accessing WSUS-server by website

Hi there,

Recently I installed the WSUS server, that works perfect. Clients get
their update frequently. When I install windows xp (for example) this
operating system needs several updates. But before the workstation is
known at the WSUSserver and a report has been made and all the updates
have been applied, several days have gone by.

Is there a way to download/install all the updates at once (or at
least after rebooting several time, as needed at windowsupdate.com)
Is it possible to let the WSUS server work as windowsupdate.com so
when i installed a new operating system, I can download the updates
direcly from the WSUS server and not use windowsupdate.com, so I don't
have to use the internet connection ?

Thanx in advance

Jan-Willem Koenraad

BITS is slower by design. Our SUS server is set to be checked every night
for updates by the client systems and that is currently sufficient for our
needs. Concerning the SUS database itself, that is downloaded once a week,
unless new updates come midweek and then the database is pulled that day.
It is a matter of vigilance unless you set the SUS server to poll Microsoft
everyday. Because the SUS database is indeed in that form, we have not
attempted to extract the individual patches nor find it necessary. We pull
the patches down manually for individual or immediate delivery.

You are asking if the system can detect that they need updates or if the SUS
server can deliver them almost immediately? You would have to perhaps get a
third party application for that.

What we use:
To address the issue of immediate delivery, a combination of the MSBSA (to
see who's vulnerable) and vbscript code as a delivery agent is used over
here to facilitate SUS. We can then stage delivery of several patchs to one
machine or several machines, or also across several subnets if necesary.
We also use SMS when necessary but the VB code is faster.

The VBscript code (modified but originally from Microsoft) is here:
It came from: How to use a visual basic script to install the 824146
(MS03-039) or 823980 (MS03-026) security patch on remote host computers
Article ID
:
827227


It has been modified through the switches to not reboot. Afterward we come
along and reboot the systems all at once after hours. The patches are
downloaded manually for our systems that have no internet access or are
blocked behind the firewall.


' Patchinstall.vbs
' Patch installation script for Windows 2000 and Windows XP
' (c) Microsoft 2003
' v1.03 cl

on error resume next

const XP_Patch = "Patch_XP.exe"
const W2k_Patch = "Patch_W2k.exe"
const W2k3_Patch = "Patch_W2k3.exe"

If right(ucase(wscript.FullName),11)="WSCRIPT.EXE" then
wscript.echo "ERROR: You must run this script using cscript, for
example 'cscript " & wscript.scriptname & "'."
wscript.quit 0
end if

' USAGE
if wscript.arguments.count <> 2 then
wscript.echo "Usage: cscript " & wscript.scriptname & " <IpFile.txt>
<LocalPathToPatches>" & vbCrLf & vbCrLf & _
" <LocalPathToPatches> must be a full path of a folder that contains
all of these files:" & vbCrLf & _
" " & XP_Patch & vbCrLf & _
" " & W2k_Patch & vbCrLf & _
" " & W2k3_Patch
wscript.quit
end if

ipFile = wscript.arguments(0)
localPathToPatches = wscript.arguments(1)

set onet = createobject("wscript.network")
set ofs = createobject("scripting.filesystemobject")

' Verify that ipfile is accessible.
set oipFile = ofs.opentextfile(ipFile, 1, false)
if (Err.Number <> 0) then
wscript.echo "Cannot open " & ipFile
wscript.quit
end if

' Make sure to end with a \ character.
if right(localPathToPatches, 1) <> "\" then
localPathToPatches = localPathToPatches & "\"
end if

'Note that cim_datafile does not support UNC paths
'so everything must be handled through mapped drives.
if left(localPathToPatches, 2) = "\\" then
wscript.echo "<pathToExecutable> cannot be a UNC path, please map a
drive locally"
wscript.quit
end if

exeWinXP = ofs.getfile(localPathToPatches + XP_Patch).name
exeW2k = ofs.getfile(localPathToPatches + W2k_Patch).name
exeW2k3 = ofs.getfile(localPathToPatches + W2k3_Patch).name

' Verify that the patches are accessible.
if ((len(exeWinXP) = 0) OR (len(exeW2k) = 0) OR (len(exeW2k3) = 0)) then
wscript.echo "Cannot find patch files."
wscript.echo "Please verify that the <LocalPathToPatches> folder
contains all of these files:" & vbCrLf & _
" " & XP_Patch & vbCrLf & _
" " & W2k_Patch & vbCrLf & _
" " & W2k3_Patch
wscript.quit
end if


set osvcLocal = getobject("winmgmts:root\cimv2")

'The error-handling code is below the function that may throw one - execute
it.
on error resume next

while not oipFile.atEndOfStream
ip = oipFile.ReadLine()
wscript.echo vbCrLf & "Connecting to " & ip & "..."

