article]] for a good overview to WSUS administration written by a previous sysadmin (however, some things have changed since). This page discusses in greater detail various topics related to configuration and implementation.

==Topics==
===Windows Updates and Group Policy===
Computers are instructed to use WSUS for updates (instead of Microsoft servers as is the default) through Group Policy. The behavior is highly configurable - for example, there's a setting to specify how many days before a user is prompted to restart in a situation where user activity has prevented the machine from performing a scheduled restart. These settings are grouped together in 1 (or maybe 2) GPOs that should be intuitively identifiable by name e.g. ''C_Windows Update Settings''. The intended settings are summarized as follows:

* Updates are scheduled to download and install every night at a specific time (currently 11pm).

* Updates that do not require a reboot nor disrupt any services are installed automatically.
* All restart notifications are suppressed.

===WSUS Computer Groups===
Within WSUS

===WSUS Reporting===
In addition to acting as a central repository for Windows Update, WSUS also provides reporting. That is, the clients report to WSUS on their Windows Update state. States include Downloaded, Pending Install, Pending Reboot. WSUS can then display or generate reports on the proportion of clients that have received a particular update, along with other metrics.

So far, it seems that the call-home behavior (PCs reporting to WSUS) is infrequent, somewhat unpredictable, and difficult to influence. Some clients provide an update to WSUS after a reboot. The best approach seems to be to just have faith in its operation - as the clients seem to eventually call home - but to monitor clients that haven't called home in a while. Inactivity also appears to influence (i.e. stall) the call-home. Unused machines should be remoted into once in a while and the Check for Updates function should be performed manually.

===Feature Updates===
Feature updates are major update packages that often involve new features. They are distributable via WSUS and have their own categorization.

====Enablement Packages====

===Delivery Optimization===
A new feature in Windows 10 is Delivery Optimization, which allows PCs to download updates from other PCs on the LAN (even PCs over WAN, but this does not apply to us). This is to ease the burden on the WSUS server. Delivery Optimization has been enabled via Group Policy, but is currently being monitored for any issues. This feature does not really need to be used, as our LAN is fairly small and therefore the WSUS server can deploy.

==Issues and Additional Notes==
* Regarding Windows Updates and Group Policy setting, there is a concept in Windows known as the maintenance period, which is a range after-hours (default is 2AM but can be tuned through Group Policy) where Windows can perform maintenance duties. Windows Update can be set to install during the maintenance period, but this has been disabled.

@@ Line 20: / Line 20: @@
 ===Approve and deploy WSUS updates===
 When you open Windows server and update services (WSUS) application, click on Updates. Under the updates, it will display - All updates, Critical updates, Security Updates, WSUS updates, Upgrades and Approved for Desktop.
-In the list of updates, select the updates that needs approval for installation. Right click and approve it if you think it is beneficial for the environment. Right click and decline if the update is not beneficial or unnecessary. You can check that by reading on the KB article number. In the approved updates dialog box, click Approved for Install. You an also set a deadline to install the updates, then Click OK. The Approval Progress window will appear and that shows the progress of the tasks that affect update approval. When the approval process is complete, click Close.
+In the list of updates, select the updates that needs approval for installation. Right click and approve it if you think it is beneficial for the environment. Right click and decline if the update is not beneficial or unnecessary. You can check that by reading on the KB article number. In the approved updates dialog box, click Approved for Install. You an also set a deadline to install the updates, then Click OK. The Approval Progress window will appear and that shows the progress of the tasks that affect update approval. When the approval process is complete, click Close. For the approved update, if it is required to revert back due to bug or malfunction, you can use "Approved for removal" to remove or uninstall an already-installed update.
 ===WSUS Reporting===

← Older revision		Revision as of 19:37, 30 June 2022
Line 17:		Line 17:

	Computers added to the domain get added to the group '''Unassigned Computers''' and need to be re-categorized to be eligible for updates that the other computers receive. Group Policy can implement client-side targeting for automatic categorization depending on OU, but this has yet to be thought out or implemented.		Computers added to the domain get added to the group '''Unassigned Computers''' and need to be re-categorized to be eligible for updates that the other computers receive. Group Policy can implement client-side targeting for automatic categorization depending on OU, but this has yet to be thought out or implemented.
		+
		+	===Approve and deploy WSUS updates===
		+	When you open Windows server and update services (WSUS) application, click on Updates. Under the updates, it will display - All updates, Critical updates, Security Updates, WSUS updates, Upgrades and Approved for Desktop.
		+	In the list of updates, select the updates that needs approval for installation. Right click and approve it if you think it is beneficial for the environment. Right click and decline if the update is not beneficial or unnecessary. You can check that by reading on the KB article number. In the approved updates dialog box, click Approved for Install. You an also set a deadline to install the updates, then Click OK. The Approval Progress window will appear and that shows the progress of the tasks that affect update approval. When the approval process is complete, click Close.

