Presentation is loading. Please wait.

Presentation is loading. Please wait.

WSUS Windows Update Services

Similar presentations


Presentation on theme: "WSUS Windows Update Services"— Presentation transcript:

1 WSUS Windows Update Services
Robert Cultrara World Health Organization

2 Purpose of the presentation
How to make an assessment of the security on your windows network Get started with Microsoft and Windows update How to install, manage and troubleshoot WSUS How WSUS can be used in a low-bandwidth environment

3 The problem: Viruses (self inflicted) Worms (network inflicted)
*.ware - Malware/Spyware Users countering policy Service and Network Outage (due to saturation and loss)

4 Microsoft Baseline Security Analyzer (MBSA)
MBSA makes an assessment of your windows network security It provides you clear instruction how to make your windows network more secure

5 Windows and Microsoft updates

6 WU and MU Windows Update Just patches Windows
Microsoft update Patches Windows Office Exchange More to come Engine is the same - Troubleshoot the same

7 MU is optional How to activate Microsoft update

8 MU steps Accept EULA Need to install software to get it to use it
Downloads activeX files \Windows\Downloaded Program Files The following ActiveX controls will be installed: MUWebControl Class WUWebControl Class

9 Is it safe? If first visit will get ‘authenticode’ prompt

10 Checking for updates

11 Two options to install Express Install: This option is recommended and provides the easiest method for installing high priority updates. Custom Install: This option enables a user to select which specific updates are installed.

12 Better ‘history’ interface

13 Revert to WU Go back Click on Change settings Check the box

14 File updated Windows Genuine Advantage control Windows Installer 3.1
Background Intelligent Transfer Service (BITS) update

15 Auto updates options Download
Will allow you to install them at a later time

16 WSUS How to update an entire network

17 WSUS installation Install on Windows server
As default it goes on port 8530 On standard loads up a MSDE instance Remember …clients may need in registry or Group Policy

18 WSUS: Services √ SUS 1.0 synchronizes with WU
Supported Applications Windows Update Microsoft Update Windows (2000 SP3+, XP+, WS2003) Office (XP & 2003) SQL Server 2000, MSDE 2000 Exchange 2003 Additional products over time SUS 1.0 synchronizes with WU WSUS synchronizes with MU Both services built on customized version of Windows Update Services

19 WSUS: How it Works Microsoft Update WUS Server
Desktop Clients Target Group 1 Server Clients Target Group 2 WUS Administrator Administrator approves updates Administrator subscribes to update categories Server downloads updates from Microsoft Update Clients register themselves with the server Administrator puts clients in different target groups Clients install administrator approved updates

20 Update Management Features
Target Groups Registry-based policy support for AD environments Server-side lists for non-AD environments Administrator control Initiate scan of machines for patch applicability Approve for install and uninstall (requires update support) Date-based deadlines for approved updates Deploy different updates to target groups Configurable client polling frequency Configurable reboot behavior Port configurability Non-administrators can install updates (like administrators) Install at Shutdown (XP SP2 only)

21 WSUS issues Clients may not check in Sync process takes a long time
Manually put in registry Sync process takes a long time About 24 hours if you pull down all files

22 Install WSUS… Double-click the installer file WSUSSetup.exe. Note:
The latest version of WSUSSetup.exe is available on the Microsoft Web site for Windows Server Update Services at 2. On the Welcome page of the wizard, click Next. 3. Read the terms of the license agreement carefully, click I accept the terms of the License Agreement, and then click Next. 4. On the Select Update Source page, you can specify where clients get updates. If you select the Store updates locally check box, updates are stored on the WSUS server and you select a location in the file system to store updates. If you do not store updates locally, client computers connect to Microsoft Update to get approved updates. Keep the default options, and click Next. Select Update Source Page

23 Install Needs a LOT of disk space 6 GB

24 WMSDE is default On the Database Options page, you select the software used to manage the WSUS database. By default, WSUS Setup offers to install WMSDE if the computer you are installing to runs Windows Server 2003. If you cannot use WMSDE, you must provide a SQL Server instance for WSUS to use, by clicking Use an existing database server on this computer and typing the instance name in the SQL instance name box. For more information about database software options besides WMSDE, see the “Deploying Microsoft Windows Server Update Services” white paper. Keep the default options, and click Next. Database Options Page

25 WSUS install Now up to 8 gigs

26 Web admin console WSUS will chose 8530

27 To get to WSUS Admin tools

28 WSUS sync

29 WSUS console Missing the computers!

30 Adding the WUAU template
1. In Group Policy Object Editor, click either of the Administrative Templates nodes. 2. On the Action menu, click Add/Remove Templates. 3. Click Add. 4. In the Policy Templates dialog box, click wuau.adm, and then click Open. 5. In the Add/Remove Templates dialog box, click Close.

31 Connect the clients In Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update. In the details pane, click Specify Intranet Microsoft update service location. Type the HTTP URL of the same WSUS server in both Set the intranet update service for detecting updates and Set the intranet statistics server. For example, type in both text boxes, where servername is the name of your WSUS server. Click OK, and then configure the behavior of Automatic Updates

32 Assigning groups Two methods Group policy Move computers

33 Group Policy Add a new policy to active directory

34 Drill down to the setting
Computer config Admin Components Windows Update

35 WU – point it First point your intranet updating Remember 8530

36 Change the check in interval
If you like – change the detection frequency

37 Adding ZONES Key decision making right here What risk What zone
What deployment strategy Who gets what patches when? At least have a Zone for the server[s] One for workstations More zones?

38 Groups are your Risk areas
Create the ‘groups’ to match your risk zones

39 Approve updates Approval

40 Approval Approval – be patient

41 Troubleshooting Main causes of issue are simple configuration errors
“ in a GPO Object SelfUpdate tree needs to be on port 80 Tools with the RC Clientdiag.exe – diagnoses some issues Logs %systemroot%\WindowsUpdate.log

42 Securing WSUS traffic Forcing WSUSAdmin site to use SSL is simple
Obtain and install a web certificate Enable SSL on WSUSADMIN directory

43 Low-bandwidth tips Some initial configuration requires
Synchronisation options Schedule What types of updates Proxy server settings Languages (ALL languages is the default) Automatic Approval options Which updates should be automatically approved


Download ppt "WSUS Windows Update Services"

Similar presentations


Ads by Google