Will WSUS work across forests?

[kmkeshav]

...if so, how should I configure a WSUS server in one forest to serve the computers in another forest. Both the forests have network connectivity and have trusts in place.

Thanks,
Keshav

 

[Davetoo]

Yes, setup a GPO in each forest pointing to the WSUS location.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.
The poster formerly known as lander215

 

[monsterjta]

Yes. WSUS is not dependent on AD for it's services. It can serve as many domains and forests as you wish. The controlling factor resides in the clients Windows Update Services properties/policies.

Like davetoo stated, configuring your policies in each domain/forest to point to the WSUS server is all that needs to be done.

I hope you find this post helpful,

Jonathan Almquist
Minneapolis, MN

 

[kmkeshav]

Thank you very much for the replies.

We have two forests in our infrastructure spanning globally (multiple sites). WSUS server is in DomainA (ForestA) and there are group policies designed in both the forests to use this WSUS server. Computers and Servers in ForestA have no problem in getting the updates from this WSUS server but ForestB doesn't update from this WSUS server.

I can see the group policy applied to these computers in ForestB (Group Policy Results Wizard, GPRESULT and a script to check the respective key in the Registry).

What should be wrong then?

What are the other troubleshooting steps in this?

Any help would be appreciated.

Thanks,

Keshav.

 

[monsterjta]

Are you sure the WSUS server is resolvable and reachable from ForestB?

I hope you find this post helpful,

Jonathan Almquist
Minneapolis, MN

 

[kmkeshav]

Yes, computers in ForestB are able to resolve and reach the SUS server.

Will there be any events logged if a computer has obtained any updates from the SUS server?

By this, I will be able to find out if the computers in ForestB are able to get the updates from ForestB. I don't see any events related to Windows Update in the event viewers of computers in ForestB. Also, I don't find any errors in Windows Update.log file of the computers.

-Keshav

 

[monsterjta]

Are you using SSL for your WSUS traffic? If so, do the machines in ForestB have the certificate installed?

Are these machines checking in with the WSUS server? Or, are you getting no status at all?

Another thing to check is that these machines have BITS 2.0 and WinHTTP 5.1 installed. This is required for WSUS communications, and needs to be installed before proceeding with WSUS communications.

What happens if you do a WUAUCLT /DETECTNOW from the CMD and wait about an hour?

I hope you find this post helpful,

Jonathan Almquist
Minneapolis, MN