A while ago now, my friend and fellow MVP, Kevin Royalty wrote an article on how to use the Windows Software Update Services (WSUS) using your Windows Home Server. What this meant is that you could use WSUS to download any Microsoft updates and have your computers get the updates from the WSUS instead of each one having to go out to the Internet for updates. This also meant that you could control what updates are installed.
Kevin has since updated the article to include an automated way of performing maintenance. So, here it is – thanks Kevin!
By Kevin Royalty, SBS MVP
Thanks to many of the Small Business Server and Home Server MVPs for their invaluable input and suggestions to improve this document. I’m proud to be one of you.
Thanks to Andrew Edney for hosting this update on UsingWindowsHomeServer.
Part 1 – Windows Server Update Services v3 (WSUS)
Most of the computer savvy folks know what Windows Server Update Services (WSUS) are. Basically, it is a local copy of Windows Update/Microsoft Update that you control what gets “approved” for installation on the PCs that report to it. Why would you want to do this at home you may ask? Well, if you want to know that your PCs are being kept up to date on all Microsoft patches, or even block certain patches until you want them (IE 7 for example).
There are a myriad of things you can do with WSUS, so to get the full skinny on it, surf to http://technet.microsoft.com/wsus to read up on it. Documents you want to have handy for reference are: WSUS 3.0 Overview, Deploying WSUS 3.0, WSUS 3.0 Operations Guide and most importantly the WSUS Deployment Whitepaper. I do recommend that you read these to get familiar with WSUS before diving into the rest of this HowTo. If you are not a computer-savvy person (an IT Pro), you should not continue beyond this point.
Keep this in mind before embarking on this project:
· You will probably need more than the minimum of 512MB of RAM in your WHS box before proceeding.
· WSUS uses a Windows Internal Database instance that runs all the time, and this takes up ram/resources. This can be more important for some of the pre-made WHS units (like the HP MediaSmart Server) that are known to use more RAM than is installed (task manager is your friend).
· We will “limit” the RAM this instance takes at the end of the installation to keep it under control and allow you to do more with your server.
· YOU control what gets installed on your PCs from Microsoft, so PCs that STAY on your network are good candidates. There is a way to update “roaming” computers – see later in this document for how to do this.
· The more PCs you have on your network that report to WSUS, the overall bandwidth savings you should see, but this can vary wildly based on what is in your environment. YMMV.
Let’s get the pieces!
We need to download some pieces from Microsoft to get started.
· WSUS 3.0 x86 installer (WHS is currently 32-bit only, so skip the x64 version for now)
· .NET Framework 2 Service Pack 1
Also, you will need to download the following utilities from http://www.codeplex.com/wsus
You want to download the “WSUS Cleanup Tool” at http://www.codeplex.com/WSUS/Release/ProjectReleases.aspx?ReleaseId=17612
If you have selected the “Drivers” category, you want to also grab the “Driver Decline tool” at http://www.codeplex.com/WSUS/Release/ProjectReleases.aspx?ReleaseId=16459
1. Install the report viewer first. Accept all the defaults and you are done. No reboot required.
2. Install .NET Framework 2 Service Pack 1, accepting the defaults and reboot when done (you will be prompted to do so).
3. Now we want to install the WSUS software. (some text from Microsoft’s document titled WSUS 3.0 StepbyStep.doc. Screenshots from an HP Mediasmart 2-drive unit)
4. Double-click the installer file, WSUS3Setupx86.exe.
5. There should be an Open File security warning. Click RUN.
6. On the Welcome page of the installation wizard, click Next.
7. On the Installation Mode Selection page, click Full server installation including Administration Console.
8. On the License Agreement page, read the terms of the license agreement carefully, click I accept the terms of the License agreement, and then click Next.
9. On the Select Update Source page of the installation wizard, you can specify where clients get updates. If you select the Store updates locally check box, updates are stored on the WSUS 3.0 server, and you select a location in the file system to store updates. If you do not store updates locally, client computers connect to Microsoft Update to get approved updates.
We only have a limited amount of disk space on the WHS C: drive, so we want to put this on a larger internal or external drive. Best Practice is to put it on an external drive that won’t be part of the WHS “Drive pool” of space. The internal database is actually installed to C:\WINDOWS\SYSMSI\SSEE\MSSQL.2005\MSSQL\Data The SQL log will continue to grow unless you backup the database or manually truncate the log. Now click Next.
10. On the Database Options page, select the software used to manage the WSUS 3.0 database. By default, WSUS Setup offers to install Windows Internal Database, if the computer on which you are installing runs Windows Server 2003 (the OS that WHS runs on).
