WSUS Questions

IRJ

Nofiy for the install in the GPO doesnt mean its going to notify me, if I approve it via WSUS, correct? If I dont approve it via WSUS is it still going to bug the user and say updates need to be installed? **Yes, since the PC/Server is "looking" at WSUS and not MS, it will believe WSUS that an update is available when you approve it. And the setting above means that it will download the update from WSUS and then notify you that there are updates that need to be installed. It won't install automatically. **

What about the scheduling option? How does that work?

I just want to approve it from WSUS and have everything donwloaded and then schedule to deploy a few PCs at a time

Dashrender

You can't do a few PCs at a time unless you create groups for the PCs and only put a few PCs in each group.

If you want to auto deploy the updates you need to change your
Configure Automatic Updates -> 4 auto download and schedule the install

Then list the time you want to schedule them.

You'll have to create a different OU for each group if want to have them go at different times (that would be a pretty big pain).

IRJ

@Dashrender said:

You can't do a few PCs at a time unless you create groups for the PCs and only put a few PCs in each group.

If you want to auto deploy the updates you need to change your
Configure Automatic Updates -> 4 auto download and schedule the install

Then list the time you want to schedule them.

You'll have to create a different OU for each group if want to have them go at different times (that would be a pretty big pain).

I have already created OUs for each group. I have like 20 different groups. I just have to change the GPO to 4 instead of 3 on all of them.

IRJ

This is what I have so far. I will actually have more groups once I reboot the PCs tonight and they all update group policy.

DenisKelley

@IRJ said:

@DenisKelley said:

Nofiy for the install in the GPO doesnt mean its going to notify me, if I approve it via WSUS, correct? If I dont approve it via WSUS is it still going to bug the user and say updates need to be installed? **Yes, since the PC/Server is "looking" at WSUS and not MS, it will believe WSUS that an update is available when you approve it. And the setting above means that it will download the update from WSUS and then notify you that there are updates that need to be installed. It won't install automatically. **

What about the scheduling option? How does that work?

I just want to approve it from WSUS and have everything donwloaded and then schedule to deploy a few PCs at a time

Like Dashrender noted, you'll need different Group Policies. They way it works is when you approve the group in WSUS, then the GP tied to that group gets enforced. So if you had TEST Group 1 with download and install automatically at 3AM, then once you approve an update for that group, the PC will download the update (next time it talks to WSUS), then at 3AM, it will then install the update.

If you do install and notify for a particular GP, then after approving, the PC or Server will just note that you are ready to install. One of the best how-to's talking about all of this is available on Microsoft called WSUS 3.0 Install Guide. Your version may be different, but this was a great guide I used years back when learning. http://www.microsoft.com/en-us/download/details.aspx?id=913

IRJ

I am changing all the GPOs to 4 - Auto download and schedule the install

Dashrender

That. Is a lot of groups, why so many?

IRJ

@Dashrender said:

That. Is a lot of groups, why so many?

Different branches and I am an AD Nazi. I like to have alot of OUs

Dashrender

Uh.. OK... You can apply the GP to the level about the 'list'. If you're OK with them all being told to install at the same time. That would cut down on the number of GPOs you have to manage.

IRJ

@Dashrender said:

Uh.. OK... You can apply the GP to the level about the 'list'. If you're OK with them all being told to install at the same time. That would cut down on the number of GPOs you have to manage.

I staggered the GPOs between midnight and 5am. That was part of the reason I created different deployment groups.