Err.Clear
set osvcRemote = GetObject("winmgmts:\\" & ip & "\root\cimv2")

if (Err.Number <> 0) then
wscript.echo "Failed to connect to " & ip & "."
else

exeCorrectPatch = detectOSPatch(osvcRemote)
if (exeCorrectPatch <> "") then
' Lay the bits on the remote computer.
wscript.echo "Installing patch " & exeCorrectPatch & "..."

onet.mapnetworkdrive "z:", "\\" & ip & "\C$"
set osourceFile = osvcLocal.get("cim_datafile=""" &
replace(localPathToPatches, "\", "\\") & exeCorrectPatch & """")
ret = osourceFile.Copy("z:\\Patchinst.exe")

if (ret <> 0 and ret <> 10) then
' Failure detected and failure was not "file already
exists."
wscript.echo "Failed copy to " & ip & " - error: " & ret
else
set oprocess = osvcRemote.Get("win32_process")

' Start the installation without user interaction, and
force a restart after completion.
ret = oprocess.create("c:\\Patchinst.exe /quiet /passive
/norestart")
if (ret <> 0) then
wscript.echo "Failed to start process on " & ip &
": " & ret
else
' Get a reference to the file that was copied.
set odestFile =
osvcLocal.get("cim_datafile=""z:\\Patchinst.exe""" )

' Wait for the installation to complete.
for waitTime = 0 to 120 ' Lay and wait--up to
two minutes for the installation to complete.
wscript.Sleep 1000 ' Sleep one second.
' Delete temporary file as soon as possible
after it is freed.
if (odestFile.Delete() = 0) then
exit for
end if
next ' Otherwise, loop again and keep waiting...

wscript.echo "Installation successful."

end if 'Create process succeeded.
end if 'Copy succeeded.

onet.removenetworkdrive "z:", true
end if ' The script knows which patch to install.
end if ' Do the next IP address, then the next IP address...
wend

oipFile.close()

'Clean up, remove drive mapping (check this time, because it may not have
been mapped).
if ofs.folderexists("z:\") then
onet.removenetworkdrive "z:", true
end if

wscript.echo vbCrLf & "Patching complete. Exiting."

function detectOSPatch(osvcRemote)

set oOSInfo = osvcRemote.InstancesOf("Win32_OperatingSystem")
'Only one instance is ever returned (the currently active OS), even
though the following is a foreach.
for each objOperatingSystem in oOSInfo

if (objOperatingSystem.OSType <> 18) then
' Make sure that this computer is Windows NT-based.
wscript.echo ip & " is not a Windows XP, Windows 2000, or
Windows 2003 Server computer."
else
if (objOperatingSystem.Version = "5.0.2195") then
' Windows 2000 SP2, SP3, SP4.
if (objOperatingSystem.ServicePackMajorVersion = 2) or
(objOperatingSystem.ServicePackMajorVersion = 3) or _
(objOperatingSystem.ServicePackMajorVersion = 4) then
systemType = exeW2k
end if

elseif (objOperatingSystem.Version = "5.1.2600") then
' Windows XP RTM, SP1, SP2.
if (objOperatingSystem.ServicePackMajorVersion = 0) or
(objOperatingSystem.ServicePackMajorVersion = 1) or _
(objOperatingSystem.ServicePackMajorVersion = 2) then
systemType = exeWinXP
end if

elseif (objOperatingSystem.Version = "5.2.3790") then
' Windows Server 2003 RTM
if (objOperatingSystem.ServicePackMajorVersion = 0) then
systemType = exeW2k3
end if
end if

