install and configure wsus 3

Information Technology Blog

By Raihan Al-Beruni

Home

About Me

Contact Me

TechNet References

Tutorials

Install and configure WSUS 3.0 SP2 – Step-By-Step

48 Votes

Microsoft Windows Server Update Services 3.0 SP2 (WSUS 3.0 SP2) enables information technology administrators to deploy the

latest Microsoft updates, hotfixes and service packs to computers running Microsoft Windows Server 2003 family, Windows Server

2008, Microsoft Windows Vista family, Microsoft Windows XP with Service Pack 2 operating systems. By using WSUS,

administrators can fully manage and take control of the distribution of updates that are released through Microsoft Update.

Prerequisites for WSUS server

Windows Server 2003 SP1 or Windows Server® 2008

Microsoft Internet Information Services (IIS) 6.0 or later

Windows Installer 3.1 or later

Microsoft .NET Framework 2.0

Microsoft Report Viewer Redistributable 2005

Microsoft Management Console 3.0

SQL Server 2005 SP1 or later

Prerequisites for WSUS clients (x86 and x64)

Windows XP SP2, Windows Vista, Windows 7

Windows Server 2003 or Windows Server 2008

WSUS Deployment Scenarios

WSUS is flexible enough to deploy starting from small to enterprise organisation. just you need to make sure active directory, DNS

and DHCP working perfect. If port 80 is occupied by your company web site you can use port 8530. I used port 8530 on WSUS

server. I have ISA 2004 so I will show how to add WSUS publishing rule in ISA 2004 also.

Install Prerequisites

1. IIS installation

go to add/remove windows component and select Application server

Install and configure WSUS 3.0 SP2 – Step-By-Step « Information Techno... http://araihan.wordpress.com/2009/08/13/install-and-configure-wsus-3-0...

1 of 46 06/09/2011 5:59 PM

click next

Select as above. you must select ASP.net and IIS, then check Internet Information Services and click Details.


2 of 46 06/09/2011 5:59 PM

Check BITS, check IIS manager and click on details

Check ASP and WWW and click ok.


3 of 46 06/09/2011 5:59 PM

2. MMC 3.0 installation

no need to install you installed service pack on your server

3. .net framework installation

Download .net 2 framework from the link http://www.microsoft.com/downloads/details.aspx?FamilyID=0856EACB-4362-4B0D-

8EDD-AAB15C5E04F5&displaylang=en

run installation, click next, accept EULA and follow the installation screen.


4 of 46 06/09/2011 5:59 PM

4. MS report viewer installation, Download report viewer from the Link

run installation, click next, accept EULA and follow the installation screen.


5 of 46 06/09/2011 5:59 PM

5. SQL Server 2005 SP1 installation

download SQL server 2005 from the link


6 of 46 06/09/2011 5:59 PM

Click next and click install, click next again


7 of 46 06/09/2011 5:59 PM

follow installation screen until finish.


8 of 46 06/09/2011 5:59 PM

Now you have fulfil prerequisite as mention above.

WSUS installation

download WSUS from http://connect.microsoft.com/directory/ website. sign in using hotmail or live account. download x86 or x64 as

you prefer. here I am installing x86 version.


9 of 46 06/09/2011 5:59 PM

Click on run

click next

Check Full server installation radio button, click next


10 of 46 06/09/2011 5:59 PM

Accept EULA

You must have two partition in your server as you can see above. I selected D:\WSUS . click next


11 of 46 06/09/2011 5:59 PM

Check use existing database. It is required for enterprise deployment. internal database will not work if you have large number of

desktop and server. click next.


12 of 46 06/09/2011 5:59 PM

Click next

On the next screen “web site selection” check create Microsoft Windows Server Update Services Web Site on port 8530

DO NOT CHECK RECOMMENDED


13 of 46 06/09/2011 5:59 PM

Click next


14 of 46 06/09/2011 5:59 PM

Click next , Click next again


15 of 46 06/09/2011 5:59 PM

Click finish. WSUS config wizard will start next


16 of 46 06/09/2011 5:59 PM

click next


17 of 46 06/09/2011 5:59 PM

Click next

Provide proxy server IP and credentials above if you have proxy server. in my case I typed my ISA server IP, port 80 and my domain

admin credentials.


18 of 46 06/09/2011 5:59 PM

Click on start connecting and wait until finish, click next and follow the config screen to select your language, products, classification


19 of 46 06/09/2011 5:59 PM

wait until synchronisation finish. It might take 30/40 minutes depending on speed of your internet.


20 of 46 06/09/2011 5:59 PM

Setup IIS Security

Now set permission in IIS in WSUS server, you may set anonymous logon. Don’t worry its inside your firewall.


