A while ago now, my friend and fellow MVP, Kevin Royalty wrote an article on how to use the Windows Software Update Services (WSUS) using your Windows Home Server. What this meant is that you could use WSUS to download any Microsoft updates and have your computers get the updates from the WSUS instead of each one having to go out to the Internet for updates. This also meant that you could control what updates are installed.

Kevin has since updated the article to include an automated way of performing maintenance. So, here it is – thanks Kevin!

By Kevin Royalty, SBS MVP

Thanks to many of the Small Business Server and Home Server MVPs for their invaluable input and suggestions to improve this document. I’m proud to be one of you.

Thanks to Andrew Edney for hosting this update on UsingWindowsHomeServer.

Part 1 – Windows Server Update Services v3 (WSUS)

Most of the computer savvy folks know what Windows Server Update Services (WSUS) are. Basically, it is a local copy of Windows Update/Microsoft Update that you control what gets “approved” for installation on the PCs that report to it. Why would you want to do this at home you may ask? Well, if you want to know that your PCs are being kept up to date on all Microsoft patches, or even block certain patches until you want them (IE 7 for example).

There are a myriad of things you can do with WSUS, so to get the full skinny on it, surf to http://technet.microsoft.com/wsus to read up on it. Documents you want to have handy for reference are: WSUS 3.0 Overview, Deploying WSUS 3.0, WSUS 3.0 Operations Guide and most importantly the WSUS Deployment Whitepaper. I do recommend that you read these to get familiar with WSUS before diving into the rest of this HowTo. If you are not a computer-savvy person (an IT Pro), you should not continue beyond this point.

Keep this in mind before embarking on this project:

· You will probably need more than the minimum of 512MB of RAM in your WHS box before proceeding.

· WSUS uses a Windows Internal Database instance that runs all the time, and this takes up ram/resources. This can be more important for some of the pre-made WHS units (like the HP MediaSmart Server) that are known to use more RAM than is installed (task manager is your friend).

· We will “limit” the RAM this instance takes at the end of the installation to keep it under control and allow you to do more with your server.

· YOU control what gets installed on your PCs from Microsoft, so PCs that STAY on your network are good candidates. There is a way to update “roaming” computers – see later in this document for how to do this.

· The more PCs you have on your network that report to WSUS, the overall bandwidth savings you should see, but this can vary wildly based on what is in your environment. YMMV.

Let’s get the pieces!

We need to download some pieces from Microsoft to get started.

· WSUS 3.0 x86 installer (WHS is currently 32-bit only, so skip the x64 version for now)

· .NET Framework 2 Service Pack 1

· Microsoft Report Viewer 2008 (find this on www.microsoft.com/downloads and search for it or grab this one at http://support.microsoft.com/kb/933137

Also, you will need to download the following utilities from http://www.codeplex.com/wsus

You want to download the “WSUS Cleanup Tool” at http://www.codeplex.com/WSUS/Release/ProjectReleases.aspx?ReleaseId=17612

If you have selected the “Drivers” category, you want to also grab the “Driver Decline tool” at http://www.codeplex.com/WSUS/Release/ProjectReleases.aspx?ReleaseId=16459

1. Install the report viewer first. Accept all the defaults and you are done. No reboot required.

2. Install .NET Framework 2 Service Pack 1, accepting the defaults and reboot when done (you will be prompted to do so).

3. Now we want to install the WSUS software. (some text from Microsoft’s document titled WSUS 3.0 StepbyStep.doc. Screenshots from an HP Mediasmart 2-drive unit)

4. Double-click the installer file, WSUS3Setupx86.exe.

5. There should be an Open File security warning. Click RUN.

6. On the Welcome page of the installation wizard, click Next.

7. On the Installation Mode Selection page, click Full server installation including Administration Console.

8. On the License Agreement page, read the terms of the license agreement carefully, click I accept the terms of the License agreement, and then click Next.

9. On the Select Update Source page of the installation wizard, you can specify where clients get updates. If you select the Store updates locally check box, updates are stored on the WSUS 3.0 server, and you select a location in the file system to store updates. If you do not store updates locally, client computers connect to Microsoft Update to get approved updates.

Note

We only have a limited amount of disk space on the WHS C: drive, so we want to put this on a larger internal or external drive. Best Practice is to put it on an external drive that won’t be part of the WHS “Drive pool” of space. The internal database is actually installed to C:\WINDOWS\SYSMSI\SSEE\MSSQL.2005\MSSQL\Data The SQL log will continue to grow unless you backup the database or manually truncate the log. Now click Next.

10. On the Database Options page, select the software used to manage the WSUS 3.0 database. By default, WSUS Setup offers to install Windows Internal Database, if the computer on which you are installing runs Windows Server 2003 (the OS that WHS runs on).

Note

It should auto-detect the largest amount of free space and select that drive, but you can override it if you wish. Best Practice would be to use an external drive connected that isn’t part of the WHS “drive pool”. Click Next to continue.

