26/1/2018 Configure Windows Server Update Services 2012

About Advertise

Forums Webinars

Petri Thurrott

Windows Virtualization Cloud / SaaS O ce 365 SharePoint PowerShell Security

Home / Windows Server Update Services 2012: Con guration

Windows Server Update Services 2012: Con guration

Posted on June 6, 2013 by Russell Smith in Windows Server 2012 with 1 Comment

 Share  Tweet  Pin it  +1  Reddit  Share  Share

In part one of this series about Windows Server Update Services (WSUS) in Windows Server 2012, I described how to install
the necessary prerequisite components for WSUS and how to carry out post-installation tasks. Today in part two, I’ll cover
how to con gure client computers to use your local WSUS instead of Microsoft Update, and how to con gure WSUS to
distribute updates to di erent groups of computers. Finally, in part three, I’ll go over WSUS 2012, reporting, and PowerShell.

https://www.petri.com/windows-server-update-services-2012-configuration 1/8
26/1/2018 Configure Windows Server Update Services 2012

Con guring Client Computers to Use WSUS

To con gure our client computers to connect to the new WSUS server, we’re going to create a Group Policy Object (GPO) to
apply the necessary settings across the selected devices:

1. In Server Manager, click Group Policy Management from the Tools menu.
2. Expand your AD forest and domain in the left pane of the Group Policy Management Console (GPMC). Right-click your AD
domain and select Create a GPO in this domain, and Link it here… from the menu.
3. In the New GPO dialog, name the new GPO WSUS and click OK.
4. Right-click the WSUS GPO under your domain in the left pane of GPMC and select Edit from the menu. The Group Policy
Management Editor will open in a separate window.
5. In the Group Policy Management Editor window, expand Computer Con guration > Policies > Administrative
Templates > Windows Components and click Windows Update.
6. In the right pane, double-click Con gure Automatic Updates.
7. In the Con gure Automatic Updates dialog, select Enabled.
8. Under Options, select Auto download and notify for install and click OK.
9. In the Group Policy Management Editor, double click Specify intranet Microsoft update service location.
10. Check Enabled in the policy dialog box and type http://<servername>:8530 for the intranet update service and intranet
statistics server under Options, replacing <servername> with the name of your WSUS server. Click OK to continue.

Don’t forget that Group Policy settings can take up to 90 minutes to apply. If you want to speed up this process to test if your
WSUS con guration is working, log on to a machine in your domain with local administrator privileges and run gpupdate
/force followed by wuauclt.exe /detectnow. Then open Windows Update in the Control Panel and click Check for updates.

https://www.petri.com/windows-server-update-services-2012-configuration 2/8
26/1/2018 Configure Windows Server Update Services 2012

Even if there are no available approved updates on your WSUS server, the local machine should connect to WSUS and report
that no update are available.

Create a WSUS Group

By default there are two WSUS groups: All Computers and Unassigned Computers. As a minimum, you should create an
additional group that will include a selection of computers that you use for testing before deploying updates to all devices.

1. Open Server Manager on your WSUS server from the desktop Task Bar or Start screen.
2. Select Windows Server Update Services from the Tools menu.
3. In the Update Services management console, expand Computers in the left pane and select All Computers. In the central
pane, you should see all computers in your domain that are using WSUS to receive updates.
4. In the Actions pane on the right, click Add Computer Group…
5. In the Add Computer Group dialog, name the new group Testing and click Add.
6. In the left pane, click All Computers. Right-click a computer(s) you want to add to the new Testing group and select
Change Membership from the menu.
7. In the Set Computer Group Membership dialog, check the Testing group and click OK.
8. Now click the Testing group in the left pane under Computers and you should see any computers you selected in the last
step listed.

https://www.petri.com/windows-server-update-services-2012-configuration 3/8
26/1/2018 Configure Windows Server Update Services 2012

Approve Updates Manually

Before WSUS will distribute any updates to clients, they must be approved by an administrator. It’s also possible to set
updates to be automatically approved.

