Windows Server Update Services

Windows Server® Update Services (WSUS) enables information technology administrators to deploy the latest Microsoft product updates to computers that are running supported Microsoft operating systems. For information about supported operating systems and other system requirements for WSUS, refer to the WSUS Release Notes.

By using WSUS, administrators can fully manage the distribution of updates that are released through Microsoft Update to computers in their network. WSUS provides a management infrastructure that consists of the following:

  • Microsoft Update: The Microsoft Web site that distributes updates of Microsoft products.

  • Windows Server Update Services server: This component is installed on a server inside the corporate firewall. The WSUS server lets administrators to manage and distribute updates through the WSUS administration console, which can be installed on any Windows-based computer in the domain. In addition, a WSUS server can be the update source for other WSUS servers within the organization. At least one WSUS server in the network must connect to Microsoft Update for available update information. The administrator can determine, based on network security and configuration, whether other servers should connect directly to Microsoft Update.

  • Automatic Updates: This component is built into supported operating systems. Automatic Updates enables both server and client computers to receive updates from Microsoft Update or from a WSUS server.

WSUS checklists and introductory topics

The following checklists and topics provide an introduction to configuring WSUS.

  • Checklist: Scale Up Your WSUS Network

  • Checklist: Get Microsoft Updates

  • Checklist: Ensure That Your Organization Gets Updates

  • Checklist: Get Timely Notification of Updates

  • Checklist: Deploy Updates at the Most Convenient TIme

  • Checklist: Ensure That Different Groups of Computers Get Updates

  • Checklist: Solve Common WSUS Server Issues

  • Design the WSUS Network

  • Configuring SSL for WSUS

Additional references

For complete information about how to install and use WSUS, refer to the following:

The WSUS Step by Step Installation Guide at http://go.microsoft.com/fwlink/?LinkId=139836.

The WSUS Deployment Guide at http://go.microsoft.com/fwlink/?LinkId=139832.

The WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

The WSUS Release Notes at http://go.microsoft.com/fwlink/?LinkId=139840.

The WSUS Administration Console online Help.


Checklist: Scale Up Your WSUS Network

You can set up a hierarchy of Windows Server Update Services (WSUS) servers to deploy updates to offices in different departments, organizational units, or geographical regions. The top-level WSUS server communicates directly with Microsoft Update, and the downstream WSUS servers communicate with the upstream server.

Designing WSUS server hierarchies

Step Reference
Check box

Decide how to link the WSUS servers. You can link WSUS servers in two ways:

Autonomous mode: An upstream WSUS server shares updates with its downstream server or servers during synchronization, however it does not share update approval status or computer group information. Downstream WSUS servers must be administered separately. Autonomous servers can also synchronize updates for a set of languages that is a subset of the set synchronized by their upstream server.

Replica mode: An upstream WSUS server shares updates, approval status, and computer groups with its downstream server or servers. Downstream replica servers inherit update approvals and cannot be administered apart from their upstream WSUS server.

WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832.

Check box

If you have multiple downstream servers, do not configure them to synchronize updates and roll up results at the same time of day. Downstream servers roll up information to their upstream server immediately after they synchronize. This can cause a high load on the upstream server and result in rollup failures. To prevent this problem, configure different downstream servers to synchronize at different times of day.

WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832.

Check box

When you configure a downstream server, verify that the update languages it supports are the same languages or a subset of the languages supported on its upstream server. If you choose a language on a downstream server that is not supported on an upstream server, you cannot obtain updates in that language.

WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832.

Additional references

For WSUS installation instructions, refer to the WSUS Step by Step Guide at http://go.microsoft.com/fwlink/?LinkId=139836.

For information about managing WSUS, refer to the WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also

  • Windows Server Update Services


Checklist: Get Microsoft Updates

You configure your Windows Server Update Services (WSUS) server by specifying the products, classifications, and languages for which you want to receive updates, and also the different computer groups to which updates should be deployed. You can then start the first synchronization in which the WSUS server obtains the specified updates from Microsoft Update.