11. On the Web Site Selection page, specify the Web site that WSUS 3.0 will use. On WHS, create an alternate site on port 8530 by selecting the second
option. Depending on the way your WHS server is configured, you may only have the 2^nd option available and this is ok. Click Next.

12. On the Ready to Install Windows Server Update Services page, review the selections, and then click Next.

13. The final page of the installation wizard will tell you whether or not the WSUS 3.0 installation was completed successfully. After you click Finish the configuration wizard will be launched. If you don’t see the wizard you can start it manually by clicking Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0. Once it launches, drill down to the Options, scroll down the center screen, and click the WSUS Server Configuration Wizard.

Note

You can accept most of the defaults of the configuration wizard – almost all of them won’t apply to you in this home environment. We now want to start the administration console for WSUS 3 and configure it.

14. On the server console, click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0. (you might want to shortcut this to your desktop, or pin it to the start menu)

15. Skip to “Connecting your PCs” if you used the wizard to configure your updates. The next section is for going back later to make changes to your selections.

Configure Updates and Set Up Synchronization

Before downloading updates, you will need to specify which updates you want to download. This section describes how to configure the set of updates you wish to download.

The next four procedures describe how to configure your updates using the configuration wizard.

Choose update languages

Choose update products

Choose the update classifications

Configure the synchronization schedule

After you have completed all of the above configuration steps, select the Finished page in the configuration wizard. You can launch the WSUS Administration console by leaving the Launch the Windows Server Update Services Administrations snap-in check box selected, and you can start the first synchronization by leaving the Begin initial synchronization check box selected.

Note

You cannot save configuration changes that are made while the server is synchronizing. Wait until synchronization is finished to make your changes.

Getting Notified

If you’d like to be notified by your WSUS of any updates or status of updates installed, you need to do the following.

1. Launch the WSUS Administration console: Click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services.

2. Select Options under your WSUS server in the left pane.

3. Click Email Notifications

4. Fill out both tabs (you will need a valid SMTP server for this to work)

5. Filling out “send e-mail notifications when new updates are synchronized” will send you at least one email a day from your WSUS telling you about all the update details it has synced. Note that it won’t actually download the updates, just the metadata describing them. It only downloads updates that actually are needed, and only when you tell it to do so (unless you have auto-approve rules).

6. The “send status reports” is what you may want to use, as it will tell you if a computer failed an update, so you can go back into the WSUS console and see what happened. Normally, I have this set to weekly.

The following procedures explain how to perform the above configuration steps through the Options page of the WSUS Administration console:

· Choose products and classifications

· Update files and languages

Choose products and classifications

Update files and languages

After you configure the network connection, you can download updates by synchronizing the WSUS server.

Synchronization involves the WSUS server contacting Microsoft Update. After making contact, WSUS determines whether any new updates have been made available since the last time you synchronized. Because this is the first time you are synchronizing the WSUS server, all of the updates are available and are ready for your approval for installation. The initial synchronization may take a fairly long time.

Note

This document describes synchronizing with the default settings, but WSUS includes options that enable you to minimize bandwidth use during synchronization.

To synchronize your WSUS server

Note

If you do not see the Actions pane on the right side of the console, on the console toolbar click View, click Customize, and ensure that the Action pane check box is selected.

After the synchronization finishes, click Updates in the left panel to view the list of updates.

Connecting your PCs:

Now we need to “join” your WHS connected PCs to WSUS. Here is a registry script that sets things to a best practice default. This was taken from an SBS Server network running WSUS 3. If you wish to research and modify it yourself go ahead.

Copy and paste the following text into notepad and save it with a name like WHS-INT-WSUS.REG filename. The .REG extension is necessary when we get to the workstations and install it.

Disclaimer: Use Registry Editor at your own risk. If you use Registry Editor incorrectly, you can cause serious problems that may require you to reinstall your operating system. This information is provided on an “as is” basis and all risk is with you. Improper use of Regedit can also make you sterile.  I make no warranties, express, implied or statutory, as to any matter whatsoever, and I do not guarantee that problems that you cause by using Registry Editor incorrectly can be resolved.

Important Safety Note: Since we are messing with the registry, please BACK UP your registry or at least the key below before overwriting with the below info.

— begin cut-n-paste below —

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]

“WUServer”=”http://server:8530/”

“WUStatusServer”=”http://server:8530/”

“ElevateNonAdmins”=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

“NoAutoUpdate”=dword:00000000

“AUOptions”=dword:00000004

“ScheduledInstallDay”=dword:00000000

“ScheduledInstallTime”=dword:00000005

“NoAutoRebootWithLoggedOnUsers”=dword:00000001

“AutoInstallMinorUpdates”=dword:00000001

“NoAUShutdownOption”=dword:00000000

“NoAUAsDefaultShutdownOption”=dword:00000000

“UseWUServer”=dword:00000001

“RescheduleWaitTimeEnabled”=dword:00000001

“RescheduleWaitTime”=dword:00000005

“DetectionFrequencyEnabled”=dword:00000001

“DetectionFrequency”=dword:00000004

“RebootRelaunchTimeoutEnabled”=dword:00000000

“RebootWarningTimeoutEnabled”=dword:00000001

“RebootWarningTimeout”=dword:00000005

“IncludeRecommendedUpdates”=dword:00000001

“AUPowerManagement”=dword:00000001

— End cut-n-paste above –

Save this file in the \\server\software folder. Go to a workstation and open the Shared Folders on Server icon. Open the Software folder. Double-click on the WHS-INT-WSUS.REG file and acknowledge that you want to add this to the registry.

