Step 5: Migrate Content and Approvals from SUS to WSUS

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server Update Services

Now that you have configured and synchronized WSUS, you can migrate content and approvals from the SUS server(s) in your environment to your WSUS server. Migrate content and approvals from the local SUS server first. If you have additional SUS computers, you can configure SUS for remote migration and then migrate any remote content and approvals, mapping these approvals to a WSUS target group. This is optional.

Step 5 contains the following procedures:

  • Migrate local content and approvals.

  • Create WSUS target groups for mapping remote SUS approvals (optional).

  • Share remote content on SUS for migration to WSUS (optional).

  • Migrate remote content and approvals, mapping approvals to WSUS target groups (optional).

Use WSUSutil.exe to migrate local SUS content and approvals. By default, WSUSutil.exe appears in the following location:

WSUSInstallationDrive:\Program Files\Update Services\Tools

You must be a member of the local Administrators group on the WSUS server to import approvals or content from SUS. These operations can only be run from the WSUS server itself. You can only run WSUSutil.exe on a 32-bit platform.

Although SUS does not have to be running in order for you to move updates or approvals, you do have to make sure that SUS is not synchronizing before you migrate content or approvals. Although WSUSutil.exe allows you to move both approvals and updates, you are not required to migrate one, the other, or both.

To migrate local content and approvals from SUS and map approvals to the All Computers target group on WSUS

  1. At the command prompt, navigate to the directory that contains WSUSutil.exe.

  2. Type the following:

    wsusutil.exe migratesus /content PathToLocalSUSContent /approvals SUSServerName /log filename

    For example:

    wsusutil.exe migratesus /content c:\sus\content\cabs /approvals sus1 /log local_migration.log

Mapping remote approvals to a WSUS computer group is optional. It is helpful if you have multiple SUS servers in a single location and want to consolidate the SUS servers onto one WSUS server. If you intend to map remote SUS approvals to a WSUS computer group, first create the group on WSUS.

To create a computer group

  1. In the WSUS console toolbar, click Computers.

  2. Under Tasks, click Create a computer group.

  3. In the Group name box, type a name for your new computer group, and then click OK.

Once you have created the WSUS target group, you can migrate remote approvals and content by using WSUSutil.exe. This command-line utility uses HTTP to get approvals and SMB to copy updates from a remote SUS installation. To copy updates from a remote computer, this tool requires Read share permissions on the remote SUS Content folder and all its subfolders.

To share remote content on SUS for migration to WSUS

  1. On the remote SUS computer, locate the SUS content store in the file system. By default, SUS content is stored in C:\SUS\Content\.

  2. Right-click the Content folder, and then click Sharing and Security (or Sharing, on computers running Windows 2000).

  3. In the Properties dialog box for the Content folder, click Share this folder.

  4. Click the Security tab, and ensure that the Everyone group has Read NTFS permissions for the Content folder.

  5. Click OK.

  6. Repeat this step on each SUS server you intend to migrate.

To migrate remote content and approvals from SUS and map approvals to a custom computer group on WSUS

  1. At the command prompt, navigate to the folder that contains WSUSutil.exe.

  2. Type the following:

    wsusutil.exe migratesus /content LocationOfRemoteSUSContent /approvals SUSServerName  "WSUSTargetGroupName" /log filename

    For example:

    wsusutil.exe migratesus /content \\sus1\content\cabs /approvals sus1 "all desktops" /log remote_migration.log