Re: SBS R2 WSUS

Ah OK. So the WSUS policies are discreet. That should make filtering the
GPO's from Vista machines doable.

I heard about the 1 hour check for new updates setting. It just makes the
workstations more responsive and with only a handfull of workstations
probably not an excessive burdon on the SBS server. Initially I configured
that for several WSUS non SBS networks, but was convinced to back it off to
the default 22 hours. Approving IE7 or a large service pack for a large
number of computers does have a noticable effect when they all hit the
server at the same hour and start downloading the updates.

--
/kj
"Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in message
news:14D57E0E-8014-43BD-8321-773037A714B1@xxxxxxxxxxxxxxxx
Hi KJ,

The GPOs are actually named:

SBS Update Services Common Settings
SBS Update Services Client Computer Settings
SBS Update Services Server Computer Settings

There are no WSUS settings in any other GPO, so this makes it clean and
clear.

The SBS Update Services GUI, now located in Standard Management, gives you
a quick way to approve updates that aren't auto approved, dislplays any
errors, and allows for some basic changes to the policy. Reporting is
included in the daily Server Perfromance reports. There's seldom a reason
to go to the WSUS console, unless you need detailed information or are
troubleshooting.

Some of the settings exposed in the GUI are:

Update level for Servers None, Low, Medium, High
Update level for Clients
Schedule for Workstations (Install, download and notify, and time of day
for restart)
Schedule for Servers
Included Computers - this is an interesting one, you can move individual
computers out of Update Services completely, and also change the group
membership of individual computers. So you could move a client computer to
the server computers group, so it complies with the update settings of
that group instead - or visa versa.

There are a couple of possibly less than ideal SBS Update Services default
settings, such as having the client computers check with the Update Server
every hour. Standard WSUS settings would be every 22 hours. I'm not sure
why the SBS DEV team did this - they may have a good reason but I don't
know what it is.

Multiplied over the number of servers and networks I maintain - it's been
a real productivity booster for me in that second week of each month - and
the GUI has allowed enough flexibility to account for some odd situations
where I have customers running odd applications on XP boxes and we want
the Server computers update policy to apply.

Additionally, I have one customer with a couple of laptop computers that
almost never see the network. The laptops possibly shouldn't be domain
members, but they are. SBS Update services warns that these computers
haven't connected in X days, which we know :-). They can easily be
excluded from the GUI.

Of course, all of this (and more) except for the automatica reporting, can
be done via the WSUS console - just not as easily. Additionally, when you
install R2 this is all automatically set up for you, whereas it's a chore
on a non R2 server.

I like it :-)


--
Les Connor [SBS MVP]
"kj" <kj@xxxxxxxxxxx> wrote in message
news:%23wbtpjAIHHA.536@xxxxxxxxxxxxxxxxxxxxxxx
So the WSUS (Windows Update) settings are in the "workstation" and
"server" settings GPOs, or are "parts" in all three?

I should have looked when I had it running in VM, but the last HW piece
for the new in house server showed up today.

--
/kj
"Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in message
news:7DBE5611-C237-4DE7-97B8-20C84722DADB@xxxxxxxxxxxxxxxx
They're seperate, and quite nicely done. 3 GPO's in all:

1 - common settings
2 - workstation settings
3 - server settings

If you didn't have R2, you'd want the GPO's to copy from :-)

--
Les Connor [SBS MVP]
"kj" <kj@xxxxxxxxxxx> wrote in message
news:eI7wau$HHHA.1252@xxxxxxxxxxxxxxxxxxxxxxx
Les,

Does R2 combine the group policy settings for WSUS with other settings
or does it have its' own GPO?

--
/kj
"Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in message
news:F165BBED-3083-45B8-909B-56C0AB2AEA51@xxxxxxxxxxxxxxxx
That's a big price to pay ;-). There's been by far more updates for
the other OS's recently. It's not a trade off I'd make, personally.

