Anyone know a bit about WSUS?

[UNICRONICUS]

One for you IT boffins.

I have installed WSUS 3.0 on our domain and it seems to be working ok at the moment, i.e. my GPO's are working fine, the clients are going to their specified group in the WSUS console, the server is downloading updates etc... Since some of our machines haven't been updating automatically in years, the WSUS console has downloaded circa 2,500 updates already for various MS products, and once I have approved these updates for install they take a lifetime to install to the clients. My last batch of PC's that I rolled these updates out to are all on 99% in the installed/not applicable section and at most they only need 15 more updates to reach 100%. I approved these updates for these machines last week and yet they are still not quite complete, I know they had a lot of updates to install and filter out but should it really take this long initially? Is there a limit on how much a client can install at one go from 2,000+ updates, i.e. are they limited to 100 installs a day (since our GPO is configured to install them at midnight every day) or should they all be banged out in one go? I personally don't agree with the install time being midnight as most machines are turned off then, but my boss seems to think that it should work fine...

Can anyone shed some light on my WSUS setup and whether it is performing normally, considering it is a fairly new setup.

Cheers!

[Guybrush]

you might be better off asking on experts exchange... although they are not very good with turbo related questions.... so for them, come back here

[UNICRONICUS]

I would like to ask the guys on Experts Exchange but it costs money to join and I aint spending my own money to ask a couple of questions if it's for work. It would be an advantage for us to create an account with them, I have on numerous occasions searched for a problem in google and their site pops up with the answer! Just thought someone might know a bit about this subject on here in compoota chat

[RichR]

I'm no expert on it, but do use it fairly often.

There are issues with large updates causing the local WUAU service to lock up. In particular we find SQL 2005 SP2 and Office 2007 SP1 just won't go out over WSUS if there are other large updates.

Try only approving a couple of updates at a time, and see if they apply. Also it's worth creating a test group with only one machine in it, so it's easier to test things out. Also worth forcing the clients with wuauclt.exe /updatenow if you're not already doing that.

If you've got clients that refuse to pick up updates, but do have the GP set, then you might need to reset the WUAU service by deleting the cached files. There's a MS technote on how to do this.

[UNICRONICUS]

Cheers for that info Rich! I was testing it out on a few machines in one OU before rolling it out to other departments and although the updates took a while to reach 100% installed it still completed successfully. I have now started to deploy updates to other OU's but one OU (which contain around 10 PC's on each floor) at a time. All machine's in this OU are sitting at 99% so I guess the next time they contact the WSUS server they should download the remaining updates and install them (at midnight) which should bring them up to 100%. You are right about approving updates in small bunches as well, but my boss wanted to approve ALL updates going back to 2003 for this OU! So it's no wonder they are taking ages to complete, but he seems to think they should just install at a click of a finger

We don't force the update policy either, we just let the GPO deal with the schedule unless I want the updates to happen right now for testing.

Cheers!