It should auto-detect the largest amount of free space and select that drive, but you can override it if you wish. Best Practice would be to use an external drive connected that isn’t part of the WHS “drive pool”. Click Next to continue.
11. On the Web Site Selection page, specify the Web site that WSUS 3.0 will use. On WHS, create an alternate site on port 8530 by selecting the second
option. Depending on the way your WHS server is configured, you may only have the 2nd option available and this is ok. Click Next.
12. On the Ready to Install Windows Server Update Services page, review the selections, and then click Next.
13. The final page of the installation wizard will tell you whether or not the WSUS 3.0 installation was completed successfully. After you click Finish the configuration wizard will be launched. If you don’t see the wizard you can start it manually by clicking Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0. Once it launches, drill down to the Options, scroll down the center screen, and click the WSUS Server Configuration Wizard.
You can accept most of the defaults of the configuration wizard – almost all of them won’t apply to you in this home environment. We now want to start the administration console for WSUS 3 and configure it.
14. On the server console, click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0. (you might want to shortcut this to your desktop, or pin it to the start menu)
15. Skip to “Connecting your PCs” if you used the wizard to configure your updates. The next section is for going back later to make changes to your selections.
Configure Updates and Set Up Synchronization
Before downloading updates, you will need to specify which updates you want to download. This section describes how to configure the set of updates you wish to download.
The next four procedures describe how to configure your updates using the configuration wizard.
Choose update languages
|1. The Choose Languages page allows you to get updates from all languages or from a subset of languages. Selecting a subset of languages will save disk space, but it is important to choose all of the languages that will be needed by all of the clients of this WSUS server.
2. If you choose to get updates for only a few languages, select Download updates only in these languages, and select the languages for which you want updates. Click Next to go to the Choose Products page, or select a different page from the left panel.
Choose update products
|1. The Choose Products page allows you to specify the products for which you want updates.
2. You may check product categories, such as Windows, or specific products, such as Windows Server 2003. Selecting a product category will cause all of the products under it to be selected. Click Next to proceed to the Choose Classifications page, or select a different page from the left panel.
Choose the update classifications
|1. The Choose Classifications page allows you to choose the update classifications you wish to obtain. You can choose all the classifications or a subset of them. Critical Updates and Security Updates are selected by default. Click Definition Updates of you have any Vista computers. This insures that the more frequent Windows Defender updates are included.
2. Click Next to proceed to the Configure Sync Schedule page, or select a different page from the left panel.
Configure the synchronization schedule
|1. You will see the Set Sync Schedule page, which allows you to choose whether to perform synchronization manually or automatically.
2. Choose to synchronize automatically, the WSUS server will synchronize at specified intervals. Set the time of the first synchronization and specify 1 synchronizations per day.
After you have completed all of the above configuration steps, select the Finished page in the configuration wizard. You can launch the WSUS Administration console by leaving the Launch the Windows Server Update Services Administrations snap-in check box selected, and you can start the first synchronization by leaving the Begin initial synchronization check box selected.
You cannot save configuration changes that are made while the server is synchronizing. Wait until synchronization is finished to make your changes.
If you’d like to be notified by your WSUS of any updates or status of updates installed, you need to do the following.
1. Launch the WSUS Administration console: Click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services.
2. Select Options under your WSUS server in the left pane.
3. Click Email Notifications
4. Fill out both tabs (you will need a valid SMTP server for this to work)
5. Filling out “send e-mail notifications when new updates are synchronized” will send you at least one email a day from your WSUS telling you about all the update details it has synced. Note that it won’t actually download the updates, just the metadata describing them. It only downloads updates that actually are needed, and only when you tell it to do so (unless you have auto-approve rules).
6. The “send status reports” is what you may want to use, as it will tell you if a computer failed an update, so you can go back into the WSUS console and see what happened. Normally, I have this set to weekly.
The following procedures explain how to perform the above configuration steps through the Options page of the WSUS Administration console:
· Choose products and classifications
· Update files and languages
Choose products and classifications
|1. Launch the WSUS Administration console: Click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services.
2. Select Options under your WSUS server in the left
3. In the middle pane, select Products and Classifications.
4. You will see a dialog box with two tabs: Products and Classifications.
5. In the Products tab, select the product category or specific product for which you want this server to get updates, or else select All Products.
6. In the Classifications tab, select the update classifications you want, or else select All Classifications.
7. Click OK to save your selections.
Update files and languages
|1. In the Options page, select Update Files and Languages.
