Administrators have the option to install WSUS 3.0 interactively or in an automated manner. To do this an administrator will issue a command called WSUSSetup.exe with switches that meet their requirements. The setup command line parameters are shown in Table 3.3 and the command line properties for WSUS 3.0 are shown in Table 3.4.

WSUSSetup.exe /q DEFAULT_WEBSITE=1.

Many administrators will select the interactive setup for WSUS 3.0. To install the software you must first download it. WSUS 3.0 can be downloaded from http://go.microsoft.com/fwlink/?LinkId=89379. If you are installing on an x64 system you must download WSUS3Setupx64.exe, 32-bit systems use WSUS3Setupx86.exe. The following steps install WSUS 3.0.

Figure 3.11. WSUS Installation Completed

After WSUS is installed you must configure it. Once the installation is done, WSUS immediately starts the Configuration Wizard. This will allow you to select options like an upstream server, proxy server, any languages supported on your network, products you want to support updates for, and more. Let’s quickly run through the wizard for our setup.

First is the Before You Begin screen shown below in Figure 3.12. It will ask you if the server firewall is configured correctly, if the server can connect to the upstream server, which in our case will be the Microsoft Update site, and if you have user credentials for a proxy server if one is installed.

Figure 3.12. WSUS Configuration Wizard

Now you have the option to Join the Microsoft Update Improvement Program (Figure 3.13). This program uses your WSUS server to upload information to Microsoft in an effort to improve the quality and reliability of updates. We will allow the default which is Yes, I would like to join the Microsoft Update Improvement Program. If you decide not to, just remove the check mark and select Next.

Figure 3.13. Microsoft Update Improvement Program

Now we choose our upstream server, demonstrated in Figure 3.14. For our example, this will be the Microsoft Update site. For some with hierarchical WSUS topologies, your upstream server will be another WSUS system on your network. Once you’ve selected your upstream server, click Next.

Figure 3.14. Choosing an Upstream Server

If you have a proxy server, then in Figure 3.15 in the Specify Proxy Server screen you must provide the server name, port number, and the user credentials so that the WSUS server can receive updates. Remember if the user account that the WSUS server uses to get through the proxy changes, if either the password or the actual account is renamed, you must type the new account and changed password in the Proxy Server settings for WSUS or synchronization with Microsoft Update will fail. If you do not have a proxy server then just click Next.

Figure 3.15. Specify Proxy Server

Now we must connect to the upstream server, as you see in Figure 3.16. At this point, just click Start Connecting.

Figure 3.16. Connect to Upstream Server

After the update information is downloaded, click Next.

Now choose the language(s) of the updates you need to support. You can choose to download updates in all languages, including any additional languages that Microsoft later supports, or you can select which language(s) you need to download updates for. As you see in Figure 3.17, we have chosen just to download updates in English.

Figure 3.17. Select Language(s) of Updates to Download

Now, choose the Microsoft products for which you want updates. You can select All Products, as in Figure 3.18, or individually select certain products. For our example, we have selected to download updates for: Exchange Server 2003, Forefront Client Security, all Office suites, and all Windows operating systems. Once your product(s) are selected, click Next to continue.

Figure 3.18. Select Product(s) to Update

Classification selection is next, as seen in Figure 3.19. Here you can choose what type of updates you want downloaded to the WSUS server. For our example, we have chosen Critical Updates, Definition Updates, Security Updates, Service Packs, and Updates. Once you’ve made your selections, click Next.

Figure 3.19. Select Update Classification(s)

Now you must set a synchronization schedule. You can either Synchronize manually or Synchronize automatically, thereby choosing an exact time for synchronization. We’ve chosen to synchronize at midnight and only synchronize once per day, as you see in Figure 3.20. After selecting your synchronization strategy, choose Next.

Figure 3.20. Set Synchronization

At the Finished screen, you can Launch the Windows Server Update Services Administration Console and/or Begin initial synchronization. Looking at Figure 3.21, you see we are choosing to do both. After your selection(s), click Next.

Figure 3.21. Configuration Wizard Completion Screen

Now you come to a What’s Next screen where you are provided suggestions such as: Using SSL with WSUS, Creating computer groups, Assigning computers to groups using Group Policies, and Configuring auto-approval rules. For our example, we will just select Finish.

