WSUS 3

[Bradtechonline]

I got WSUS running, and see computers connecting to it, and have automatic approval set.. However I see computers needing updates but they are not installing them automatically even though I have them set to do so.. i got a GPO setup to connect to my WSUS server the path is http://wsus1 which is the netbios/dns name of the server.. Can't really even tell if it is connecting to my WSUS server to install these updates or the windows update website.. It all seems the same..

 

[tr1kstanc3]

from the client computer go to the command prompt and type: wuauclt.exe /detectnow
(this should force the client to find http://wsus1 on the network)

you pointed the workstations using local computer policy or GPO on a domain? make sure this is working properly. dns server is tested as well from the workstations?

goodluck.

 

[Genx87]

You have to set the automatic updates to install at a set time via that gpo. Tell the clients where the WSUS server only gets them to connect and tell the server what it needs.

 

[Bradtechonline]

Thank you for the help. Here are my current setting via a Domain Wide GPO..

http://img524.imageshack.us/my.php?image=wsuskf9.jpg

 

[TheKub]

What are your settings in "Configure Automatic Updates"?

 

[Bradtechonline]

Originally posted by: TheKub
What are your settings in "Configure Automatic Updates"?

3 - Auto download and notify for install


2 - Every Monday

12:00

 

[TheKub]

Im going to assume that most users do not have admin rights to the local machine and because "allow non admins to receive update notifications" is not configured they are not getting prompted for installation. "allow AU immediate installation" will only allow patches that don't effect services or the users session which is only a small subset of all patches.

I'd recommend using setting 4 to force the install and not to leave it up to the user.

Enable "reschedule automatic updates scheduled installations" and set it to like 1. If a machine was off during noon next time it powers on it will wait X min and do the installation automatically.

If your concerned about automatically restarting the PC on someone enable the "delay restart for scheduled installations" then when an update that requires a reboot gets installed they will get a prompt telling them the machine will restart in XX min. They have an option to delay the reboot. Then enable "re-prompt for restart with scheduled installations" so that if the do dismiss the original reboot request after XX min they will get another prompt that they can accept or ignore for another XX min.

 

[Agamar]

Have you verified that the client machines have the latest GPO? Try running a GPUPDATE on the client, or rebooting it. I have WSUS 3 set up and it does take a while for some of the clients to pull down the GPO. Easiest way to tell for XP machines is force them to update only to the WSUS server in the GPO. If the GPO is active on the PC, then the options will be greyed out for automatic updates.

 

[jdkick]

Definitely review your policies to ensure the settings are actually scheduling installations, not just notifying, and account for user permissions.

To get an idea of what the client is doing, take a look at %WINDIR%\WindowsUpdate.log. You can also run the client diagnostic tool (http://technet.microsoft.com/en-us/wsus/bb466192.aspx) to review configuration details.

 

[Genx87]

Have it set to install automatically and make sure it allows non-admins to install those updates. Secondly as a nice gesture I always set the dont reboot option and then bug them every 60 mins to reboot.

 

[TheKub]

Originally posted by: Genx87
Have it set to install automatically and make sure it allows non-admins to install those updates. Secondly as a nice gesture I always set the dont reboot option and then bug them every 60 mins to reboot.

I would like to be able to do that but if we don't force\nag our users they won't do it, they would be happy to leave their systems powered up for 3 months. All the while I'm scratching my head why 20% of the machines are only partially updated.

Also, our updates are set to run at 11 PM so the only people that should get be bothered are the facilities that are 24 hour.

 

[Genx87]

I find a simple email to the trouble makers works. Otherwise create a new policy for the ones who refuse to reboot named "annoying employee". Put them in that policy and spam the prompt once a minute. It is amazing how fast those machines get rebooted

Of course each organization has its own issues. But the few I have done this for the above works fine. I would say 95% of the machines on the network are patched within 48 hours of issuing the patch.

 

[TheKub]

Originally posted by: Genx87
I find a simple email to the trouble makers works. Otherwise create a new policy for the ones who refuse to reboot named "annoying employee". Put them in that policy and spam the prompt once a minute. It is amazing how fast those machines get rebooted

Na, I prefer a single solution for all users versus micromanaging problem users.

 

[Genx87]

The problem I run into with a single solution is there are users who run reports, db queries, other operations at night. They come in the morning with a rebooted computer and call me pissed off they are behind or their data corrupted. Also servers are an issue. If you have worked with this technology you understand it is great but not terribly reliable in terms of the time the actual update gets installed. I set our time for 3:00AM. I have had servers reboot themselves hours later in the middle of the work day. Which is problematic as you can assume.

To each their own of course. Like I said if I worked in an evionrment with thousands of users it may be a different story. I work with hundreds of users and the micromanaging really isnt that much of a problem. Rarely do I have people who are on the network be more than 2 days behind. And I have only had to invoke the nuclear 1 min prompt policy once His computer was rebooted within 10 mins of coming in the morning.

 

[TheKub]

Originally posted by: Genx87
The problem I run into with a single solution is there are users who run reports, db queries, other operations at night. They come in the morning with a rebooted computer and call me pissed off they are behind or their data corrupted.

All the users that generate reports here have the reports generated by the server. So the only people negatively effected by the required reboot is by chance someone working ridiculously late, or the minority of 24 hour areas.

Originally posted by: Genx87
Also servers are an issue. If you have worked with this technology you understand it is great but not terribly reliable in terms of the time the actual update gets installed.

Good point so its a good thing that someone had enough fore site to segregate servers from the other user OUs so that the servers are unaffected by the users update policy.