Make WSUS more efficient??

1. How can WSUS be told to automatically decline all updates more than
X months old?? Say 6 months??

2. How to make WSUS automatically approve all critical and important
updates but not recommended updates??

3. How to ensure that all 'Patch Tuesday' updates are included for all
the servers??

Are there any good books or tutorials???

Thank you...

[[ Right pew, wrong church. Forwarded to WSUS newsgroup
(microsoft.public.windows.server.update_services) via crosspost as a
convenience to OP.

On the web:
http://www.microsoft.com/communities...pdate_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
]]

tom12010 wrote:
> 1. How can WSUS be told to automatically decline all updates more than
> X months old?? Say 6 months??
>
> 2. How to make WSUS automatically approve all critical and important
> updates but not recommended updates??
>
> 3. How to ensure that all 'Patch Tuesday' updates are included for all
> the servers??
>
> Are there any good books or tutorials???
>
> Thank you...

On Mar 16, 12:18*pm, "PA Bear [MS MVP]" <PABear...@gmail.com> wrote:
> [[ Right pew, wrong church. *Forwarded to WSUS newsgroup
> (microsoft.public.windows.server.update_services) via crosspost as a
> convenience to OP.

Thank you...I've never been religious about software or operating
systems, anyway.

tom12010 wrote:
>> [[ Right pew, wrong church. Forwarded to WSUS newsgroup
>> (microsoft.public.windows.server.update_services) via crosspost as a
>> convenience to OP.]]
>
> Thank you...I've never been religious about software or operating
> systems, anyway.

In any event, you won't find a rabbi in a church either! <VBEG>

> tom12010 wrote:

>> 1. How can WSUS be told to automatically decline all updates more than
>> X months old?? Say 6 months??

It cannot.

However, you can use the Server Cleanup Wizard to decline expired and
superceded updates that have not been reported as "Needed" by any system in
the past 30 days.


>> 2. How to make WSUS automatically approve all critical and important
>> updates but not recommended updates??

Classification in WSUS is not based on critical / important / recommended.
That is a Microsoft Update scenario only. In WSUS, updates are classified as
Security Updates, Critical Updates, Updates, Update Rollups, and some other
categories not directly related to severity.

In general, the MU equivalent of "critical and important" updates will
include everything in the WSUS Server classifications of "Security Updates"
and "Critical Updates"; however, you need to be especially cautious of the
unpredictable nature of "Updates" and "Update Rollups" vis-a-vis the MU
concept of "Recommended Updates".


>> 3. How to ensure that all 'Patch Tuesday' updates are included for all
>> the servers??

Approve them???


>> Are there any good books or tutorials???

On what? Fundamentals of Patch Management? Best Practices in Windows Update
Management? or something like product documentation: WSUS Operations Guide.

--
Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

On Mar 16, 5:30*pm, "Lawrence Garvin [MVP]" <lawre...@news.postalias>
wrote:
> > tom12010 wrote:
> >> 1. How can WSUS be told to automatically decline all updates more than
> >> X months old?? Say 6 months??
>
> It cannot.

too bad...that would save a lot of time.

> However, you can use the Server Cleanup Wizard to decline expired and
> superceded updates that have not been reported as "Needed" by any system in
> the past 30 days.

I'll try to figure this out.

> >> 2. How to make WSUS automatically approve all critical and important
> >> updates but not recommended updates??
>
> Classification in WSUS is not based on critical / important / recommended..
> That is a Microsoft Update scenario only. In WSUS, updates are classifiedas
> Security Updates, Critical Updates, Updates, Update Rollups, and some other
> categories not directly related to severity.
>
> In general, the MU equivalent of "critical and important" updates will
> include everything in the WSUS Server classifications of "Security Updates"
> and "Critical Updates"; however, you need to be especially cautious of the
> unpredictable nature of "Updates" and "Update Rollups" vis-a-vis the MU
> concept of "Recommended Updates".

It seems like all Security and Critical should be auto-approved, then
updates and update rollups should be reviewed and manually approved.
Thank you.

> >> 3. How to ensure that all 'Patch Tuesday' updates are included for all
> >> the servers??
>
> Approve them???

No, I meant that I have read things like such-and-such updates will be
included in WSUS etc. etc., and my question is if WSUS does not
automatically include all 'Patch Tuesday' patches FOR approval, then I
might as well not use it. What I meant is that I really want to
know that WSUS will always know about and present all 'Patch Tuesday'
updates -- these are the ones I am most concerned about getting with
WSUS and scheduling them to be done during off-hours with whatever
reboots etc. are necessary.