2. You will see a dialog box with two tabs: Update Files and Update Languages.
3. In the Update Files tab, you can choose whether to store update files locally or to have all client computers install from Microsoft Update. If you choose to store update files on this server, you can choose whether to download only those updates that are approved or to download express installation files.
4. In the Update Languages tab, you can choose to get updates for all languages (the default) or to get updates for only the specified languages.
5. Click OK to save these settings.
After you configure the network connection, you can download updates by synchronizing the WSUS server.
Synchronization involves the WSUS server contacting Microsoft Update. After making contact, WSUS determines whether any new updates have been made available since the last time you synchronized. Because this is the first time you are synchronizing the WSUS server, all of the updates are available and are ready for your approval for installation. The initial synchronization may take a fairly long time.
This document describes synchronizing with the default settings, but WSUS includes options that enable you to minimize bandwidth use during synchronization.
To synchronize your WSUS server
|1. In the WSUS Administration console, select Synchronizations.
2. Right-click or go to the Actions pane on the right, and then click Synchronize now.
If you do not see the Actions pane on the right side of the console, on the console toolbar click View, click Customize, and ensure that the Action pane check box is selected.
After the synchronization finishes, click Updates in the left panel to view the list of updates.
Connecting your PCs:
Now we need to “join” your WHS connected PCs to WSUS. Here is a registry script that sets things to a best practice default. This was taken from an SBS Server network running WSUS 3. If you wish to research and modify it yourself go ahead.
Copy and paste the following text into notepad and save it with a name like WHS-INT-WSUS.REG filename. The .REG extension is necessary when we get to the workstations and install it.
Disclaimer: Use Registry Editor at your own risk. If you use Registry Editor incorrectly, you can cause serious problems that may require you to reinstall your operating system. This information is provided on an “as is” basis and all risk is with you. Improper use of Regedit can also make you sterile. I make no warranties, express, implied or statutory, as to any matter whatsoever, and I do not guarantee that problems that you cause by using Registry Editor incorrectly can be resolved.
Important Safety Note: Since we are messing with the registry, please BACK UP your registry or at least the key below before overwriting with the below info.
— begin cut-n-paste below —
Windows Registry Editor Version 5.00
— End cut-n-paste above –
Save this file in the \\server\software folder. Go to a workstation and open the Shared Folders on Server icon. Open the Software folder. Double-click on the WHS-INT-WSUS.REG file and acknowledge that you want to add this to the registry.
Once you’ve done this, click Start then Run and type WUAUCLT /resetauthorization /detectnow and click OK. This will force the PC to check in with the WSUS service on the WHS server.
You can do this on all your Internal networked PCs now, or do one and wait before doing the others.
I don’t recommend you have your WHS server report to WSUS for it’s updates, due to the fact that currently WHS updates aren’t under their own classification, and you may miss updates you need. So, please don’t run the REG file on the WHS server.
If you wish to control PCs that are not internal to your network (college students away from home) take the same REG file above and change the URLs on the WUServer and WUStatusServer lines to the external names for your WHS server. E.G. http://myserver.homeserver.com:8530/ where “myserver” is the domain name you chose when configuring external access to your server. Save the new file as WHS-EXT-WSUS.REG and run it on the roaming computers. When the machines “come back home” you’ll need to use the WHS-INT-WSUS.REG file on them, and vice-versa when they leave again.
You’ll also need to open up port 8530 in your router and forward it to the WHS server. Consult your router documentation for how to do this.
Create a Computer Group for Updates
Computer groups are an important part of WSUS deployments, even a basic deployment. Computer groups enable you to target updates to specific computers. There are two default computer groups: All Computers and Unassigned Computers. By default, when each client computer initially contacts the WSUS server, the server adds that client computer to each of these groups.
You can create custom computer groups. One benefit of creating computer groups is that they enable you to test updates before deploying updates widely. If testing goes well, you can roll out the updates to the All Computers group. There is no limit to the number of custom groups you can create. A suggestion would be to have a “test” group that auto-approves everything and the other group “normal” would be set to manual approval.
To set up computer groups
|1. Specify how you are going to assign computers to the computer groups. There are two options: server-side targeting and client-side targeting. Server-side targeting involves manually adding each computer to its group by using WSUS. We want Server-side targeting.
2. Create the computer group on WSUS.
3. Move the computers into groups created.
You can use this step to set up a test group that contains at least one test computer.
· Create a group.
· Add a computer to the group.
To create a group
|1. In the WSUS Administration console, expand Computers and select All Computers.