Configure the WSUS server

 | Step | Reference
Check box | Confirm that the server on which you plan to install WSUS meets the minimum system requirements. | WSUS Release Notes http://go.microsoft.com/fwlink/?LinkId=139840
Check box | If you have a firewall or proxy server, ensure that WSUS has access to updates on the Internet before configuring the WSUS server. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832
Check box | Install WSUS and run the WSUS Setup Wizard. | WSUS Step by Step Guide http://go.microsoft.com/fwlink/?LinkId=139836

Additional references

For information about how to manage WSUS, refer to the WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also


Checklist: Ensure That Your Organization Gets Updates

By installing an update in a test environment first, you can assess its impact before you decide whether to deploy it to your production systems. This approach can prevent unplanned downtime and lost productivity.

To test the updates that you plan to deploy to the network, set up a test environment of computers that use the software to be updated, as well as other applications used in your environment. You can create multiple test computer groups that use different configurations that resemble the computers in different departments in your organization. After the updates have passed your test process, you can deploy the updates to the rest of the computers.

Set up a test environment for updates

 | Step | Reference
Check box | Create a custom computer group or groups to use as a test environment. | WSUS Step by Step Guide http://go.microsoft.com/fwlink/?LinkId=139836
Check box | Move some representative computers into the test group or groups. | WSUS Step by Step Guide http://go.microsoft.com/fwlink/?LinkId=139836

Additional references

For more information about how to set up and use a test environment for updates, see the WSUS Deployment Guide at http://go.microsoft.com/fwlink/?LinkId=139832.

See Also


Checklist: Get Timely Notification of Updates

You can configure the Windows Server Update Services (WSUS) server to send e-mail notifications of new updates and reports on the status of the WSUS network. Notifications are sent when the WSUS server synchronizes new updates, and status reports can be sent daily or weekly. You select the users who will receive e-mail updates by adding them either to the Windows Server Update Services Administrators account group or to the WSUS Reporters group. You can then configure the WSUS server to send the notifications to selected users.

Setting up e-mail notification

You can change authentication credentials only on a WSUS server, not from a remote administration console.

 | Step | Reference
Check box | Configure e-mail notifications for new updates and reports on the status of the WSUS network and the WSUS server. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832
Check box | Configure the e-mail server. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832

Additional references

For more information about WSUS reports, see the WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also


Checklist: Deploy Updates at the Most Convenient TIme

You can schedule updates in a way that minimizes network traffic and causes the least disruption to users by setting Automatic Updates on client computers to install updates on a specific day and at a specific time.

Scheduling updates

 | Step | Reference
Check box | If you have not already done this, install WSUS and run the WSUS Setup Wizard. | WSUS Step by Step Guide http://go.microsoft.com/fwlink/?LinkId=139836
Check box | Configure automatic updates. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832

Additional references

For best practice information about deploying updates, see the WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also


Checklist: Ensure That Different Groups of Computers Get Updates

Windows Server Update Services (WSUS) lets you target updates to groups of client computers, so that you can ensure that specific computers always get the applicable updates. You can create computer groups in hierarchies (for example, the Payroll group and the Accounts Payable group underneath the Accounting group). Updates that are approved for a higher group will automatically be deployed to lower groups.

You first configure the client computers to contact the WSUS server before you can assign them to groups and manage them from that server. You can assign computers to computer groups by using one of two methods, server-side targeting or client-side targeting. With server-side targeting, you manually move one or more client computers to one computer group at a time. With client-side targeting, you use Group Policy or edit the registry settings on client computers to enable those computers to automatically add themselves into the previously created computer groups.

WSUS deployment using computer groups

 | Step | Reference
Check box | Configure client computers to contact the WSUS Server. | WSUS Step by Step Guide http://go.microsoft.com/fwlink/?LinkId=139836
Check box | Create computer groups in WSUS. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832
Check box | Assign computers to computer groups. | WSUS Deployment Guide http://go.microsoft.com/fwlink/?LinkId=139832

Additional references

For more information about how to manage WSUS computer groups, see the WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also


Checklist: Solve Common WSUS Server Issues

After you have installed Windows Server Update Services (WSUS), if you encounter server issues, you can resolve them by using the WSUS Operations Guide that gives detailed troubleshooting information to resolve common issues with client computers, download and installation failures, and other problems.

If you cannot install WSUS, this is likely because of a network issue or to a failure to meet the minimum system requirements and prerequisites for hardware and software.

