How to install & configure WSUS in Windows Server 2016

 Thank to: https://askme4tech.com

Before install WSUS

Before start the installation of WSUS you must decide how you will Plan the WSUS Deployment.

It's recommended to read the article from Microsoft Docs Plan your WSUS Deployment

WSUS use the port 443 and https protocol. 

If you don't want to allow Internet Access in the WSUS Server you must allow the following URL in your firewall

 

How to install WSUS

The installation of WSUS Role it's easy without complexity

So let's start

  • Open Server Manager
  • Click Manage -- Add Roles & Features
  • Click Next

 

  • Keep the default settings and click Next.

 

  • If you don't have add other Server in Server Manager just leave the default and click Next. Unless select the local Server and click Next.

 

  • Check the Windows Server Update Services and at the same time click Add Features.

 

  • Click Next

 

  • Once again Next without Add any Feature

 

  • Click once again Next. It's just steps that proceed to finish the installation of WSUS.

 

  • Don't change anything for the Role Services of the Web Server and click Next.

 

  • Windows Server Update Services Wizard. Just click Next

 

  • We don't need the option Sql Server Connectivity.

 

  • You must select if you want to store the Windows Updates local in your Server or not

 

  • Let's explain the difference here.
    • If you store the Windows Updates local the endpoints will download quicker the Windows Updates from the WSUS
    • If you will not store the Windows Updates in your Server you save disk space but need more time the endpoints to download the Windows Updates from the WSUS.
  • If you decide to store the Windows Updates it's recommended to create a separate partition.
  • Take your decision and click Next. In my Scenario i choose to store the Windows Updates and gave the path.

 

  • Click Install and wait until finish. 

 

How to configure WSUS

After finish the installation of the WSUS then you must configure the WSUS Server using Configuration Wizard.

This is one time configuration wizard that you must do before start using WSUS. 

  • Open the Server Manager 
  • Click in the Flag
  • Click Launch-Post Installation Task

 

If you skip it by mistake then you can launch it from WSUS Server Console

  • From the Server Manager click Tools -- Windows Server Update Services

 

  • Expand the Server Name. In my scenario is WSUS
  • Select Options.
  • From the right side click WSUS Server Configuration Wizard

 

  • In the first step click Next.

 

  • Click Next again

 

  • Keep the default option Synchronize from Microsoft Updates.

 

  • Specify proxy information if you have got one. Unless click Next without change anything.

 

  • Click Start Connecting  to Connect in Upstream Server.

 

  • Specify the Language for your Windows Updates.

 

  • Specify the products that you want to update. I select Windows Server 2012 , Windows Server 20016 and 2019.

 

  • Specify the type of the Windows updates to download. 

 

  • Configure when you want to synchronize the WSUS with the Windows Updates.

 

  • Check the Begin initial synchronization.Click Next

 

  • Click Finish.

 

  • You can see the Synchronization Status from the Console

Until finish the synchronization let's go to create the Group Policies to deploy the Windows updates in the Endpoints that you would like.

 

How to configure Group Policy for WSUS

The last step after finish the Installation and Configuration of WSUS is to create a Group Policy for the WSUS.

In the Group Policy configure from which Server will request the Windows Updates the Endpoint.

  • Create a new Group Policy
  • Go in  Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update.
  • Edit the Configure Automatic Updates with any of the options that match in your environment. In this scenario i select 3 - Automatic download and notify for install and 0-Every Day

 

  • Edit the Specify intranet Microsoft update service location. You must enter the URL of the intranet server which is in type of http:<fqdn>:8350

 

  • Now Apply the GPO in every Organization Unit which include the Endpoints that will be receive Windows Updates from WSUS
  • Once apply the GPO in the Endpoints you will be ask how can identify that the GPO apply and it's sure that the Endpoint will retrieve Windows Updates from WSUS?
  • One way is to open Server Manager - - Local Server
  • Verify that in the Windows Updates says Download Windows updates only using managed updating service

 

  • The other way is to open the registry
  • Go in HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate.

 

 

How to configure WSUS Computer Groups

Probably you will have Server , Workstations and different OS in your environment.

To target the Updates for the different OS and type of Endpoints you can create the Computer Groups.

The hierarchy depends from your infrastructure.

I will show you only how can create the Computer Group and add the Endpoints in the Group

  • Right click in All Computers and select Add Computer Group

 

  • Type the name of the Computer Group. Click Add

 

  • Now right click on Updates and select New update View

 

  • Tick the Updates are for a specific product
  • Click in any produc.

 

  • Select only the product that you prefer. For this scenario i select Windows 10 

 

  • Type the name of the View and click OK
  • Now click on the new Update View
  • Change the Filter to Unapproved

 

  • Select the Windows Updates that you want to deploy in your Windows 10 Endpoints (in my example)
  • As you can see i use the search to find the Update for the specific version of Windows 10
  • Right click select Approve

 

  • Select the Computer Group and select Approve for Install.

 

That's it! Now base on which Computer has in Group and the Group Policy Settings will be install the Windows Updates.

