Best Practices with Windows Server Update Services 3.0 SP2

  • Article

This section provides a list of best practices for managing updates with WSUS. There are four main sections: one on security practices, one on resource usage, one on setting up a WSUS network, and the last on miscellaneous best practices.

Best practices for security

The following practices can help you secure your WSUS network.

  1. Use the Secure Sockets Layer (SSL) for WSUS connections (server to server, server to client) on all computers that download updates via the Internet. For information about configuring SSL, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  2. If you do not want to use SSL, you can deploy Internet Protocol security (IPsec) on your network to secure network traffic. The Overview of IPsec Deployment (https://go.microsoft.com/fwlink/?LinkId=45154) topic offers guidance about how to deploy IPsec in your environment.

  3. Make sure that the WSUS server that downloads updates from Microsoft Update is secured behind a firewall, and allows access only to the domains needed by WSUS. For a description of these domains, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  4. Make sure that WSUS servers have only the file and folder permissions that are needed by WSUS. For a description of the necessary file and folder permissions, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  5. If a WSUS server is Internet-facing, its database should be located on a different computer that is not reachable from the Internet. For remote SQL Server installation information, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  6. There are two security groups that are set up for WSUS: WSUS Administrators and WSUS Reporters. WSUS Administrators can perform any WSUS task, while WSUS Reporters have read-only access (view server settings, get reports, and so on). Make sure that the only people in the WSUS Administrators group are the ones who need to perform administrative tasks.

Best practices for resource usage

Disk space

The following practices can help you conserve resources on your WSUS server.

  1. Make sure that your WSUS server is configured to download only approved updates. When the server synchronizes updates, it downloads only the update metadata and will download the update files only after the update has been approved.

  2. Use the Cleanup Wizard on a regular basis. This will keep the number of unneeded updates and revisions to a minimum.

  3. If a WSUS server has a small number of clients, or if most of the clients are "roaming" clients with Internet access, you may wish to host update content on Microsoft Update rather than on the local WSUS server. Clients will get update approvals from the server, but can pull the upload files directly from the Internet.

  4. If you are storing update content locally on your WSUS server, make sure you have enough disk space on the storage partition. Monitor disk usage on this partition carefully. One way to do this is to configure the WSUS health monitoring thread to warn you with an event if disk usage exceeds a specified percentage. For more information about configuring the health monitoring thread, see the explanation of the healthmonitoring parameter of the wsusutil utility in Managing WSUS 3.0 SP2 from the Command Line.

  5. Approve only the updates that are really needed on your network. Limit the product updates to the products that are installed on the network. You can also set up separate WSUS servers for computers with different sets of Microsoft products.

  6. Synchronize only the update languages needed on your network. If you need to synchronize more than one language and you are storing updates locally, you should estimate your needed disk space by multiplying the recommended space times the number of update languages. For more information about recommended disk space, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  7. Make sure that your WSUS server is configured to synchronize all the needed languages, because you will not be notified of needed updates in the unsynchronized languages. These updates will appear as “Not Needed” on clients who require the language. To help avoid that problem, make sure to include all operating system languages in your WSUS server's synchronization options. You can see all the operating system languages by going to the Computers view of the WSUS administration console and sorting the computers by operating system language. However, you may need to include more languages if there are Microsoft applications in more than one language (for example, if Microsoft Word in French is installed on some computers with Windows XP in English).

  8. You should allow WSUS to decline expired updates automatically (click Options, click Automatic Approvals, click the Advanced tab, and then click Automatically decline updates when a new revision causes them to expire). If you do not wish to decline expired updates automatically, you should decline them manually on a periodic basis.

  9. You should not choose to synchronize express installation files unless you have a pressing need to minimize downloads between the WSUS server and its clients. Typically, using express installation files reduces downloads from WSUS servers to clients by a factor of two but increases downloads from Microsoft Update (or an upstream server) to the WSUS server by a factor of four. You should decide which criteria are more important to your network: local network bandwidth or server disk space and Internet bandwidth.

Network bandwidth

The following practices will help you improve the way WSUS uses network bandwidth.

  1. When deploying large updates (such as service packs), you can avoid saturating the network by doing the following:

    1. Use BITS throttling. BITS bandwidth limitations can be controlled by time of day, but apply to all applications using BITS. For more information about BITS throttling, see Appendix E: Configuring BITS 2.0 and 3.0 for Download Performance.

    2. Use IIS throttling, which limits throttling to one or more Web services. For more information about IIS throttling, see Appendix F: Configuring IIS for Download Performance.