if (systemType = "") then
'This was a Windows NT-based computer, but not with a
valid service pack.
wscript.echo "Could not patch " & ip & " - unhandled OS
version: " & objOperatingSystem.Caption & " SP" & _
objOperatingSystem.ServicePackMajorVersion & "("&
objOperatingSystem.Version & ")"
end if
end if

next

detectOSPatch = systemType

end function







"Jan-Willem" <> wrote in message
news: om...
> Hi there,
>
> Recently I installed the WSUS server, that works perfect. Clients get
> their update frequently. When I install windows xp (for example) this
> operating system needs several updates. But before the workstation is
> known at the WSUSserver and a report has been made and all the updates
> have been applied, several days have gone by.
>
> Is there a way to download/install all the updates at once (or at
> least after rebooting several time, as needed at windowsupdate.com)
> Is it possible to let the WSUS server work as windowsupdate.com so
> when i installed a new operating system, I can download the updates
> direcly from the WSUS server and not use windowsupdate.com, so I don't
> have to use the internet connection ?
>
> Thanx in advance
>
> Jan-Willem Koenraad

Hey Jan-Willem,

I have WSUS installed also, I find that until you get the new PC put into
your Computer group that has the GPO on it, it can take a couple days for it
to function correctly or even see it at all. When I do with a New system
that I bring online, is soon as i admit it into the Domain, I move the PC
from the standard computer to a computer group with the GPO on it. I have
found within Mins the WSUS server will see it and push data to it. Once WSUS
sees it on the network and has the applied GPO it will start pushing.



"Jan-Willem" wrote:

> Hi there,
>
> Recently I installed the WSUS server, that works perfect. Clients get
> their update frequently. When I install windows xp (for example) this
> operating system needs several updates. But before the workstation is
> known at the WSUSserver and a report has been made and all the updates
> have been applied, several days have gone by.
>
> Is there a way to download/install all the updates at once (or at
> least after rebooting several time, as needed at windowsupdate.com)
> Is it possible to let the WSUS server work as windowsupdate.com so
> when i installed a new operating system, I can download the updates
> direcly from the WSUS server and not use windowsupdate.com, so I don't
> have to use the internet connection ?
>
> Thanx in advance
>
> Jan-Willem Koenraad
>

Thank you very much for your extended answer !!

But perhaps I should be more specific. The computers are only in our
network when they are installed. the are not added to our domain and
are just connected to the network to have internet access to update
windows etc. Once that's finished, they will be disconnected from the
network and shipped to another place (client side). The problem is
that everytime we have to download the updates over and over again, so
i thought, maybe there is a way that the WSUS server acts like a
windows update server, so there might be intranet site available in
the WSus server that works (almost) the same as windowsupdate.com

Any ideas ?

