Information Systems:Windows Update and WSUS

This page discusses in greater detail various topics related to Windows Update and WSUS. The intended audience includes administrators of WSUS or anyone generally curious about its implementation at uniPHARM.

Overview

uniPHARM has enough PCs and servers to warrant centralized management where possible. WSUS is used to achieve this centralized management for Windows updates. Refer to this article for a good overview to WSUS administration written by a previous sysadmin (however, some things have changed since).

Topics

Windows Update and Group Policy

Computers are directed to use WSUS for updates (instead of Microsoft servers as is the default) through Group Policy. The behavior is highly configurable - for example, there's a setting to specify how many days before a user is prompted to restart in a situation where user/machine activity has prevented the computer from performing a scheduled reboot. These settings are grouped together in 1 (or maybe 2) GPOs that should be intuitively identifiable by name e.g. C_Windows Update Settings. The intended settings are summarized as follows:

• Clients are pointed to the local WSUS server to check and download Windows Updates.
• Updates are scheduled to download and install every night at a specific time (currently 11pm).
• Updates that do not require a reboot nor disrupt any services are installed automatically.
• All restart notifications are suppressed.

WSUS Computer Groups

Within WSUS, computers can be grouped, and updates can be set to install for certain groups only. The current groups reflect our basic needs: Desktops, Servers, Test Desktops, Test Servers. There used to be a group for each department but that was utterly pointless and misguided. These concept behind these groups is simple - group-targeting for update packages.

Computers added to the domain get added to the group Unassigned Computers and need to be re-categorized to be eligible for updates that the other computers receive. Group Policy can implement client-side targeting for automatic categorization depending on OU, but this has yet to be thought out or implemented.

Approve and deploy WSUS updates

When you open Windows server and update services (WSUS) application, click on Updates. Under the updates, it will display - All updates, Critical updates, Security Updates, WSUS updates, Upgrades and Approved for Desktop. In the list of updates, select the updates that needs approval for installation. Right click and approve it if you think it is beneficial for the environment. Right click and decline if the update is not beneficial or unnecessary. You can check that by reading on the KB article number. In the approved updates dialog box, click Approved for Install. You an also set a deadline to install the updates, then Click OK. The Approval Progress window will appear and that shows the progress of the tasks that affect update approval. When the approval process is complete, click Close.

WSUS Reporting

In addition to acting as a central repository for Windows Update, WSUS also provides reporting. That is, the clients report to WSUS on their Windows Update state. States include Downloaded, Pending Install, Pending Reboot. WSUS can then display or generate reports on the proportion of clients that have received a particular update, along with other metrics.

So far, it seems that the call-home behavior (PCs reporting to WSUS) is infrequent, somewhat unpredictable, and difficult to influence. Some clients provide an update to WSUS after a reboot. The best approach seems to be to just have faith in its operation - as the clients seem to eventually call home - but to monitor clients that haven't called home in a while. Inactivity also appears to influence (i.e. stall) the call-home. Unused machines should be remoted into once in a while and the Check for Updates function should be performed manually.

Feature Updates

Feature updates are major update packages that often involve new features. They are distributable via WSUS and have their own categorization.

Upgrade strategy

The unofficial policy is to hold off on updating to the latest version, instead keeping 1 behind (this seems to be a common practice). Feature updates are notorious for introducing critical, showstopping issues. For example, the 20H2 update caused a bootloop and file system corruption on the older Thinkpad T420s and T430s machines being used for remote work (COVID WFH), rendering the machines completely unusable.

Communication can be sent out to the staff if new features are to be expected. Release of feature updates should also be thoroughly tested prior.

Enablement Packages

Enablement packages are a special delivery method for feature updates. The gist is that Microsoft is already releasing code that is part of the next feature update in its monthly quality updates. Therefore, if a computer is up to date with these quality updates (which they should be if WSUS is properly administered), then computers will be eligible for the enablement package, which is a very small package that essentially enables all the new code that has previously been installed on the computer. Also, only 1 reboot is necessary for the feature update when it is installed via an enabled package. This as opposed to the regular feature update download which is many GBs in size and takes a long time to install.

Keep in mind the following regarding Enablement Packages:

• Approve both the Enablement Package and the full Feature Update.
• Computers will specify themsleves whether they can take the Enablement Package or need the full update. That's why the previous point of approving both is important.

Delivery Optimization

A new feature in Windows 10 is Delivery Optimization, which allows PCs to download updates from other PCs on the LAN (even PCs over WAN, but this does not apply to us). This is to ease the burden on the WSUS server. Delivery Optimization has been enabled via Group Policy, but is currently being monitored for any issues. This feature does not really need to be used, as our LAN is fairly small and therefore the WSUS server can deploy.

Issues and Additional Notes

• Regarding Windows Updates and Group Policy setting, there is a concept in Windows known as the maintenance period, which is a range after-hours (default is 2AM but can be tuned through Group Policy) where Windows can perform maintenance duties. Windows Update can be set to install during the maintenance period, but this has been disabled.