SUS Server and Group Policy in Active Directory 1

[timlowe]

Hi, I just installed Microsoft's SUS sever.. I synchonized and approved the updates. How do I tell all my client pc's to look to my server for updates?? Do I do a group Policy In Active Directory? any help on this would be appreciated.

Thanks

 

[buddafish]

yes, use group policy to do this if your clients are XP and or W2k.

Create a new policy, from the Computer Configuration, expand the Administrative Templates --> Windows Components --> Windows Updates.

Make sure to enable the policies and choose what applies to your network. The server name should be

HTTP://Your

Server Name.

NOTE: Client machines need to have BITS service enabled and started as well as Windows Update Service...

scottie

 

[timlowe]

Thanks for the help!!!! I can always count on people here..

 

[timlowe]

Hi again, after I have done everything state above, how can i initate an update to the pc without having it go to the windows update website?

 

[buddafish]

Client machines will only talk to the SUS server if the policy is applied correctly. Check clients C:\WINNT directory for Windows Update.log . This will log communications with the SUS server and what is going on.

Also, you can check the registry in the HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU -
you should see your server name listed as the SUS server...

Once everything is in order, the client will contact the server once (?) per day at a specified time to check on what updates have been downloaded and APPROVED by the administrator (you).

scottie

 

[timlowe]

Thanks Scottie, i'll check what you have mentioned.

Tim

 

[timlowe]

Me again.. sorry to keep bothering you on this.. when i look in the registry, i do not have a Windows update under that path listed. so im assuming the policy didnt transfer over from the server. I set the Group Policy on the folder in active directory that contains my user name.. is there something I could have done wrong or missing? Thanks again..

Tim

 

[buddafish]

move your computer account into the OU that the policy is applied to. this is a computer based policy, not user based.

then reboot the machine and give it a few minutes.

are you familiar with gpresult.exe?

scottie

 

[timlowe]

once again, i apologize.. im new to all this stuff and trying to learn.. In active directory users and computers..my tree kinda looks like this:
COMPUTER
MIS-(user defined)
FISCAL - (user defined)
CLERICAL - (user defined)
MR - (user defined)
MH - (user defined)

My Login is under the MIS folder.. I set the group policy on that folder.. i tried to set a group policy on the "Computer" folder, but there is no option for that..

not sure what gpresult.exe does..

Tim

 

[buddafish]

yes, find your computer object, right click and choose to move. select the MIS OU as the target to move to...

verify that your computer object is now in the OU for the MIS department. yes --- cool...

now any object within this OU will get the policies applied to them (user and computer objects are two different things) and Group Policy can be applied to either the User or Computer object - (or both if it is complex)... anyway, once you have success in moving your computer account, reboot. then run gpresult.exe from a command prompt on the client machine. you should see your policy name "SUS Policy" listed in registry settings applied... if not, check back and we need to look at why the policy is not being applied....

 

[timlowe]

Ok, i did what you had suggested.. i know how it in my registry under windows update.. am I good to go now? Thanks so much for your time and patience..!!

Tim

 

[buddafish]

yep, if you see your SUS sever name listed in the reg, then this is where the client machine will look for updates (there are other values to tweak, but stick with the basics for now).
don't forget to approve the updates that you want to pass down from the SUS server.

http://"Your

Server Name Here"/susadmin/ else no updates will flow down to the clients...


scottie

 

[timlowe]

You have been excellent thru out all this!! thank you very much!!! and Best wishes to the new year!!

Tim