During the installation of WSUS, you had the choice of using the default Web site which uses port 80. This is recommended by Microsoft as long as there are no other websites on the server listening on port 80. If there are, Microsoft allows you to choose Create a Windows Server Update Services 3.0 Web Site as you saw back in Figure 3.9. This then informs you that client systems must now use TCP 8530 to access the update server. For instance, in our example, if we had chosen to create a Web site our WSUS server would be accessed by clients with http://obi1:8530. If this had been the case then we would need to make sure that the individual firewalls on the clients (Windows XP, Windows Server 2003, and Windows Vista) allowed TCP 8530.

The client software for WSUS is called Automatic Updates. The clients supported are:

After setting up the GPO for clients to use the WSUS server, we can force the newly modified GPO to take effect on our system(s) and check for updates. To force the changed GPO to take effect just click Start | Run and in the run box type gpupdate.exe /force. If prompted, restart your system. On Windows 2000 systems you do not have gpupdate.exe, so you must run secedit.exe /refreshpolicy machine_ policy. Now we need to get our client to check for updates that are on the newly installed WSUS server. Click Start | Run and in the run box type wuauclt.exe / detectnow. This forces the client to communicate with the WSUS server and check for updates. To verify you are communicating with and searching for updates from the WSUS server look for the WindowsUpdate.txt file found in the C:Windows directory. Some lines to look for in this file are:

After confirming any of the above lines in the WindowsUpdate.txt, you are communicating successfully to the WSUS server.

The node below Update Services is the actual WSUS server itself, as seen in Figure 3.27. In our case, it’s OBI1. Under this selection, the Details Pane provides the administrator with a To Do list. This list informs the administrator of how many security updates, critical updates, and new products, along with their classifications, are waiting to be approved or have been added. Administrators are also provided an overview with the same information seen in the Update Services Details Pane along with the Synchronization Status, Download Status, Server Statistics, and Connection type. In the Actions Pane, you have the ability to remove the selected server from the console by clicking on Remove from Console. You can also search for specific updates by title, description, Knowledge Base article number, or the Microsoft Security Response Center number of all updates. You can also search for specific computers by their names if need be. Also in the Actions Pane is the ability to import updates to the WSUS server. This can be done by clicking on Import Updates in the Actions Pane.

Figure 3.27. Update Services: WSUS Server Details and Actions Panes

The Updates node in the Console Tree provides more information about the updates on the WSUS server. It breaks them down into four categories: All Updates, Critical Updates, Security Updates, and WSUS Updates (Figure 3.28). The Actions Pane allows administrators the same Search option previously mentioned, along with the same Import Updates option. It does allow some customization for the administrator in that they can click on New Update View and choose the properties they want to include in the view, the specifics of that property, and even a name for the customized view. For instance, if we wanted to view the updates required for all Windows Vista and XP systems we could create a custom view.

Figure 3.28. Updates Console

The subnodes for the Updates folder include: All Updates, Critical Updates, Security Updates, WSUS Updates, and any custom views the administrator may have added. The subnodes have the same options. In the Details Pane, administrators can view a list of Approved, Unapproved, Declined, and Any Except Declined. To the right, you can view the Status of the updates, such as Failed or Needed, Installed/ Not Applicable or No Status. In Figure 3.29, we see a list of some of the updates that are currently Unapproved with a status of Failed or Needed. Below this you will see the list of the updates that meet these criteria. By highlighting an update you get information such as the Title of the update, its Classification, the Installed/Not Applicable percentage, and whether that update is approved or not. Below this information, you are provided data such as Computers needing this update, the KB article number(s), a description of the update, and additional details about it.

Figure 3.29. All Updates Details Pane

Approve

To approve an update in WSUS 3.0, highlight the update in the Details Pane, and choose Approve in the Actions Pane. In our example, we will choose to approve the update you see in the Details Pane from Figure 3.29, which is titled Update for Outlook 2003 (KB943649). Once we click Approve in the Actions Pane, we see the Approve Updates screen, which allows us to choose the computer group we want to approve the update for. Since we don’t currently have any computer groups created, for this instance we will approve the update for All Computers. To do this click on the down-arrow button to the left of All Computers in the Computer Group column and choose Approved for Install. You can see this in Figure 3.30.

