Information Systems:Windows Update and WSUS

From uniWIKI
Revision as of 22:31, 12 July 2021 by Norwinu (talk | contribs) (Add category)
Jump to navigation Jump to search

Overview

uniPHARM has enough PCs and servers to warrant centralized management where possible. WSUS is used to achieve this centralized management for Windows updates. Refer to this article for a good overview to WSUS administration written by a previous sysadmin (however, some things have changed since). This page discusses in greater detail various topics related to configuration and implementation.

Topics

Windows Updates and Group Policy

Computers are instructed to use WSUS for updates (instead of Microsoft servers as is the default) through Group Policy. The behavior is highly configurable - for example, there's a setting to specify how many days before a user is prompted to restart in a situation where user activity has prevented the machine from performing a scheduled restart. These settings are grouped together in 1 (or maybe 2) GPOs that should be intuitively identifiable by name e.g. C_Windows Update Settings. The intended settings are summarized as follows:

  • Updates are scheduled to download and install every night at a specific time (currently 11pm).
  • Updates that do not require a reboot nor disrupt any services are installed automatically.
  • All restart notifications are suppressed.

WSUS Computer Groups

Within WSUS

WSUS Reporting

In addition to acting as a central repository for Windows Update, WSUS also provides reporting. That is, the clients report to WSUS on their Windows Update state. States include Downloaded, Pending Install, Pending Reboot. WSUS can then display or generate reports on the proportion of clients that have received a particular update, along with other metrics.

So far, it seems that the call-home behavior (PCs reporting to WSUS) is infrequent, somewhat unpredictable, and difficult to influence. Some clients provide an update to WSUS after a reboot. The best approach seems to be to just have faith in its operation - as the clients seem to eventually call home - but to monitor clients that haven't called home in a while. Inactivity also appears to influence (i.e. stall) the call-home. Unused machines should be remoted into once in a while and the Check for Updates function should be performed manually.

Feature Updates

Feature updates are major update packages that often involve new features. They are distributable via WSUS and have their own categorization.

Enablement Packages

Delivery Optimization

A new feature in Windows 10 is Delivery Optimization, which allows PCs to download updates from other PCs on the LAN (even PCs over WAN, but this does not apply to us). This is to ease the burden on the WSUS server. Delivery Optimization has been enabled via Group Policy, but is currently being monitored for any issues. This feature does not really need to be used, as our LAN is fairly small and therefore the WSUS server can deploy.

Issues and Additional Notes

  • Regarding Windows Updates and Group Policy setting, there is a concept in Windows known as the maintenance period, which is a range after-hours (default is 2AM but can be tuned through Group Policy) where Windows can perform maintenance duties. Windows Update can be set to install during the maintenance period, but this has been disabled.
Retrieved from "https://owl.unipharm.com/mediawiki/index.php?title=Information_Systems:Windows_Update_and_WSUS&oldid=13978"