	===WSUS Reporting===		===WSUS Reporting===

@@ Line 28: / Line 28: @@
 ====Upgrade strategy====
 The unofficial policy is to hold off on updating to the latest version, instead keeping 1 behind (this seems to be a common practice). Feature updates are notorious for introducing critical, showstopping issues. For example, the 20H2 update caused a bootloop and file system corruption on the older Thinkpad T420s and T430s machines being used for remote work (COVID WFH), rendering the machines completely unusable.
 ====Enablement Packages====

@@ Line 14: / Line 14: @@
 ===WSUS Computer Groups===
-Within WSUS, computers can be grouped, and updates can be set to install for certain groups only. The current groups reflect our basic needs: Desktops, Servers, Test Desktops, Test Servers. There used to be a group for each department but that was utterly pointless and misguided.
+Within WSUS, computers can be grouped, and updates can be set to install for certain groups only. The current groups reflect our basic needs: Desktops, Servers, Test Desktops, Test Servers. There used to be a group for each department but that was utterly pointless and misguided. These concept behind these groups is simple - group-targeting for update packages.
 ===WSUS Reporting===

← Older revision		Revision as of 05:31, 13 July 2021
Line 29:		Line 29:
	==Issues and Additional Notes==		==Issues and Additional Notes==
	* Regarding Windows Updates and Group Policy setting, there is a concept in Windows known as the maintenance period, which is a range after-hours (default is 2AM but can be tuned through Group Policy) where Windows can perform maintenance duties. Windows Update can be set to install during the maintenance period, but this has been disabled.		* Regarding Windows Updates and Group Policy setting, there is a concept in Windows known as the maintenance period, which is a range after-hours (default is 2AM but can be tuned through Group Policy) where Windows can perform maintenance duties. Windows Update can be set to install during the maintenance period, but this has been disabled.
		+
		+	[[Category: Windows Updates]]

@@ Line 1: / Line 1: @@
 ==Overview==
-uniPHARM has enough PCs and servers to warrant centralized management where possible. WSUS is used to achieve this centralized management for Windows updates. [[Information Systems:WSUS|Refer to this article]] for a good overview to WSUS administration written by a previous sysadmin (however, some things have changed since). This page discusses in greater detail various topics related to configuration and implementation.
+uniPHARM has enough PCs and servers to warrant centralized management where possible. WSUS is used to achieve this centralized management for Windows updates. [[Information Systems:WSUS|Refer to this article]] for a good overview to WSUS administration written by a previous sysadmin (however, some things have changed since).
 ==Topics==
-===Windows Updates and Group Policy===
+===Windows Update and Group Policy===
-Computers are instructed to use WSUS for updates (instead of Microsoft servers as is the default) through Group Policy. The behavior is highly configurable - for example, there's a setting to specify how many days before a user is prompted to restart in a situation where user activity has prevented the machine from performing a scheduled restart. These settings are grouped together in 1 (or maybe 2) GPOs that should be intuitively identifiable by name e.g. ''C_Windows Update Settings''. The intended settings are summarized as follows:
+Computers are directed to use WSUS for updates (instead of Microsoft servers as is the default) through Group Policy. The behavior is highly configurable - for example, there's a setting to specify how many days before a user is prompted to restart in a situation where user/machine activity has prevented the computer from performing a scheduled reboot. These settings are grouped together in 1 (or maybe 2) GPOs that should be intuitively identifiable by name e.g. ''C_Windows Update Settings''. The intended settings are summarized as follows:
 * Updates are scheduled to download and install every night at a specific time (currently 11pm).
 * Updates that do not require a reboot nor disrupt any services are installed automatically.
 * All restart notifications are suppressed.
 ===WSUS Computer Groups===
 ===WSUS Reporting===
@@ Line 20: / Line 22: @@
 ===Feature Updates===
 Feature updates are major update packages that often involve new features. They are distributable via WSUS and have their own categorization.
 ====Enablement Packages====
 ===Delivery Optimization===