As you can see it's very easy when you separate with the Groups the types of your Endpoints because you can target the specific Windows Updates for the specific group of Endpoints very quickly.

How to Automatic Approval Updates

 

It's not the recommended option for all the Windows Updates but only for the Security Updates.

We must keep every time all our Servers with the latest Security Updates to avoid any security hole in our systems.

It's not easy to keep the process manual when you have hundred of Servers to maintain.

For this reason i will show you how can approve automatic all the Security Updates for your Windows OS

  • Open the WSUS
  • Click in the Options
  • From the right side Select Automatic Approvals

 

  • Click in the New Rule

 

  • Tick the first 2 Options

 

  • Now click in Any Classification 

 

  • Select only the Security Updates. Click OK

 

  • Select any Product 

 

  • Select only the product  that you want to automatic approve the Security Updates. For the scenario i select Windows Server 2016.Click OK

 

  • Click in all computers

 

  • Select the Computer Group which include the specific Servers or Workstations with the appropriate Windows OS. Click OK

 

  • If you have already download the Windows Updates then you must click in Run Rule to approve all the Security Updates.
  • You don't need to click in Run Rule for the next updates that will download or if you don't have start to download any Windows update yet. 

 

  • Now you can easily create a new Update View which will include only the Security Updates to verify that all has been approved

 

 

Remember that until now we have only Automatic Approve all the Security updates.

If you want to proceed with automatic installation of the Security Updates you must change your Group Policy settings.

Read the paragraph How to configure Group Policy for WSUS to understand which settings  must be change in Group Policy

 

To be honest it's not very easy process because must be dedicate specific time to find and approve the Windows Updates for every Category.

But remember that this will happened only once and create an automate procedure while you have centralize your Windows Updates and know exactly which Endpoints are out of Date and must be Updated.

Have a nice weekend !!

Be Safe

Comentarios

Publicar un comentario

Dime si la información de este blog te sirvio.

Entradas populares de este blog

Guía de herramientas básicas para estudiantes: 31 apps y webs imprescindibles para ayudarte con los estudios

Imagen
  Te traemos una guía con   31 aplicaciones y herramientas web para ayudarte como estudiante , una colección muy variada para sacar provecho en diferentes ámbitos en los que puedas necesitarlo. Nos hemos dejado fuera el ámbito educativo para los más jóvenes, recursos que tenemos en   esta otra guía , y nos hemos centrado en estudiantes más adultos. Hemos decidido centrarnos en herramientas prácticas, dejando fuera las plataformas para cursos online, tanto  las más conocidas  como  otras menos conocidas . Lo que hemos preferido buscar son recursos que puedas usar en tu día a día, como gestores de fuentes y citaciones, herramientas para diagramas, para intercambiar apuntes o para crear diferentes contenidos. Y lo que decimos siempre en Xataka Basics hoy cobra más sentido que nunca. Nosotros te traemos 31 herramientas, pero te invitamos a  compartir tus propuestas en la sección de comentarios  para que el resto de usuarios también pueda beneficiarse de los conocimientos de nuestros xatake
Leer más

Comando FOR para archivos BAT

Gracias a: http://profesoremiliobarco.blogspot.com/ El comando FOR sirve para ejecutar bucles de instrucciones, y es una instrucción que se encuentra disponible en todos los lenguajes de programación. Un bucle son varias repeticiones de algunas instrucciones. Este comando suele ser el más complicado de entender para las personas que empiezan a escribir archivos BAT complejos. Aqui intentaré explicar todas las opciones y usos del comando FOR, así como intentar resolver las dudas que los usuarios de Internet me puedan plantear. La sintaxis normal del comando FOR es: FOR %var IN (lista) DO (      comando     comando      ... )  Pero si lo vamos a usar dentro de un archivo BAT será así: FOR %%var IN (lista) DO (      comando     comando      ... ) Observa que la variable "var" ahora va precedida por dos simbolos de "%". Además, si este for está dentro de un archivo BAT, el nombre de la variable debe ser UNA SOLA LETRA (p.ej: %%n, %%i,  %%j , etc
Leer más

How to Fix Failed to Connect a Hyper-V Standalone to Veeam Backup

Imagen
 Thank to: https://bonguides.com/ Invalid Credentials Error Adding a Hyper-V Host When attempting to add a Hyper-V host to  Veeam Backup & Replication  using a local (non-domain) user account, the following error occurs: Failed to connect to host Access denied or timeout expired . Check if you have local administrator privileges on computer Possible reasons: 1 . Invalid credentials . 2 . Specified host is not a Hyper - V server . Solutions 1. Login into the Hyper-V host then open  Registry Editor . 2. Navigate to the following location then create a new  DWORD  value. Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 3. Enter the name  LocalAccountTokenFilterPolicy  then double click on it and set the value data is  1. Or you can create a DWORD value using PowerShell, let run below command in PowerShell Admin. reg add HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system / v LocalAccountTokenFilterPolicy / t Reg_DWORD / d 1 Fin
Leer más