If I use SUS, how should the 'client update' on XP look like'?

Imagine I don't want to users with laptops to install software updates
automatically in my organization. We have 2,000 laptops.

Then I deploy SUS so I can test and authorize downloads prior to let users
install them.

Now users take their laptops home. What's the behavior ? Are users going to
get updates downloaded from Microsoft Windows Update website automatically ?
Is that the recommended approach let users download this automatically when
they are at home ?

If I DO NOT WANT users to download critical updates automatically even if
they are at home, how does the "Windows XP->Control Panel->Automatic
Updates" configuration should look like ?


Thanks !

Hi,

You will want to use WSUS and not SUS (MS will stop releasing new
updates to SUS in December this year).

When configuring the Automatic Updates (AU) client to use a WSUS
server, and a user takes the computer home and connects it to a
network there, the following will happen:

The AU client will try to connect to the WSUS server. If it does not
get any connection, it will forever try again and again with some hours
in between. It will never automatically switch over to use the
Microsoft severs instead, and the end user will never get any
notification that the AU client is not able to connect to the WSUS
server.

Anyway, regardless if the computer is in a corporate or home network,
default the user will be able to use Windows Update/Microsoft Update'
through the GUI Web interface even if you have configured the AU client
to use WSUS.

To stop them from using the GUI, you can enable the group policy
"Remove access to use all Windows Update features" (note that it is a
"User Configuration")

Some side effects by enabling this policy:

If you apply the user policy of "Remove access to use all Windows
Update features" the current user is always treated as a
non-administrator, as far as the Automatic Client is concerned.

This means that even if you are a local admin, it will remove
all update notifications to the users, and you will not be able to
stop the reboot countdown timer.


And a fyi:

Please post WSUS related issues to the newsgroup dedicated to WSUS:

microsoft.public.windows.server.update_services


Marlon Brown wrote:

> Imagine I don't want to users with laptops to install software updates
> automatically in my organization. We have 2,000 laptops.
>
> Then I deploy SUS so I can test and authorize downloads prior to let users
> install them.
>
> Now users take their laptops home. What's the behavior ? Are users going to
> get updates downloaded from Microsoft Windows Update website automatically ?
> Is that the recommended approach let users download this automatically when
> they are at home ?
>
> If I DO NOT WANT users to download critical updates automatically even if
> they are at home, how does the "Windows XP->Control Panel->Automatic
> Updates" configuration should look like ?

--
torgeir, Microsoft MVP Software Distribution, Porsgrunn Norway