Figure 3.30. Approve Update to Install

Now you should see a green check mark beside All Computers in the Approve Updates screen, along with the Approval status changed to Install. Once you see this, just select OK. The Approval Progress is shown after approving the update (Figure 3.31). Once the action has finished and the result reads as Success, you can click Close.

Figure 3.31. Approval Progress

After the approval has been completed you can go back to the Details Pane in the WSUS Update Services MMC and change the Approval status to Approved. You should then see the newly approved update, as in Figure 3.32. You will probably need to hit the Refresh button in the upper right of the Details Pane.

Figure 3.32. Verifying Update Approval

Decline

Declining an update is just as easy as approving one. To decline an update, just highlight the update you wish to decline in the Details Pane and choose Decline from the Actions Pane. For our example, we will decline an update titled Thai Language Pack. When you decline an update, after clicking the Decline button you come to a warning message asking you if you’re sure you want to decline the update (Figure 3.33). To decline, just click Yes.

Figure 3.33. Declining an Update

After you’ve declined the update, to confirm go to the Details Pane and change the Approval status to Declined, where you should see the update you just declined. Figure 3.34 shows the Thai Language Pack that we just declined.

Figure 3.34. Verifying Update Declined

Sometimes you may need to change an update’s status from approved to declined or vice versa. To change an update from approval to decline, just change the Approval status to Approved, find and highlight the update whose status you want to change and click Decline in the Actions Pane. To change an update from decline to approval, you would do the same thing but change the Approval status to Declined to find the update, and then in the Actions Pane choose Approve.

Sometimes there are revisions made to updates, whether it is metadata changes, a new update description or title, or even actual changes to the update files themselves. By highlighting a particular update in the Details Pane, you can then go to the Actions Pane and select Revision History to view any changes that have occurred with that particular update.

Update reports are available in three formats, depending on an administrator’s need: Update Status Summary, Update Detailed Status, and Update Tabular Status. Update Status Summary provides a detailed summary on each update that is specified in the report criteria. While an Update Detailed Status report provides information about the status of all computers for each update, an Update Tabular Status report provides update status for multiple updates. The data is presented in a tabular format. For our example, we will walk through creating an Update Status Summary for critical updates for Exchange Server 2003 that has a status of Needed, Failed.

To do this we click on the Reports node in the Console Tree pane, then go to the Details Pane and select Update Status Summary under the Update Reports category. In the Updates Report screen our New report type will be Summary Report, while the Include updates in these classifications will be set for just Critical Updates. For the Include updates for these products criteria, we will choose Windows Vista. Since we don’t have any groups configured in our example, we will leave this as default, which is Any computer group. Next we will choose Needed, Failed for Include updates that have a status of. Finally we will leave the Include status from replica downstream servers to their default, which is All replica downstream servers. Now that our report criteria have been selected, as you see in Figure 3.36, we can run our report.

Figure 3.36. Report Criteria for Update Status Summary

To run the report, just select Run Report from the menu at the top. After the report has run, you should see any updates that have a status of Needed, Failed. Figure 3.37 shows one of three pages that our report has produced.

Figure 3.37. Update Status Summary Report

If we decided that we wanted more details about our updates, we could run a Detailed Report on the same criteria. The results of that report are shown in Figure 3.38; there doesn’t seem to be a difference between the two on first look.

Figure 3.38. Detailed Status Report Page One

Notice that the number of pages has increased from three to five. Looking at the next page, we will see which computer needs the Update for Exchange Server 2003 SP2 (KB924334)-Non-cluster. Looking at Figure 3.39, you see that the computer requiring this update is jedi.sigr.local.

Figure 3.39. Update Detailed Status Report Page Two

What if we just want a summary of the report but in a friendlier view—say in a tabular layout? Just select Update Tabular Status within the Details Pane and choose the same criteria and your report should look something similar to Figure 3.40.

Figure 3.40. Update Tabular Status Report

Computer reports consist of Computer Status Summary, Computer Detailed Status, and Computer Tabular Status. The Computer Status Summary provides a detailed summary of each computer, including computer group information and update installation status. Computer Detailed Status shows a summary of computer status, with the status for each update. Computer Tabular Status provides computer status for multiple computers; this report is shown in a tabular manner. In our example here, we are going to run a Computer Status Summary report for critical updates on systems running Microsoft Office 2003 and 2007 and have either a Needed or Failed status.