Jan-Willem




"Steve Shodde" <> wrote in message news:<>...
> BITS is slower by design. Our SUS server is set to be checked every night
> for updates by the client systems and that is currently sufficient for our
> needs. Concerning the SUS database itself, that is downloaded once a week,
> unless new updates come midweek and then the database is pulled that day.
> It is a matter of vigilance unless you set the SUS server to poll Microsoft
> everyday. Because the SUS database is indeed in that form, we have not
> attempted to extract the individual patches nor find it necessary. We pull
> the patches down manually for individual or immediate delivery.
>
> You are asking if the system can detect that they need updates or if the SUS
> server can deliver them almost immediately? You would have to perhaps get a
> third party application for that.
>
> What we use:
> To address the issue of immediate delivery, a combination of the MSBSA (to
> see who's vulnerable) and vbscript code as a delivery agent is used over
> here to facilitate SUS. We can then stage delivery of several patchs to one
> machine or several machines, or also across several subnets if necesary.
> We also use SMS when necessary but the VB code is faster.
>
> The VBscript code (modified but originally from Microsoft) is here:
> It came from: How to use a visual basic script to install the 824146
> (MS03-039) or 823980 (MS03-026) security patch on remote host computers
> Article ID
> :
> 827227
>
>
> It has been modified through the switches to not reboot. Afterward we come
> along and reboot the systems all at once after hours. The patches are
> downloaded manually for our systems that have no internet access or are
> blocked behind the firewall.
>
>
> ' Patchinstall.vbs
> ' Patch installation script for Windows 2000 and Windows XP
> ' (c) Microsoft 2003
> ' v1.03 cl
>
> on error resume next
>
> const XP_Patch = "Patch_XP.exe"
> const W2k_Patch = "Patch_W2k.exe"
> const W2k3_Patch = "Patch_W2k3.exe"
>
> If right(ucase(wscript.FullName),11)="WSCRIPT.EXE" then
> wscript.echo "ERROR: You must run this script using cscript, for
> example 'cscript " & wscript.scriptname & "'."
> wscript.quit 0
> end if
>
> ' USAGE
> if wscript.arguments.count <> 2 then
> wscript.echo "Usage: cscript " & wscript.scriptname & " <IpFile.txt>
> <LocalPathToPatches>" & vbCrLf & vbCrLf & _
> " <LocalPathToPatches> must be a full path of a folder that contains
> all of these files:" & vbCrLf & _
> " " & XP_Patch & vbCrLf & _
> " " & W2k_Patch & vbCrLf & _
> " " & W2k3_Patch
> wscript.quit
> end if
>
> ipFile = wscript.arguments(0)
> localPathToPatches = wscript.arguments(1)
>
> set onet = createobject("wscript.network")
> set ofs = createobject("scripting.filesystemobject")
>
> ' Verify that ipfile is accessible.
> set oipFile = ofs.opentextfile(ipFile, 1, false)
> if (Err.Number <> 0) then
> wscript.echo "Cannot open " & ipFile
> wscript.quit
> end if
>
> ' Make sure to end with a \ character.
> if right(localPathToPatches, 1) <> "\" then
> localPathToPatches = localPathToPatches & "\"
> end if
>
> 'Note that cim_datafile does not support UNC paths
> 'so everything must be handled through mapped drives.
> if left(localPathToPatches, 2) = "\\" then
> wscript.echo "<pathToExecutable> cannot be a UNC path, please map a
> drive locally"
> wscript.quit
> end if
>
> exeWinXP = ofs.getfile(localPathToPatches + XP_Patch).name
> exeW2k = ofs.getfile(localPathToPatches + W2k_Patch).name
> exeW2k3 = ofs.getfile(localPathToPatches + W2k3_Patch).name
>
> ' Verify that the patches are accessible.
> if ((len(exeWinXP) = 0) OR (len(exeW2k) = 0) OR (len(exeW2k3) = 0)) then
> wscript.echo "Cannot find patch files."
> wscript.echo "Please verify that the <LocalPathToPatches> folder
> contains all of these files:" & vbCrLf & _
> " " & XP_Patch & vbCrLf & _
> " " & W2k_Patch & vbCrLf & _
> " " & W2k3_Patch
> wscript.quit
> end if
>
>
> set osvcLocal = getobject("winmgmts:root\cimv2")
>
> 'The error-handling code is below the function that may throw one - execute
> it.
> on error resume next
>
> while not oipFile.atEndOfStream
> ip = oipFile.ReadLine()
> wscript.echo vbCrLf & "Connecting to " & ip & "..."
>
> Err.Clear
> set osvcRemote = GetObject("winmgmts:\\" & ip & "\root\cimv2")
>
> if (Err.Number <> 0) then
> wscript.echo "Failed to connect to " & ip & "."
> else