Thank you, Tom

P.S. I had trouble with your site in Firefox 3.0.7 -- things that
display in IE 7.x don't display in FF 3.0.7...

"tom12010" <> wrote in message
news:b96cbbca-36cd-43a5-b42c-...
On Mar 16, 5:30 pm, "Lawrence Garvin [MVP]" <lawre...@news.postalias>
wrote:
> > tom12010 wrote:
> >> 1. How can WSUS be told to automatically decline all updates more than
> >> X months old?? Say 6 months??
>
> It cannot.

It would also cause a lot of headaches. Who's to say an update should be
automatically declined based on a time period? There's some updates from
five years ago that still need to be installed; have never been superceded.

> too bad...that would save a lot of time.

How much time do you need to save. Create a custom view with the updates you
want to decline, select All, and click on Decline.

>It seems like all Security and Critical should be auto-approved, then
>updates and update rollups should be reviewed and manually approved.

Maybe for you... but the majority of people deploying WSUS are doing so
because they want direct approval authority over EACH and EVERY update
distributed in their enterprise. Why expend effort deploying a server that
does exactly what Automatic Updates already does, and has been doing, for
the past ten years?

> >> 3. How to ensure that all 'Patch Tuesday' updates are included for all
> >> the servers??
>
> Approve them???

>No, I meant that I have read things like such-and-such updates will be
>included in WSUS etc. etc.,

Hmm... well, if that's the extent of your reading, then I'd offer two
additional "learning" suggestions:

1. READ the WSUS Getting Started and WSUS Deployment guides.

2. Set up a WSUS Server in a =TEST= environment and observe how it actually
works.

The "such-and-such" will be included in WSUS is to distinguish from those
updates that are not -- which typically are untested HOTFIXes not meant for
general distribution.

>and my question is if WSUS does not
>automatically include all 'Patch Tuesday' patches FOR approval, then I
>might as well not use it.

WSUS can include ALL updates published to the Microsoft Update site; whether
it does, or not, is dependent on which classifications of updates you choose
to manage from your particular WSUS Server.

>P.S. I had trouble with your site in Firefox 3.0.7 -- things that
>display in IE 7.x don't display in FF 3.0.7...

Bummer. Except that it's not an IE7 site. It's like an IE5 site. The site is
based on a Frontpage 2000 template. There isn't even any ASP in the site,
it's pure, raw, HTML (with Frontpage extensions), albeit probably only HTML
v3.2 to be honest.

What specifically was the problem you encountered?


--
Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

On Mar 17, 5:28*pm, "Lawrence Garvin [MVP]" <lawre...@news.postalias>
wrote:

> Bummer. Except that it's not an IE7 site. It's like an IE5 site. The siteis
> based on a Frontpage 2000 template. There isn't even any ASP in the site,
> it's pure, raw, HTML (with Frontpage extensions), albeit probably only HTML
> v3.2 to be honest.
>
> What specifically was the problem you encountered?

The white section where the FAQ text is supposed to display was
blank...this could easily be rectified by globally updating all pages
somehow in one of at least a couple ways: 1) warn people that FF
doesn't work, IE does work (can't say anything yet about IE 8.x); 2)
globally somehow modify all pages to work in FF (without looking at
page code, I can't say more). I don't know how many pages there are
either, I didn't look that far in depth. Many people will figure out
trying another browser, some won't. Mainly depends how much time you
can put into it.

Thank you also for explaining in more detail in your above post...now
I know better what to look for in reading the manual and using views
etc.

"tom12010" <> wrote in message
news:f36b08bb-dc3f-40bf-b30e-...

>> What specifically was the problem you encountered?

> The white section where the FAQ text is supposed to display was blank...

Uhhh.. there's no FAQ on my site. The link is there. The page is there. Has
been there since the dawn of time. As noted in the text on the home page,
"The FAQ is ... a work in creation...". It's still a work in creation. When
(IF.... gosh I need another eight hours in each day) I actually get this
site moved over to my new Win2008/IIS7/ASP.NET v2 server, the FAQ link and
page will be removed.

Incidentally, if you did a View Source on that page
(http://wsusinfo.onsitechsolutions.com/faq.htm), you would have been able to
confirm that there's no content, and what you saw is exactly what's there.


--
Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin