WSUS部署实验 Part5之 Project WSUS Overview
1.
Overview of WSUS Setup
WSUS Simple Overview
WSUS Simple Overview
The most basic WSUS deployment consists of a server inside the corporate firewall that serves client computers on a private intranet
WSUS server hierarchies
Autonomous mode: An upstream WSUS server shares updates with its downstream server or servers during synchronization, but not update approval status or computer group information. Downstream WSUS servers must be administered separately.
Replica mode: An upstream WSUS server shares updates, approval status, and computer groups with its downstream server or servers. Downstream replica servers inherit update approvals and cannot be administered apart from their upstream WSUS server.
Upstream & downstream with replica mode
Centralized management
HK as upstream management server
Other countries to run replica servers
Replica servers are not administered separately
used only to distribute approvals, groups, and updates
approvals and targeting groups created on the Upstream server are replicated throughout the entire organization
Centralized management
HK as upstream management server
Other countries to run replica servers
Replica servers are not administered separately
used only to distribute approvals, groups, and updates
approvals and targeting groups created on the Upstream server are replicated throughout the entire organization
Branch offices
low-bandwidth connections to the central office
high-bandwidth connections to the Internet
downstream WSUS servers to get information about which updates to install from the central WSUS server
but download the updates themselves from Microsoft Update
low-bandwidth connections to the central office
high-bandwidth connections to the Internet
downstream WSUS servers to get information about which updates to install from the central WSUS server
but download the updates themselves from Microsoft Update
2. Workflow
Normal Patch Management process:
1) On normal "Patch Tues" (second Tuesday of each month), person-in-charge (we are currently rotating it between SGP, TWN & KOR) will go through the new Windows critical patches and approve them to the Test group for each country. [Test group contain ITS machines]
2) An email will be sent out to inform Hub managers about the new patches and to get feedback as well if any.
3) After 1 week, if there is no feedback on any problem, the patches will then be released to the Pilot groups for each country. [Pilot group contain selected users' machines of different stream/division]
4) Another email will be sent to inform about this release to pilot group.
5) The new patches will then be released to all (Main groups) if there is no feedback the following week. [Main group contain all other machines
1) On normal "Patch Tues" (second Tuesday of each month), person-in-charge (we are currently rotating it between SGP, TWN & KOR) will go through the new Windows critical patches and approve them to the Test group for each country. [Test group contain ITS machines]
2) An email will be sent out to inform Hub managers about the new patches and to get feedback as well if any.
3) After 1 week, if there is no feedback on any problem, the patches will then be released to the Pilot groups for each country. [Pilot group contain selected users' machines of different stream/division]
4) Another email will be sent to inform about this release to pilot group.
5) The new patches will then be released to all (Main groups) if there is no feedback the following week. [Main group contain all other machines
"Out of normal/band" Patch Management process:
1) If there is any "out of band/normal" patches within the month, person-in-charge (we are currently rotating it between SGP, TWN & KOR) will go through these patches and approve them to only Test group. [Test group contain ITS machines]
3) After 3 days, if there is no feedback on any problem, the patches will then released to all (Pilot and Main groups). [Main group contain all other machines]
1) If there is any "out of band/normal" patches within the month, person-in-charge (we are currently rotating it between SGP, TWN & KOR) will go through these patches and approve them to only Test group. [Test group contain ITS machines]
3) After 3 days, if there is no feedback on any problem, the patches will then released to all (Pilot and Main groups). [Main group contain all other machines]
3. Demo on Patch Approval (Done by Upstream server Admins)
4. Downstream servers Admin Guide
Simple overview on console
Moving clients to respective group
Go to Unassigned Computers group
Right-click and select Change Membership…
Check the group/ groups you want the computer to be part of
Recommended to check Unassigned Computers group weekly for new machines.
Run Server Cleanup Wizard
Run Server Cleanup Wizard
On every end of the month, run this wizard to remove old updates and computers that are no longer reporting. This is found in the WSUS Console under Options.
Select All checkboxes and click Next. The cleanup would be completed in a few minutes.
Generating reports
Reports can be generated under the REPORTS menu. We will use Update Tabular Status as example here
Select the Report Options as required
Since we are only patching Critical & Security Updates for Windows XP only, that is what we will select the report to run.
Here we have selected only Singapore groups as example
Since we are only patching Critical & Security Updates for Windows XP only, that is what we will select the report to run.
Here we have selected only Singapore groups as example
All the updates shows on the left while its deployment status are shown on its right
Sort by Failed status to see which has the highest fail count
Click on the Update Title to see the machines that failed the deployment and troubleshoot from there.
Where necessary, manually install the Updates.
Sort by Failed status to see which has the highest fail count
Click on the Update Title to see the machines that failed the deployment and troubleshoot from there.
Where necessary, manually install the Updates.
Generating reports by specific KB#
To know which PCs are fail/ok to deploy the KB#, Right-click on Updates view and select Search
To know which PCs are fail/ok to deploy the KB#, Right-click on Updates view and select Search
Run a report for a specific PC
To know which KB# are fail/ok to deploy into the PC, Right-click on Computers and select Search
To know which KB# are fail/ok to deploy into the PC, Right-click on Computers and select Search
Checking the patch status from client PC
Patch status can be seen in Add/ Remove Programs from the client machines
Patch status can also be generated in EMS
Troubleshooting Guide
Clients not reporting to WSUS
Run clientdiag.exe
1. Access the following url from client
http://servername/iuident.cab <should prompt for file download>
http://servername/selfupdate/iuident.cab <should prompt for file download>
http://servername/clientwebservice/wusserverversion.xml <should be an xml page>
http://servername/simpleauthwebservice/simpleauth.asmx <should see two options on the webpage>
Patch status can also be generated in EMS
Troubleshooting Guide
Clients not reporting to WSUS
Run clientdiag.exe
1. Access the following url from client
http://servername/iuident.cab <should prompt for file download>
http://servername/selfupdate/iuident.cab <should prompt for file download>
http://servername/clientwebservice/wusserverversion.xml <should be an xml page>
http://servername/simpleauthwebservice/simpleauth.asmx <should see two options on the webpage>
2. Location of log files for more detailed events
Server side: %programfiles%\Update Service\LogFiles
Client side: %windir%\windowsupdate.log
3. If client PCs has been moved or deleted from a group. It will not be removed or deleted from the Upstream. Running the Server Cleanup Wizard will remove them.