WSUS - Is it just me?
Ever since we deployed WSUS it has brought all sorts of problems. What was meant to be a great solution, turned into a cumbersome nightmare that I'm ready to ditch. Below are the issues I constantly experience with WSUS. It is just me, or are you having issues as well?
1) WSUS services are constantly stopping, preventing updates and requiring manual restarts.
3) Machines do not follow the update schedules, even though the GPO and groups have been double checked and verified. Usually, they like to kick in at the worst possible time.
Because of these issues, WSUS deployment has cause me to spend much more time ensuring updates are installed as I have to troubleshoot updates for each individual machine constantly. So, in my experience, this is not a solution at all, and I'm really thinking about ditching the service.
Apply this GPP to your clients that you wish to have updated to Windows 10.
Setup 1 GPO to JUST point to the FQDN of the new WSUS Server on port 8530 for both the location and the reporting server.
Link this 1 GPO at the domain level.
Create a new GPO for desktops - setup the proper method of install (4 - Automatically download and install) including time for checking/installing, etc. Setup your appropriate auto-reboots if needed (Always automatically restart at the scheduled time), and setup WSUS Targeting to be "Desktops"
Create a new GPO for Laptops - setup the proper method of install (4 - Automatically download and install) including time for checking/installing, etc. Setup your appropriate auto-reboots if needed (Always automatically restart at the scheduled time), and setup WSUS Targeting to be "Laptops"
Create a new GPO for Servers - setup the proper method of install (3 - download and notify for install) including time for checking, etc. Setup WSUS Targeting to be "Servers"
Assign your GPOs appropriately to the OU that contains the Servers, Laptops/Desktops.
Now you're ready - wait for all systems to populate in WSUS on 2012 R2.
All of your computers attached to the domain will check this new location (care of the GPO at the domain root), and then appropriate policies for checking frequency, install methods, and others will apply at the lower levels combining to produce a great GPO inheritance setup.
I follow a really smart guy named Emin Atac (he was the one who helped me develop part of my WSUS Script) and he posted something that was enlightening in all regards with regards to WSUS and MITM attacks and how relatively easy it would be to compromise a network.
Please everyone mitigate this risk and switch to SSL.
Something's definitely wrong with your WSUS install. Dump that install and start over using the OverDrive's instructions and scripts.
Once done I'd take a good hard look at the server you had WSUS on and seriously consider nuking it as well.
When mine was a 2008R2 server I kept having issues with the WSUS database becoming corrupt and no matter what I did I could not fix it. So at least 3 times I had to uninstall and reinstall. Finally I found out (I was new to this job them) we had a license for Server 2012R2 and SQL 2012 so I installed WSUS on it using SQL 2012 and (knock on wood) I have had no issues since. That has been over a year now.
Alright, so it is just me. Thanks for the replies everyone. I will start over with OverDrive's instructions. However, I'm in the middle of an IMAP transfer to Office 365 and posted this out of frustration today. It will have to wait until next week after the email migration but, I'll keep you posted as I progress. Thanks again.
For item 3 - the GPO setting for Reschedule Automatic Updates Scheduled installations - if set to Disabled, should cause it to stick to the installation timeframe you set with the other policies. If your schedule is daily - this will not have any negative implications - but if your schedule period is longer some machines could get behind.
Other random thoughts - the update view panel is customizable - right click the header and you can select other columns to display - supercedence is always good to see.
When you configure the new server, you can set it up to email you a report which will let you keep tabs on your environment without having to touch the server on a regular basis.
Yeah, WSUS is almost a "set and forget" application. You definitely shouldn't be having so much trouble out of it.