Once you’ve done this, click Start then Run and type WUAUCLT /resetauthorization /detectnow and click OK. This will force the PC to check in with the WSUS service on the WHS server.

You can do this on all your Internal networked PCs now, or do one and wait before doing the others.

Note

I don’t recommend you have your WHS server report to WSUS for it’s updates, due to the fact that currently WHS updates aren’t under their own classification, and you may miss updates you need. So, please don’t run the REG file on the WHS server.

External/Roaming PCs

If you wish to control PCs that are not internal to your network (college students away from home) take the same REG file above and change the URLs on the WUServer and WUStatusServer lines to the external names for your WHS server. E.G. http://myserver.homeserver.com:8530/ where “myserver” is the domain name you chose when configuring external access to your server. Save the new file as WHS-EXT-WSUS.REG and run it on the roaming computers. When the machines “come back home” you’ll need to use the WHS-INT-WSUS.REG file on them, and vice-versa when they leave again.

Note

You’ll also need to open up port 8530 in your router and forward it to the WHS server. Consult your router documentation for how to do this.

Create a Computer Group for Updates

Computer groups are an important part of WSUS deployments, even a basic deployment. Computer groups enable you to target updates to specific computers. There are two default computer groups: All Computers and Unassigned Computers. By default, when each client computer initially contacts the WSUS server, the server adds that client computer to each of these groups.

You can create custom computer groups. One benefit of creating computer groups is that they enable you to test updates before deploying updates widely. If testing goes well, you can roll out the updates to the All Computers group. There is no limit to the number of custom groups you can create. A suggestion would be to have a “test” group that auto-approves everything and the other group “normal” would be set to manual approval.

To set up computer groups

You can use this step to set up a test group that contains at least one test computer.

· Create a group.

· Add a computer to the group.

To create a group

Use the next procedure to assign a client computer to the test group. A client computer appropriate for testing is any computer with software and hardware indicative of the majority of computers on your network, but not a computer assigned to a critical role. In this way, you can tell how well computers like the test computer will fare with the updates you approve.

To add a computer to the group

Approve and Deploy Updates in WSUS 3.0

In this step, you approve an update for any test client computers in the test group. Computers in the group will contact the WSUS server over the next 24 hours. After this period, you can use the WSUS reporting feature to determine if those updates have been deployed to the computers. If testing goes well, you can then approve the same updates for the rest of the computers in your organization.

· Approve and deploy an update.

· Check the status of the update.

To approve and deploy an update

Note

Many options are associated with approving updates, such as setting deadlines and uninstalling updates.

After 24 hours, you can use the WSUS reporting feature to determine whether the updates have been deployed to the computers.

To check the status of an update

If the updates were successfully deployed to the test group, you can approve the same updates for the rest of the computers in your organization.

Automated Maintenance of WSUS

In the previous version of this guide, it was a good idea manually run maintenance every month. Now this process is automated J

Unzip the WSUS Cleanup Tool and optionally the Driver Decline Tool into the WSUS directory on your home server

Set up a Scheduled Task (start..control panel…scheduled tasks) for the WSUS_Cleanup_CL.exe to run weekly at an off time that doesn’t conflict with backups or normal use of the server

The Driver Decline tool you can run once (only needed if you have the Drivers category selected), or schedule it to run monthly if you wish.

Now your WSUS cleanup is now totally automated!

Limiting the RAM for the Windows Internal Database instance

The Windows Internal Database instance can eat up RAM if we let it, and we don’t want it to do that. WSUS instances can be safely tuned for small networks. We easily do this via a script. Feel free to experiment with the script for your network, but this is what I use at many customers for networks of up to 75 computers.

We need more downloads before we can continue. Browse to here to get Microsoft Core XML Services (MSXML) 6.0 http://www.microsoft.com/downloads/details.aspx?familyid=993C0BCF-3BCF-4009-BE21-27E85E1857B1&displaylang=en install it, then http://go.microsoft.com/fwlink/?LinkId=65110 and install it. You’ll need tool to help you manage SQL 2005 embedded.

Run the Microsoft SQL Server Management Studio Express (via start..all programs). Enter \\.\pipe\mssql$microsoft##ssee\sql\query in the computer query field.

Click “Connect” and wait for the screen to change. Right-click on the top and select Properties.

The below settings change the RAM limit for WSUS to 256Meg. As I mentioned on page 1 of this article, that works fine for networks I manage of up to 75 computers. You may be able to lower it and have no ill effects for networks of under 10 PCs connected to your WHS server. I wouldn’t go below 128 however.

Once you make the changes, click OK and close the SQL Management Studio. You are done! The changes made take effect immediately and do not require a reboot of your WHS server.