Approve and deploy updates

Updated: July 13, 2009

Applies To: Windows SBS 2008

Update Services is designed to automatically approve the most important types of updates. Using the Software Update Settings dialog, you can enable automatic approval of the following types of updates:

  • Security updates

  • Critical updates

  • Service packs

  • Definition updates

  • Windows Small Business Server update rollups

Because administrators often want to manage updates for computers on the network based on the role of the computer, you can use Update Services to manage updates for server computers differently than for client computers. You can set a specific update level for each group.

Update Level

When you install Windows SBSĀ 2008, Setup configures a default update level for automatic approval of updates for the Server Computers group and the Client Computers group. The update level is the level of automatic approval that you want for a computer group. The available update levels for the Server Computers group and the Client Computers group are as follows:

Update level Action

High

Automatically approve for installation all security, critical and definition updates, all service packs, and all Windows Small Business Server update rollups. This is the default setting for the Client Computers group.

Medium

Automatically approve for installation all security, critical and definition updates, and all Windows Small Business Server update rollups. This is the default setting for the Server Computers group.

Low

Automatically approve all security and definition updates.

None

Do not automatically approve any updates.

You can change the update level for the Server Computers group or the Client Computers group by using the Software Update Settings dialog box. For instructions about how to change the update level for computer groups, see Change software update settings.

Automatic Approval

If you set an update level higher than None, Update Services automatically approves updates that match that update level. This means that you do not need to manually approve each update that matches the update level.

For example, the default update level setting for the Server Computers group is Medium, which includes security, critical, and definition updates, and Windows Small Business Server update rollups. With this setting, all security, critical, and definition updates, and all Windows Small Business Server update rollups that apply to the Server Computers group are approved and downloaded automatically.

Important

Updates that have revised Microsoft Software License Terms (MSLT) must be manually approved.

Note

You must be a network administrator to complete this procedure.

To manually approve an update that contains revised Microsoft Software License Terms

  1. Open the Windows SBS Console.

  2. On the Updates page, choose the appropriate update from Updates with Microsoft Software License Terms that are pending approval.

  3. Click Deploy the update.

  4. Click OK in the confirmation dialog.

  5. Review the MSLT, and then, if you agree with the terms, click I accept.

  6. Click OK in the confirmation dialog.

Note

Windows SBS Manager checks every 60 minutes to see if there are updates that are waiting to be automatically approved. During this check, if an update is available that requires automatic approval, the update is approved. Administrator involvement should not be necessary.

Deploying updates manually

Updates other than security, critical, definition updates, and service packs must be manually approved. For example, an update might be released for a device driver, or a new feature pack might be released. By default, Windows Server Update Services (WSUS) synchronizes only the following update classifications:

  • Critical Updates

  • Definition Updates

  • Security Updates

  • Service Packs

  • Update Rollups

You can specify what update classifications you want to make available for deployment across the Windows SBS network.

Note

You must be a network administrator to complete this procedure.

To add update classifications

  1. Click Start, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0 SP1.

  2. On the User Account Control page, click Continue.

  3. In the navigation pane, click Options. In the details pane, click Products and Classifications.

  4. Click Classifications, and then choose the additional update classifications that you want to make available for deployment.

Important

Do not clear the classifications that are configured by the Windows SBS installation. Modifying these classifications places your server in a non-recommended configuration.

  1. Click OK.

Note

In order to retrieve update definitions for the newly selected update classifications, either wait for the next scheduled synchronization or initiate a manual synchronization by opening the Windows SBS Console, clicking Security, clicking Updates, and then clicking Synchronize now.

Any update classifications that are added by an administrator and that are not part of the Windows SBS default configuration are listed as optional updates. You need to manually select updates originating from the new update classifications and determine whether to approve the updates for installation.

Note

You must be a network administrator to complete this procedure.

To manually approve an update

  1. Open the Windows SBS Console.

  2. Click Security, and then click Updates.

  3. Review the updates in the Optional Update section.

  4. Click the updates that you want to deploy, and then click Deploy the update.

  5. Click OK in the confirmation dialogs.

After you approve an update, click Refresh this view to move the updates to the Updates in Progress section.