21 of 46 06/09/2011 5:59 PM

Configure WSUS

open WSUS management console. In the Left hand side pan, click on Options then click on Change Update File and Language. Check

Download Update files to the server when updates are approved. Select appropriate language. Then Click Apply and Ok.


22 of 46 06/09/2011 5:59 PM


23 of 46 06/09/2011 5:59 PM

Click on Automatic Approval and create new rules and run the rules. In my case I have two custom rules.


24 of 46 06/09/2011 5:59 PM


25 of 46 06/09/2011 5:59 PM

In the left hand side pan right click on All Computers, Click on Add Computer Group. For example, I have three computer groups;

desktop, Windows7 and Server.

Group Policy Configuration

This part describes how to use GPO to deliver Automatic Updates


26 of 46 06/09/2011 5:59 PM

Open group policy management console, Right click on the Group policy objects container and click new. create policies for each of

computer groups. For Example, WSUS Policy for desktop, WSUS Policy for Windows 7 and WSUS Server policy.

Now right click on WSUS policy that is

desktop policy you just created and change

settings of four GPO that are enabled here on

screen

Configure Auto download and schedule

installation that fit for you

Point WSUS server and port as

http://yourserver:8530 in both the box

Type target group to populate desktop/pc in

WSUS Server.

Check enabled in following box not to


27 of 46 06/09/2011 5:59 PM

reboot machine if user logged on


28 of 46 06/09/2011 5:59 PM


29 of 46 06/09/2011 5:59 PM

Repeat this process for WSUS server policy, Windows 7 Policy and so on.

In GPO management console, Right click on the organisational unit that contain desktop/workstation and link existing WSUS

policy you created in above steps with this organisational unit.

Link it with WSUS policy

Repeat same steps for all other

organisational unit in GPO management

console. Now you may close GPO now.


30 of 46 06/09/2011 5:59 PM

Important! Do NOT link WSUS policy in

child OU. Link directly to the top of OU

hierarchy otherwise workstation will not

populate.

Publish WSUS policy in ISA

Server

If you have ISA 2004/2006 or Forefront

TMG 2010, you have to set WSUS policy in

ISA firewall access rule. so that ISA doesn’t

block communication between server and

client. You don’t need to do it if nothing

blocking between Client and Server

communication and don’t have a firewall.

To publish WSUS policy, Open ISA

management console

Go to Network Object and expand WEB

listener, right click on web listener click

new. Type Name of WSUS server. Name

should be netbios name of WSUS server.

Follow the screen shot.


31 of 46 06/09/2011 5:59 PM


32 of 46 06/09/2011 5:59 PM

Click next, click finish.

In the right hand side Tasks Pan, Click on publish a web server and follow the screen shot


33 of 46 06/09/2011 5:59 PM


34 of 46 06/09/2011 5:59 PM


35 of 46 06/09/2011 5:59 PM

On the next screen shot select the web listener (WSUS server) you added in the previous steps.


36 of 46 06/09/2011 5:59 PM

Right click on the WSUS Publishing policy, click on property>Click Bridging Tab and check web server and port 8530


37 of 46 06/09/2011 5:59 PM

On the paths add these path if these aren’t exist already


38 of 46 06/09/2011 5:59 PM


39 of 46 06/09/2011 5:59 PM

uncheck verify and block option. Apply Changes and click ok.

Troubleshooting

Go to client machine, run gpupdate /force if client not showing on WSUS

Run wuauclt /resetauthorization /detectnow command from client machine.

Check Registry of client.

Conclusion

Auto update and patch up gives administrator more

time to concentrate other things without spending

time on patching up servers and pc. I enjoyed

deploying WSUS. I hope these instruction would

be handy for you.

Relevant Articles:


40 of 46 06/09/2011 5:59 PM

Share this:

Like this: 2 bloggers like this post.

WSUS 3.0 SP2: Understanding WSUS

deployment topology

How to configure automatic updates by

using Group Policy or registry settings

How to configure Windows Server Update Services (WSUS) to use BranchCache

How to Configure WSUS for Roaming Clients

Troubleshooting WSUS server

Windows Server 2008: Windows Server Update Services Role–Step by Step Guide

WSUS: Best practice guide lines for WSUS installation, configuration and management

WSUS Health Check

ADVERTISEMENT

This entry was posted on Thursday, August 13th, 2009 at 11:03 AM and is filed under Windows Server Update Services (WSUS).

You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your

own site.

2 Responses to Install and configure WSUS 3.0 SP2 – Step-By-Step

Windows Server 2008: Windows Server Update Services Role « IT BLOG says:

November 3, 2009 at 4:20 PM

1.


