Regular TLA reader Chris Sanders has contributed the following list of frequently asked questions about WSUS.
Windows Server Update Services Q&A
I have deployed several WSUS servers in networks of all sizes. This Microsoft technology is one that I believe is a necessity for any network that includes Microsoft servers or clients. Unfortunately, I still see a lot of network admins who don’t deploy it just because they have misconceptions about it. The purpose of this Q&A is to address some of the most common answers I get from those who are looking to deploy WSUS.
Q: What is WSUS?
A: Windows Server Update Services, known as WSUS, is a technology that runs on Windows Server 2003/2008 and allows network administrators to distribute and manage updates to Microsoft products.
Q: How much does it cost?
A: WSUS is provided FREE of charge. However, it does require a server operating system to run, so you must have a valid license for that operating system, as well as Client Access Licenses (CALs) for each computer being updated by the WSUS server.
Q: What products will it update?
A: WSUS will manage updates for virtually every Microsoft product. This includes the Windows Server 2000, 2003, 2008, and Small Business Server operating systems. Client operating systems that can be managed include Windows 2000, XP, and Vista. Also included are Exchange 2000, 2003, and 2007, Forefront Security, Internet Security and Accelerate Server (ISA), SQL Server 2000 and 2005, Systems Management Server (SMS), and Microsoft Office 2003 and 2007. For a complete listing, check the official WSUS website, at http://technet.microsoft.com/en-us/wsus/default.aspx.
Q: What are the server prerequisites for WSUS?
A: WSUS must run on Windows Server 2003 SP1 or Windows Server 2008. The other components that are required include Internet Information Service (IIS) 6.0, .NET Framework 2.0, MMC 3.0, and Microsoft Report Viewer 2005.
Q: Do I have to have a dedicated server for WSUS?
A: Although isolation of services is always recommended, this isn’t a requirement. As a matter of fact, in smaller networks most people piggyback WSUS off of an existing file server or backup domain controller. WSUS is pretty flexible so you can typically place it where you see fit. It is also not uncommon to see WSUS running within a virtual machine.
Q: How much disk space does WSUS require?
A: If you are storing the downloaded updates locally on the server, then you will need at least 6 GB of free space. Depending on the products you will be updating you may need as much as 30 GB of space.
Q: My network spans multiple locations. How can I effectively use WSUS?
A: WSUS was designed with this in mind. It provides the ability to utilize upstream and downstream servers in order to fit most any network topology. Using this model, you can configure multiple downstream servers to synchronize with a locally housed upstream server. This removes administrative burden and conserves bandwidth.
Q: Can I use WSUS on a network that is disconnected from the Internet?
A: Yes. You can export the updates from a WSUS server that is connected to the Internet and import them into an offline WSUS installation. Doing this, you can manage update approvals just as you would with an online WSUS installation.
Q: Where can I get WSUS?
A: WSUS can be downloaded directly from Microsoft. The latest version, WSUS 3.0 SP1 can be downloaded here: http://www.microsoft.com/downloads/details.aspx?FamilyId=F87B4C5E-4161-48AF-9FF8-A96993C688DF&displaylang=en#Requirements.
Q: Where can I get support for WSUS troubleshooting issues?
A: Since WSUS is so widely used, the community support for it is quite large. One of the best WSUS support sites is http://www.wsus.info, which is run by a Microsoft MVP in software deployment. I also write about WSUS quite a bit on my personal blog at http://www.chrissanders.org. You can stay up to date on new release information at the official Microsoft WSUS team blog at http://blogs.technet.com/wsus/.
I’d say about 90% of the WSUS related questions I receive in my inbox can be answered by reading this FAQ. There really is no valid reason why your network shouldn’t be running some form of software update distribution, and unless you are running some type of managed services software or SMS, then WSUS is the best way to do that.
About Chris Sanders:
Chris Sanders is a Senior Support Engineer for KeeFORCE, a technology consulting firm in western Kentucky. Chris writes and speaks on various topics including packet analysis, network security, Microsoft technologies, and general network administration. His personal website at www.chrissanders.org contains a great deal of information, articles, and guides related to these topics.