2. Right-click All Computers, or go to the Actions pane and then click Add Computer Group.
3. You will see an Add Computer Group dialog box. Specify the name of the new group.
Use the next procedure to assign a client computer to the test group. A client computer appropriate for testing is any computer with software and hardware indicative of the majority of computers on your network, but not a computer assigned to a critical role. In this way, you can tell how well computers like the test computer will fare with the updates you approve.
To add a computer to the group
|1. In the WSUS Administration console, click Computers.
2. Click the group of the computer you want to move.
3. In the list of computers, select the computer you want to move.
4. Right-click Change Membership.
5. You will see a dialog box, Set Computer Group Membership, with a list of groups.
6. Check the group to which you want to move the computer, and then click OK.
Approve and Deploy Updates in WSUS 3.0
In this step, you approve an update for any test client computers in the test group. Computers in the group will contact the WSUS server over the next 24 hours. After this period, you can use the WSUS reporting feature to determine if those updates have been deployed to the computers. If testing goes well, you can then approve the same updates for the rest of the computers in your organization.
· Approve and deploy an update.
· Check the status of the update.
To approve and deploy an update
|1. On the WSUS Administration console, click Updates. Doing so will display a summary of updates in the default views (All Updates, Critical Updates, Security Updates, and WSUS Updates). Use All Updates for this procedure.
2. On the list of updates, select the updates you want to approve for installation. Information about a selected update is available in the lowermost pane of the Updates panel. To select multiple contiguous updates, press and hold down the SHIFT key while clicking updates; to select multiple noncontiguous updates, press and hold down the CTRL key while click updates.
3. Right-click the selection and click Approve. The Approve Updates dialog box appears.
4. Select one of the groups (for example, Test) and click the arrow to its left. You will see a context menu with the choices Approved for Install, Approved for Removal, Not Approved, Deadline, Same as Parent, and Apply to Children. Click Approved for Install and then click OK.
5. You will see a new window, Approval Progress, which shows progress of the different tasks affecting the approval of the updates. When approval is completed, click Close to close this window.
Many options are associated with approving updates, such as setting deadlines and uninstalling updates.
After 24 hours, you can use the WSUS reporting feature to determine whether the updates have been deployed to the computers.
To check the status of an update
|1. In the WSUS Administration console, click Reports in the left pane.
2. On the Reports page, you will see a number of standardized reports. Click the Update Status Summary report. You will see the Updates Report window.
3. If you want to filter the list of updates, select the criteria you want to use (for example, Include updates in these classifications), and then click Run Report on the window’s toolbar.
4. You will see the Updates Report pane. You can check the status of individual updates by selecting the update in the left section of the pane. The last section of the report pane shows the status summary of the update.
5. You can save or print this report by clicking the appropriate icon on the toolbar.
If the updates were successfully deployed to the test group, you can approve the same updates for the rest of the computers in your organization.
Automated Maintenance of WSUS
In the previous version of this guide, it was a good idea manually run maintenance every month. Now this process is automated J
Unzip the WSUS Cleanup Tool and optionally the Driver Decline Tool into the WSUS directory on your home server
Set up a Scheduled Task (start..control panel…scheduled tasks) for the WSUS_Cleanup_CL.exe to run weekly at an off time that doesn’t conflict with backups or normal use of the server
The Driver Decline tool you can run once (only needed if you have the Drivers category selected), or schedule it to run monthly if you wish.
Now your WSUS cleanup is now totally automated!
Limiting the RAM for the Windows Internal Database instance
The Windows Internal Database instance can eat up RAM if we let it, and we don’t want it to do that. WSUS instances can be safely tuned for small networks. We easily do this via a script. Feel free to experiment with the script for your network, but this is what I use at many customers for networks of up to 75 computers.
We need more downloads before we can continue. Browse to here to get Microsoft Core XML Services (MSXML) 6.0 http://www.microsoft.com/downloads/details.aspx?familyid=993C0BCF-3BCF-4009-BE21-27E85E1857B1&displaylang=en install it, then http://go.microsoft.com/fwlink/?LinkId=65110 and install it. You’ll need tool to help you manage SQL 2005 embedded.
Run the Microsoft SQL Server Management Studio Express (via start..all programs). Enter \\.\pipe\mssql$microsoft##ssee\sql\query in the computer query field.
Click “Connect” and wait for the screen to change. Right-click on the top and select Properties.
The below settings change the RAM limit for WSUS to 256Meg. As I mentioned on page 1 of this article, that works fine for networks I manage of up to 75 computers. You may be able to lower it and have no ill effects for networks of under 10 PCs connected to your WHS server. I wouldn’t go below 128 however.
Once you make the changes, click OK and close the SQL Management Studio. You are done! The changes made take effect immediately and do not require a reboot of your WHS server.