If you have Windows 10 clients on a WSUS server and you want to confirm that they are receiving patches from that WSUS server and not going directly to Microsoft to update, you used to just read the %SystemRoot%\WindowsUpdate.log. Under Windows 10 however, that log now looks like: Show
UPDATE: Oct 13, 2016: Microsoft Partner Support tells me that at least on Windows 10, specifying the SYMBOL SERVER is not required as it will automatically pull down any missing symbols without the switch so you can use:
I have tested this and found it definitely works on Windows 10 1607. If you want to run this on a remote machine use:
You can then open the log with notepad and look for “WSUS” like:
If you want to look further into your Windows 10 client’s you can check the registry to see what it:
but that is only a confirmation that your Windows 10 PC received the registry entries from your GPO… not that it is paying attention to that GPO. For instance, I am currently troubleshooting all my customers Windows 10 Enterprise 1607 Anniversary PC’s that have the GPO applied (according to GPRESULT /R) and the correct registry entry but NOT taking updates from WSUS. When I find an answer, I will post it here. This comprehensive guide explains the entire patch management process and its role in IT administration and security. The hyperlinks direct you to detailed articles on patch management best practices, tools and services.
By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.
What is Windows Server Update Services (WSUS)?Windows Server Update Services (WSUS) is a Windows server role that can plan, manage and deploy updates, patches and hotfixes for Windows servers, client operating systems (OSes) and other Microsoft software. It allows system administrators to control when and how systems install updates and provides a central point for clients to get the updates. It is designed for small to medium-sized business (SMB) use. There is typically no additional cost to add WSUS to a Windows network. Installed on Microsoft Windows Server, WSUS is a simple tool that system administrators use to manage Microsoft Windows updates. It is available for Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019 and will be part of Server 2022. All supported Microsoft client OSes can use WSUS, including Windows 8.1, 10 and 11. WSUS allows an organization to control when and how Windows devices receive OS updates and patches. It also allows for automated updates within specific parameters. Without WSUS, clients install updates as soon as they are available from Microsoft. This can cause clients to be at different patch levels, to install patches that break software or install during the middle of the workday, causing employee downtime. It also allows for automated updates within specific parameters Using WSUS gives system administrators time to test that the updates work with their network and allows them to install the updates during a maintenance time frame so that production work isn't affected. For example, an organization would want to avoid installing updates to the accounting department during tax preparation. This article is part of What is patch management? Lifecycle, benefits and best practices
Windows Server Update Services provides reporting about Windows updates in an organization. System administrators can use this information to see that all clients are installing updates correctly and have the same updates applied. This ensures that the systems have the correct security patches, reducing overall network vulnerability. Without WSUS, all clients go directly to Microsoft servers to download updates. In networks with many clients or with poor bandwidth, this could cause excessive internet use and affect productivity. With WSUS acting as a central point, the server downloads only one copy of the update from Microsoft and all clients can get the update from there. This approach makes better use of high-speed LAN connections and reduces overall internet usage. WSUS supports multiple languages and can selectively make the information for these languages available. Windows Server Update Services does not require any additional license for the server. Clients connecting to WSUS only require a Windows Server Client Access License (CAL). Because most organizations already purchase Windows Server and CALs, WSUS is typically no additional cost to an organization. WSUS only supports Microsoft products, such as Windows and Microsoft Office updates. It does not allow for installing new software or updating other products, such as Google Chrome. It also does not support other OSes such as macOS or Linux. How to use WSUSWSUS is installed to Windows Server as a server role using Microsoft Windows Server Manager. Once the role is activated it is available for use. It has a few prerequisites, including .NET, Microsoft Report Viewer, Internet Information Services (IIS), and a database such as Windows Internal Database (WID) or SQL. All these prerequisites are freely available on Windows Server. Depending on the size of the network, WSUS can be a single server or many working together. WSUS servers can get update content and configurations from each other. This allows for extremely large networks and for different office locations to each have their own server. Organizations can also use WSUS disconnected from the internet. This way, high security networks can receive regular patches without exposing the network to the internet. Just deploying a WSUS server to a network is not enough; clients must be configured to connect to it instead of to Microsoft update. System admins often configure the client using Group Policy, but may also set it up through System Center Configuration Manager (SCCM), mobile device management (MDM) or manually with registry keys. Admins can set how clients install updates, if they reboot after installation and how to notify users of the updates. The Windows Update Agent (WUA) performs the actions on the client to install updates. It connects to the WSUS server and scans for needed updates and then downloads and installs them. The download uses Background Intelligent Transfer Service (BITS) to optimize bandwidth use. WSUS requires a few network ports to be open for operation. The server must be able to communicate out to the internet Windows update servers on ports 80 and 443 to receive the update packages. Clients connect to the WSUS server on ports 8530 and 8531 by default, though these can be changed. WSUS and System Center Configuration ManagerWindows Server Update Services is a separate product from Microsoft System Center Configuration Manager. SCCM can perform any role that WSUS does and much more. WSUS only manages updates and patches, while SCCM allows for updates, patches, software installation, administration, configuration and inventory. WSUS is included with Windows Server. SCCM is a separate paid product from Microsoft. Windows Server Update Services and Windows Update for BusinessWindows Update for Business (WUfB) is a modern update system from Microsoft. In WUfB the organization sets when and how clients apply updates, but the clients connect to Microsoft servers or use peer distribution to download update content. This is different than in WSUS where clients connect to servers that the organization manages. WUfB is easier to set up and manage than WSUS and provides benefits to remote workers, but it does not provide as much control of updates nor as much bandwidth savings as WSUS. Where does WSUS download updates from?WSUS downloads these updates from the Microsoft Update website and then distributes them to computers on a network. WSUS is an integral component of Windows Server.
Where are WSUS Updates located?In the WSUS administrative console, click Options, and then click Update Files and Languages. Click the Update Files tab.
Does WSUS use http or https?In this article, I'll look at how the two changes, introduced in September 2020 and January 2021, can help improve WSUS security. By default, Windows clients connect to WSUS servers using HTTP on port 80.
Which products does WSUS update?Installed on Microsoft Windows Server, WSUS is a simple tool that system administrators use to manage Microsoft Windows updates. It is available for Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019 and will be part of Server 2022. All supported Microsoft client OSes can use WSUS, including Windows 8.1, 10 and 11.
|