To do this, just click Reports in the Console Pane and go to the Computer Reports area. Click on Computer Status Summary and you are shown a similar screen that you saw when creating update reports earlier. Figure 3.41 shows our report criteria for our Computers Status Summary report.

Figure 3.41. Report Criteria for Computers Status Summary

Once you’ve established your criteria you can click on Run Report in the menu at the top. Once the report generation has completed, you will see the Computer Status Summary Report as seen in Figure 3.42. Here we are provided information with the name of the system(s) that fall into our criteria and additional information such as: Operating System, Service Pack, Language, IP Address, and their Last Status Reported date and time.

Figure 3.42. Computers Status Summary Report

If you decided you wanted a more detailed report, one in which you were provided the actual updates that were missing on this system, you could then choose the Computer Detailed Status report. If you needed the summary report to present in a tabular format, you would choose to run the Computer Tabular Status report.

Synchronization Results show the results of a WSUS’s last synchronization or any synchronization for a given period of time. For our example, we will run a Synchronization Report for the dates of December 25 to December 27. To do this, click on Reports in the Console Pane and go down to the Synchronization Reports area in the Details Pane. Once here, click on Synchronization Results and a screen for the synchronization report for that WSUS server will appear. As you see in Figure 3.43, we have clicked on the radio button beside Between these dates and have put a start date of December 26 and an end date of December 27. After this you can go ahead and click on Run Report just as you’ve done with the previous reports.

Figure 3.43. Synchronization Report Criteria

In Figures 3.44 and 3.45, you see our results. You are provided the date and time the synchronizations took place, how many new updates were downloaded, and how many updates had expired. Further down in the report (Figure 3.45), you see a list of the actual new updates and a list of the ones that have expired. As we’ve shown throughout this chapter, one of the biggest changes to WSUS 3.0 is the use of the Microsoft Report Viewer 2005 and it is possibly the most important, next to the ability to deliver updates to clients.

Figure 3.44. Synchronization Report Results Part 1

Figure 3.45. Synchronization Report Results Part 2

Now that you have created computer groups you’ll be able to target updates to those specific groups instead of having them update all systems throughout the network at the same time.

By default, WSUS 3.0 is configured to synchronize and obtain updates from Microsoft Update and to do so without going through a proxy server. If either of these settings need to be modified after installation, simply pull up the WSUS Administrative console and go to Options | Update Source and Proxy Server. The Update Source and Proxy Server setup screen is shown in Figures 3.50 and 3.51. Figure 3.50 is the Update Source tab where administrators can decide where they will obtain downloads. In our example, we will synchronize from Microsoft Update. However, we could change this to synchronize with another WSUS server. If we were to do that we would need to provide that server’s name and the port number. We could use Secure Sockets Layer (SSL) to synchronize with an upstream WSUS server by putting a check beside Use SSL when synchronizing update information. We can also inform WSUS that this server is a replica of the upstream server. Doing this would prevent anyone independently approving updates on this downstream system. This is a good idea if we have a hierarchy server topology and a centrally located administrative staff.

Figure 3.50. Update Source Tab

Figure 3.51. Proxy Server Tab

The proxy server settings can be changed by clicking on the Proxy Server tab in the Update Source and Proxy Server dialog box. In situations where a proxy server has been added since the installation of the WSUS 3.0, you will need to enter the proxy server’s name, the port number, and any user credentials that may be required to allow the server to synchronize upstream with the Microsoft Update site.

Products and classifications allow you to choose and/or modify which products you wish to download updates for. For instance, if you wanted to synchronize updates for all supported versions of Microsoft Office you would first go into Options | Products and Classifications. At the Products tab, scroll down the list of products and put a check mark in the box beside Office, as you see in Figure 3.52. This selects Office versions 2002/XP, 2003, and 2007.

Figure 3.52. Select a Product(s) to Synchronize Updates

Classifications such as Critical Updates, Definition Updates, Drivers, Feature Packs, Security Updates, Service Packs, Tools, Update Rollups, and Updates can be selected by clicking on the Classifications tab and choosing the type(s) you wish to support.

In Update Files and Languages an administrator can decide to store update files locally on the WSUS server or not. They can also decide what languages of the updates they need to support. Figure 3.53 shows the option to store updates on the WSUS server itself. If we want to store the update files locally then we would select Store update files locally on this server. We then would choose when we needed to download the files. We have the option to Download update files to this server only when updates are approved, meaning that we only download what we approve.