I'm happily running a Vista workstation in an SBS network without
joining it to the domain, using PTA, it works OK. More just to get the
feel of the OS than anything, as opposed to integrating with the SBS
network. But as mentioned, the integration update is in the works.

--
Les Connor [SBS MVP]
"Marc Frenette" <imskizzer@xxxxxxxxx> wrote in message
news:11E1C705-1CC4-4011-A182-C3F43E3A8E83@xxxxxxxxxxxxxxxx
Actually, I did alot more than excluding the Vista client from WSUS.
I actually disabled the 3 GPOS controlling WSUS. I can manually
update till MS comes out with a fix.
Just using the exclude feature yeilded me no solution.
"kj" <kj@xxxxxxxxxxx> wrote in message
news:uxlGHD7HHHA.1008@xxxxxxxxxxxxxxxxxxxxxxx
If you are getting "error 8024400A" in your Vista Windowsupdate.log
then the WSUS V3 beta group recommends applying

http://support.microsoft.com:80/?id=898708

..but nowhere does the fix list SBS2003 as one of the "applies to:"
Operating systems, so do so at your own risk.

--
/kj
"kj" <kj@xxxxxxxxxxx> wrote in message
news:%23$gbG56HHHA.3424@xxxxxxxxxxxxxxxxxxxxxxx
WSUS V3 will be the first to fully support Vista updates. It's
still in beta but it's getting there.

It's a substantial change over V2 (even SBSR2's V2) and I don't
know what MS plans for a SBS retrofit if any.

I'm surprised that moving a computer to the R2 WSUS exluded list
clears the WU GPO and registry settings, but then I don't have one
available to try right now.

--
/kj
"Marc Frenette" <imskizzer@xxxxxxxxx> wrote in message
news:D76366CA-ABFD-4FD8-A2B3-02A2D7A2DB43@xxxxxxxxxxxxxxxx
Thanks Les. I guess I am a bit ahead. I was offerred VIsta
Ultimate for participating in the Tech beta. It is a bit of a
hassle thus far on an sbs network. So for now, I have disabled
WSUS altogether on the server. It seems to be the only way for me
to get the updates I want through Windows update.
Looking forward to seeing what MS comes out with for SBS and
Vista. I had thought that R2 would have some features already
prepared... but then again, I was jumping the gun.. ;)
"Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in message
news:B1B9E2F4-AE41-46EB-9890-BF54E5CE928D@xxxxxxxxxxxxxxxx
Vista is a special case. There are a large number of GPO settings
required to integrate a Vista client into an SBS nework. I'm not
even going to try and do it manually - MS is working on that and
there'll be an update for SBS to address this. You're just a bit
ahead of the wave, as Vista isn't widely available yet.

--
Les Connor [SBS MVP]
"Marc Frenette" <imskizzer@xxxxxxxxx> wrote in message
news:FC218D7E-96FF-4403-B1EF-E24A8C3232AE@xxxxxxxxxxxxxxxx
I did that. Though in control panel on Vista, it tells me that
updates are managed by my network admin... It seems to be a gpo.
Though I am unclear how to check that.

"Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in
message
news:26A12C95-752B-4C46-8751-EFBCE4A7C8BF@xxxxxxxxxxxxxxxx
Hi Marc,

In the Update Services node of Standard Management:

Click on Change Update Servcies Settings
Click on Included Computers
Move the computer from teh Included section to the Excluded
section.

--
Les Connor [SBS MVP]
"Marc Frenette" <imskizzer@xxxxxxxxx> wrote in message
news:4A28A7E7-BD2A-4CEF-BD77-242820CBA855@xxxxxxxxxxxxxxxx
I am wondering if someone could help me. I want to remove a
Vista Ultimate client from using the gpo that involves WSUS.
It is presently set by policy to always use WSUS, what steps
do I need to
take be able to access Windows Update directly?
BTW, I am relatively new at SBS so I need need some clear
explanation.
Thanks in advance!
Marc


















.

Loading