    3. Use targeting to control the rollout. You can set up multiple computer groups, then approve large service pack downloads for a subset of these groups at one time.

  2. Use peer caching (available only on Windows Vista and Windows Server 2008 operating systems) to minimize downloads from WSUS servers to clients and maximize the "sharing" of downloads among peer computers on a subnet of the network. This will reduce network load and in particular load on the WSUS server. For more information about peer caching, see Appendix E: Configuring BITS 2.0 and 3.0 for Download Performance.

  3. Consider configuring WSUS clients to synchronize more frequently from the WSUS server and configuring downstream WSUS servers to synchronize more frequently from their upstream servers. This will allow updates to be deployed to clients faster, which could be important if you need to deploy an “emergency update” that must be installed as quickly as possible. This will result in smaller downloads from server to client, but will add additional load to the WSUS server. It will also add additional load to the network when updates are deployed, because clients start downloading updates as soon as they synchronize with the server.

Best practices for setting up WSUS networks

The following practices will help you configure WSUS networks.

  1. If possible, set up WSUS networks with a hub-and-spoke topology rather than a hierarchical one. The greater the number of tiers in the network, the greater the latency in downloading updates.

  2. Consider using DNS netmask ordering for roaming clients. For more information about setting up this configuration, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  3. Configure roaming clients, so they get their updates from the Internet-facing WSUS server, if they do not usually connect to your local intranet.

Best practices for maintaining WSUS databases

The following practices will help you get the best performance from your WSUS network.

  1. Have a maintenance plan for your WSUS database that includes regular backups and periodic re-indexing.

  2. Make sure to re-index the WSUS database at least once a month. See Appendix I: Database Maintenance for more information.

Other best practices

Manage restarts

The following practices will help you manage computer restarts.

  1. Client computers (and most servers) often need restarts after an update is installed. Deferring the restarts will put machines in an unsupported and unstable state, which may include mismatched client and server binaries. These computers should be set up to get automatic downloads and scheduled installs. You can pick a time for scheduled installations when there is little chance for lost productivity (for example, on Sunday at 3:00 A.M). For information about setting up client computers for a scheduled installation, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

  2. Critical servers cannot generally be restarted daily. If this is the case, you can either configure them for installations at longer intervals (weekly), or configure them to get automatic downloads but manual installations at a time when the servers can be restarted if necessary.

  3. Configure e-mail notification to tell you when updates become available, so you can plan the deployment of these updates in advance.

  4. If you need to deploy an “emergency update” and can’t wait for the next scheduled installation, approve the update with a deadline in the past. This will cause the update to be installed the next time the clients synchronize from the server. If you can’t wait for the next synchronization, create a script to automate installing the updates and then restarting your server. For more information about creating scripts to automate Automatic Updates tasks, see the Windows Update Agent Software Developer's Kit (https://go.microsoft.com/fwlink/?LinkID=43101).

  5. Configure client computers or WSUS servers to immediately install updates that do not require a restart. For information about setting up client computers for a scheduled installation, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

Ensure WSUS availability

The following practices will help you ensure that WSUS servers are always available to their clients.

  1. There are typically two different backup strategies. The first is a standard backup and restore strategy. For information about backing up and restoring WSUS, see Backing Up Windows Server Update Services 3.0 SP2. This strategy requires more work to maintain and requires extra storage for the backup files, but makes it possible to restore the system to a known state without needing to download the update files once more. The other strategy is to rebuild the server. This is a fairly fast operation and is preferred by many customers, because it requires less work and less disk space.

  2. Consider using network load balancing if you have a requirement for high availability. Load balancing involves a more complex configuration and is not typically considered necessary, because new updates are not released very frequently. For more information about setting up network load balancing, see the WSUS Deployment Guide (https://go.microsoft.com/fwlink/?LinkId=139832).

Test service packs carefully

You should thoroughly test large bundles of updates such as service packs to ensure that they do not break line-of-business applications. A typical test strategy is to set up test computer groups in which the test computers are configured with the same applications as the production groups, approve installation only to these groups, and then verify that the applications continue to function correctly.

Check overall system health

The following practices will help you monitor the general health of your WSUS network.

  1. You should check the WSUS administration console home page at least once a day to view overall update compliance and network health.

  2. Check application logs frequently, if you suspect problems such as download failures or clients that are failing to report to the WSUS server.

  3. Install the WSUS MOM Pack to monitor overall service health.