Figure 3.53. Update Files Tab

We can alternatively choose to Download express installation files. An express installation file is the delta or change between the version of a file that already exists on a system needing updated and the updated file itself. The advantage of this is that you limit the bandwidth consumed on the local network, but at the cost of bandwidth consumption on your Internet connection plus disk space on the server.

So why would this increase the amount of bandwidth used for the Internet connection? The files/updates downloaded must contain all the possible deltas of that file. You could end up doubling or tripling the size of an updates download using express installation files, but you gain on the cost of bandwidth when you install those updates.

Besides deciding whether or not to store updates locally, notice the option grayed out. That option is Download files from Microsoft Update; do not download from upstream server. Since this is the only WSUS server on the network and it is already configured to download updates from the Microsoft Update site, we aren’t provided this option. If we were a downstream server and we had permission to do so, we could download directly from Microsoft Update. This does not mean that the particular server would no longer be a downstream server, just that the updates that are approved from the upstream server would be downloaded directly from Microsoft Update.

In the Update Languages tab seen in Figure 3.54, you are given the option of downloading updates in all languages, including any new languages supported later, or choosing individual languages that are supported in your environment.

Figure 3.54. Update Languages Tab

The Synchronization Schedule option allows administrators to choose how they want to synchronize with Microsoft Update or an upstream server, when they want to synchronize, and how often each day. For our example, during setup we chose to Synchronize automatically at 12:12 A.M. and do so only once per day (Figure 3.55).

Figure 3.55. Synchronization Schedule

The Automatic Approvals option allows an administrator to automatically approve updates to be installed based on product and classification, and gives the ability to target which computers to set the automatic approval(s) for. Automatic approvals are based on rules. For instance, we could create a simple rule to automatically update all computers in the Vista Computers group within the Marketing department for any Windows Vista updates.

Figure 3.58. New Rule Enabled

As you probably noticed there is an Advanced tab in the Automatic Approvals screen. This tab allows administrators to automatically approve updates for WSUS 3.0 itself, automatically approve new revisions of previously approved updates, and decline updates when a new one causes them to expire.

The Computers option allows administrators to specify how computers are assigned to groups. Computers can be added to groups using either Group Policies (or registry settings) or via the Update Services console but not both.

The Server Cleanup Wizard is used to help administrators manage their disk space by removing unused updates and revisions, deleting computers not contacting the server, deleting unneeded update files, declining expired updates, and declining superseded updates.

In environments where there are multiple WSUS servers, administrators have the option to consolidate status information into a single console. This is done using Reporting Rollup in WSUS 3.0. By using Reporting Rollup, administrators can easily view downstream replica WSUS servers in both the WSUS Administrative Console and in WSUS reports themselves.

WSUS 3.0 can send e-mail notifications of new updates and provide status reports to whomever an administrator feels needs this information. To set this up do the following:

The Microsoft Update Improvement Program is used to improve the quality and reliability of Microsoft’s updates. If you opt in to this program, your WSUS server will send information to Microsoft, such as the number of computers in the organization, number of computers that successfully install each update, and number of computers that fail installation. You are not forced to join. If you decide you want to, click on Microsoft Update Improvement Program within Options. Once there, check Yes, I would like to join the Microsoft Update Improvement Program and you’re in.

If you want to personalize the way information is displayed for a WSUS server you can do so by clicking on Personalization within Options. This option allows administrators to choose how server rollup data is displayed, what items will be listed in the To Do list, and how validation errors are displayed. Figure 3.62 shows the option to consolidate information from replica downstream servers to your WSUS 3.0 server.

Figure 3.62. General Tab of Personalization

In the To Do List tab, you can choose which items will be shown in the To Do list for that server, as seen in Figure 3.63.

Figure 3.63. To Do List Tab of Personalization

After we installed WSUS 3.0 earlier in this chapter, the next thing we did was run through the Windows Server Update Services Configuration Wizard. This wizard allows administrators to easily configure basic settings for upstream server, proxy server settings, supported languages, products, classifications, and synchronization schedule. If for any reason an administrator needs to re-run this wizard, click on WSUS Server Configuration Wizard under Options.