Resolving WSUS issues

 | Step | Reference
Check box | If you receive the message “The update could not be found. There may be a network connection issue.” when you try to install WSUS, refer to the information in the Network and Sharing Center Troubleshooting Guide. | Network and Sharing Center Troubleshooting Guide http://go.microsoft.com/fwlink/?LinkId=140135
Check box | If you receive a different failure message when you try to install WSUS, you may not have met all the minimum system requirements as stated in the Release Notes. | WSUS Release Notes http://go.microsoft.com/fwlink/?LinkId=139840
Check box | If you encounter issues with WSUS after installation, refer to the WSUS Operations Guide. | WSUS Operations Guide http://go.microsoft.com/fwlink/?LinkId=139838

Additional references

For more information about how to set up and use WSUS, see the WSUS Deployment Guide at http://go.microsoft.com/fwlink/?LinkId=139832.

See Also


Design the WSUS Network

The first step in deploying Windows Server Update Services (WSUS) is to design the server configuration, either a simple configuration with a single server or a complex configuration with multiple WSUS servers. Considerations include connection bandwidth (for both Internet connections and local area network [LAN] or wide area network [WAN] connections), network configuration, and different language requirements.

Additional references

For WSUS installation instructions, see the WSUS Step by Step Guide at http://go.microsoft.com/fwlink/?LinkId=139836.

For information about how to design and manage the WSUS network, see the following:

  • The WSUS Deployment Guide at http://go.microsoft.com/fwlink/?LinkId=139832.

  • The WSUS Operations Guide at http://go.microsoft.com/fwlink/?LinkId=139838.

See Also


Configuring SSL for WSUS

You can use the Secure Sockets Layer (SSL) protocol to help secure your Windows Server® Update Services (WSUS) deployment. WSUS uses SSL to allow client computers and downstream WSUS servers to authenticate the WSUS server. WSUS also uses SSL to encrypt the metadata passed between client computers and downstream WSUS servers. Be aware that WSUS uses SSL only for metadata, not for content. This is also how Microsoft Update distributes updates.

Updates consist of two parts:

  • The metadata that describes the update

  • The files to install the update on a computer

Microsoft reduces the risk of sending update files over a non-encrypted channel by signing each update. Additionally, a hash is computed and sent with the metadata for each update. When an update is downloaded, WSUS verifies the digital signature and hash. If the update has been altered, it is not installed.

For detailed steps to configure SSL on the WSUS Server and on the WSUS Client, see the WSUS Deployment Guide at http://go.microsoft.com/fwlink/?LinkId=139832.

Limitations of WSUS SSL deployments

Administrators planning to implement WSUS SSL deployments should consider two limiting issues:

  1. Securing your WSUS deployment with SSL increases the workload of the server. You should plan for about a 10-percent loss of performance because of the additional cost of encrypting all the metadata sent over the network.

  2. If you are using remote SQL, the connection between the WSUS server and the server that is running the database is not secured with SSL. If the database connection must be secured, consider the following recommendations:

    • Put the database on the WSUS server (the default WSUS configuration).

    • Put the remote server that is running SQL and the WSUS server on a private network.

    • Deploy IP security (IPsec) on your network to secure network traffic. For guidance about how to deploy IPsec in your environment, see the Windows Server Deployment Guide http://go.microsoft.com/fwlink/?LinkId=45154.

Additional references

Setting up a Certification Authority (CA), binding a certificate to the WSUS Web site, and then bootstrapping client computers to trust the certificate on the WSUS Web site are complex administrative tasks. The step-by-step procedures for each task are beyond the scope of this topic. However, several articles on the subject are available. For more information and instructions about how to install certificates and set up your environment, see the following resources:

  • The Windows Server 2003 PKI Operations Guide (http://go.microsoft.com/fwlink/?LinkId=83159) provides a guide for administrators about how to configure and operate a Windows Certification Authority.

  • Microsoft Knowledge Base article 299875 (http://go.microsoft.com/fwlink/?LinkId=86176) offers step-by-step instructions for implementing SSL in IIS.

  • Certificate Autoenrollment in Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkId=17801) offers instructions about how to automatically enroll client computers running Windows XP in Windows Server 2003 Enterprise environments integrated with Active Directory.

  • Advanced Certificate Enrollment and Management (http://go.microsoft.com/fwlink/?LinkId=83160) offers guidance about how to automatically enroll client computers in other environments.

See Also