1. Start by checking that WSUS has successfully synchronized updates by clicking Synchronizations in the left pane of the
Update Services management console. There you should see at least one successful report. If not, right click
Synchronizations in the left pane and select Synchronize Now from the menu and wait for the sync to complete.
2. Once updates have been synchronized from Microsoft Update to WSUS, expand Updates in the left pane and select
Critical Updates.
3. For testing purposes, I’m going to approve only one update. Right-click the rst update shown in the central pane and
select Approve from the menu.
4. In the Approve Updates dialog, click the icon to the left of the Testing group, select Approve for Install from the menu and
click OK.
5. Click Close in the Approval Progress dialog once the approval process has completed.

https://www.petri.com/windows-server-update-services-2012-configuration 4/8
26/1/2018 Configure Windows Server Update Services 2012

Log on to a machine on your network that’s a member of the WSUS Testing group as a local administrator, open Windows
Update in the Control Panel and click Check for updates. You should now see an update available for download. Click Install
updates to make sure everything is working properly.

Sponsored

https://www.petri.com/windows-server-update-services-2012-configuration 5/8
26/1/2018 Configure Windows Server Update Services 2012

Con gure Automatic Approvals

If you don’t want to manually approve every update, WSUS allows you to automatically approve updates according to a simple
set of rules. In this example, I’m going to approve all updates for the Testing group.

1. In the left pane of the Update Services management console, click Options.
2. In the central pane, click Automatic Approvals.
3. On the Update Rules tab in the Automatic Approvals dialog, click New Rule.
4. In the Add Rule dialog, click all computers under Step 2.
5. In the Choose Computer Groups dialog, deselect all groups apart from Testing and click OK.
6. In the Add Rule dialog, name the rule Testing in Step 3 and click OK.
7. Make sure the Testing rule is selected and checked in the Automatic Approvals dialog and click Run Rule.

https://www.petri.com/windows-server-update-services-2012-configuration 6/8
26/1/2018 Configure Windows Server Update Services 2012

Tagged with Windows Server 2012, Windows Server Update Services, WSUS

1 Comment The Petri It Knowledgebase 

1 Login

Sort by Best
 Recommend ⤤ Share

Join the discussion…

LOG IN WITH
OR SIGN UP WITH DISQUS ?

Name

azedas101 • 3 years ago

Thank you for the above step-by-step guide. Its really straight forward. I have been able to work through the above guide.
https://www.petri.com/windows-server-update-services-2012-configuration 7/8
26/1/2018 Configure Windows Server Update Services 2012

Now my question are as follows;

1. If Automatic Approvals is configured does it mean there is no need for Admin to approve anymore?
2. What are the disadvantages of configuring Automatic Approvals on All Computers?

Please consider this as an urgent need.

Thank you.
△ ▽ • Reply • Share ›

ALSO ON THE PETRI IT KNOWLEDGEBASE

Google’s Bringing a Unified Security View to G Suite
2 comments • 8 days ago
veer negi — what new administrator task in G suite so that i
manage my domain cruntly we have 250 user licence in G
suite but i can,t nothing about G suite administrator task i …
Change the System Partition From MBR to GPT in
Windows 10
6 comments • 14 days ago
Mikie — If it helps at all, according to Wikipedia -- linked in
earlier post -- UEFI requires boot files stored in/on a FAT file
system, & FAT32 fits the bill.RE: Win-2-go, here are a …

Protect Users Against Malicious Websites Using
Windows 10 Application Guard
2 comments • 16 days ago
Russell Smith — I don't know the answer to your question.
But I see it's been logged as a problem in the Feedback Hub.
The more upvotes the better. Although I think it's unlikely …
Paul Thurrott's Short Takes: January 26 - Petri
2 comments • 2 hours ago
Essam Almohammadi — "And market leader Twitter grew
almost 200 percent"; is this supposed to be Twitch instead of
Twitter?

✉ Subscribe d Add Disqus to your siteAdd DisqusAdd 🔒 Privacy

© 2018 Blue Whale Web Media Group

https://www.petri.com/windows-server-update-services-2012-configuration 8/8