41 of 46 06/09/2011 5:59 PM

[...] my previous blog how to deploy Microsoft update Services using WSUS and Group Policy Object.

WSUS SP2 installation and GPO deployment instruction. Read my previous installation instruction and

follow WSUS SP2 installation on windows server 2008 [...]

Blogging year 2010—-what stats says | MicrosoftGURU says:

January 3, 2011 at 11:58 AM

[...] Install and configure WSUS 3.0 SP2 – Step-By-Step August 2009 [...]

2.

Search

Categories

Cisco

Exchange Server 2010

Forefront TMG 2010

Group Policy Object

Microsoft Active Directory

Microsoft Internet Security and Acceleration Server

Microsoft System Centre Configuration Manager (SCCM)

Miscellaneous

SharePoint Server

Virtualization

Windows 2003 Server

Windows 2008 Server

Windows 7

Windows Deployment Services (WDS)

Windows Server Update Services (WSUS)

Windows XP

Blog Stats

625,189 hits

Top Rated

Posts | Pages | Comments

All | Today | This Week | This Month

Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized

Management—Step by Step

5/5 (6 votes)

WSUS: Best practice guide lines for WSUS installation, configuration and management

5/5 (4 votes)

WSUS 3.0 SP2: Understanding WSUS deployment topology

5/5 (4 votes)

How to deploy custom windows 7 using windows deployment services (WDS) 2008

5/5 (3 votes)


42 of 46 06/09/2011 5:59 PM

Troubleshooting WSUS server

5/5 (3 votes)

My Profile

I am a Systems Administrator. I work mainly on Microsoft Server operating systems,

Cisco networks and VMware vSphere. I am a MCSE, MCSA, CCNA and MACS.

My interest and skills includes various technologies such as Microsoft Windows Server,

Microsoft Active Directory Infrastructure, Microsoft Messaging technologies,

Microsoft Internet Security and Acceleration Server (ISA), Microsoft Forefront

Technologies, WSUS, WDS and SCCM. I also design and deploy Cisco networks and VMware vSphere

technologies. I am a blogger. I write articles regularly on various information technology issues and on

new development in IT. I hope this would be advantageous to the information technology community.

Visitor Location

Calender

August 2009

M T W T F S S

« Mar Sep »

1 2

3 4 5 6 7 8 9

10 11 12 13 14 15 16

17 18 19 20 21 22 23

24 25 26 27 28 29 30

31

Previous Posts

Recent Comments

Bradley on How to configure L2TP/IPSec VP…


43 of 46 06/09/2011 5:59 PM

Dimon on Forefront TMG 2010: How to ins…

Raihan Al-Beruni on Forefront TMG 2010: How to ins…

Raihan Al-Beruni on How to configure L2TP/IPSec VP…

Dimon on Forefront TMG 2010: How to ins…

Bradley on How to configure L2TP/IPSec VP…

How to configure L2T… on Install and configure Microsof…

Raihan Al-Beruni on Forefront TMG 2010: Publish Ou…

Raihan Al-Beruni on Transitioning from Exchange 20…

Raihan Al-Beruni on Deploy custom Office 2007 usin…

RSS - Posts

RSS - Comments

Email Subscription

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 69 other followers

Top Posts

Forefront TMG 2010: How to install and configure Forefront TMG 2010 ----Step by step

How to configure L2TP IPSec VPN using Network Policy Server in Windows Server 2008 R2

Windows Server 2008: how to configure Network Policy Server or Radius Server --Step by Step

Guide

Install and configure WSUS 3.0 SP2 - Step-By-Step

Step by Step Guide on Exchange Server 2010 Edge Transport Role

Step by Step guide to build a Cisco wireless infrastructure using Cisco WLC 5500, Cisco 1142

AP and Microsoft Radius server


44 of 46 06/09/2011 5:59 PM

How to configure Exchange 2010 Hub Transport (HT) Server

Forefront Protection 2010: how to install and configure Forefront Protection 2010 for Exchange

Server 2010—Step by step

Install and configure Microsoft Active Directory Certificate Services (AD CS) using Windows

Server 2008 R2

Forefront TMG 2010: Publish Outlook Web Access and Exchange Servers using Forefront TMG

2010

Top Clicks

araihan.files.wordpress.c…


connect.microsoft.com/dir…



Blogroll

Raihan's Blog

SocialVibe

Spam Blocked

10,770spam comments


45 of 46 06/09/2011 5:59 PM

Theme: Contempt by Vault9.

Blog at WordPress.com.


46 of 46 06/09/2011 5:59 PM

install and configure wsus 3

Documents