>
> exeCorrectPatch = detectOSPatch(osvcRemote)
> if (exeCorrectPatch <> "") then
> ' Lay the bits on the remote computer.
> wscript.echo "Installing patch " & exeCorrectPatch & "..."
>
> onet.mapnetworkdrive "z:", "\\" & ip & "\C$"
> set osourceFile = osvcLocal.get("cim_datafile=""" &
> replace(localPathToPatches, "\", "\\") & exeCorrectPatch & """")
> ret = osourceFile.Copy("z:\\Patchinst.exe")
>
> if (ret <> 0 and ret <> 10) then
> ' Failure detected and failure was not "file already
> exists."
> wscript.echo "Failed copy to " & ip & " - error: " & ret
> else
> set oprocess = osvcRemote.Get("win32_process")
>
> ' Start the installation without user interaction, and
> force a restart after completion.
> ret = oprocess.create("c:\\Patchinst.exe /quiet /passive
> /norestart")
> if (ret <> 0) then
> wscript.echo "Failed to start process on " & ip &
> ": " & ret
> else
> ' Get a reference to the file that was copied.
> set odestFile =
> osvcLocal.get("cim_datafile=""z:\\Patchinst.exe""" )
>
> ' Wait for the installation to complete.
> for waitTime = 0 to 120 ' Lay and wait--up to
> two minutes for the installation to complete.
> wscript.Sleep 1000 ' Sleep one second.
> ' Delete temporary file as soon as possible
> after it is freed.
> if (odestFile.Delete() = 0) then
> exit for
> end if
> next ' Otherwise, loop again and keep waiting...
>
> wscript.echo "Installation successful."
>
> end if 'Create process succeeded.
> end if 'Copy succeeded.
>
> onet.removenetworkdrive "z:", true
> end if ' The script knows which patch to install.
> end if ' Do the next IP address, then the next IP address...
> wend
>
> oipFile.close()
>
> 'Clean up, remove drive mapping (check this time, because it may not have
> been mapped).
> if ofs.folderexists("z:\") then
> onet.removenetworkdrive "z:", true
> end if
>
> wscript.echo vbCrLf & "Patching complete. Exiting."
>
> function detectOSPatch(osvcRemote)
>
> set oOSInfo = osvcRemote.InstancesOf("Win32_OperatingSystem")
> 'Only one instance is ever returned (the currently active OS), even
> though the following is a foreach.
> for each objOperatingSystem in oOSInfo
>
> if (objOperatingSystem.OSType <> 18) then
> ' Make sure that this computer is Windows NT-based.
> wscript.echo ip & " is not a Windows XP, Windows 2000, or
> Windows 2003 Server computer."
> else
> if (objOperatingSystem.Version = "5.0.2195") then
> ' Windows 2000 SP2, SP3, SP4.
> if (objOperatingSystem.ServicePackMajorVersion = 2) or
> (objOperatingSystem.ServicePackMajorVersion = 3) or _
> (objOperatingSystem.ServicePackMajorVersion = 4) then
> systemType = exeW2k
> end if
>
> elseif (objOperatingSystem.Version = "5.1.2600") then
> ' Windows XP RTM, SP1, SP2.
> if (objOperatingSystem.ServicePackMajorVersion = 0) or
> (objOperatingSystem.ServicePackMajorVersion = 1) or _
> (objOperatingSystem.ServicePackMajorVersion = 2) then
> systemType = exeWinXP
> end if
>
> elseif (objOperatingSystem.Version = "5.2.3790") then
> ' Windows Server 2003 RTM
> if (objOperatingSystem.ServicePackMajorVersion = 0) then
> systemType = exeW2k3
> end if
> end if
>
> if (systemType = "") then
> 'This was a Windows NT-based computer, but not with a
> valid service pack.
> wscript.echo "Could not patch " & ip & " - unhandled OS
> version: " & objOperatingSystem.Caption & " SP" & _
> objOperatingSystem.ServicePackMajorVersion & "("&
> objOperatingSystem.Version & ")"
> end if
> end if
>
> next
>
> detectOSPatch = systemType
>
> end function
>
>
>
>
>
>
>
> "Jan-Willem" <> wrote in message
> news: om...
> > Hi there,
> >
> > Recently I installed the WSUS server, that works perfect. Clients get
> > their update frequently. When I install windows xp (for example) this
> > operating system needs several updates. But before the workstation is
> > known at the WSUSserver and a report has been made and all the updates
> > have been applied, several days have gone by.
> >
> > Is there a way to download/install all the updates at once (or at
> > least after rebooting several time, as needed at windowsupdate.com)
> > Is it possible to let the WSUS server work as windowsupdate.com so
> > when i installed a new operating system, I can download the updates
> > direcly from the WSUS server and not use windowsupdate.com, so I don't
> > have to use the internet connection ?
> >
> > Thanx in advance
> >
> > Jan-Willem Koenraad