9

We currently have our single internal WSUS server configured for all computers, both desktops and laptops. The WSUS server is available internally only (either VPN or LAN). We have some remote users who are almost never on-site and semi-frequently VPN into the network. Instead of having them download Windows Updates across the VPN, I'd like to accomplish the following:

  • While the clients are on the local network, they check the WSUS server for the updates that are approved and download them from our local WSUS server.
  • While the clients are remote, they check in to the WSUS server and the WSUS server dictates which updates to download, but they download them straight from Microsoft.

From what I've read, this is probably possible by having a secondary WSUS server that tells the clients to download from Microsoft and utilizing DNS netmask ordering to tell the clients which WSUS server to contact; is there a way to do this with a single WSUS server? All remote clients are Windows 7 SP1, WSUS is v3 on Server 2008 R2 SP1. Utilizing Microsoft RRAS for VPN services (IKEv2/SSTP/L2TP/PPTP).

Dan
  • 1,278
  • 18
  • 27

3 Answers3

4

I don't believe so, but one workaround is to implement an intercepting proxy server on your network. This means that you can configure the WSUS server to instruct clients to download from Microsoft, but still cache the content locally for machines on your network. (As an added bonus, updates will only be downloaded if they are actually needed, so you can be less selective about what you approve.)

A variation of this is to configure WinHTTP on your desktop machines to use a proxy server, although this means laptops that are on-site will still download from Microsoft. In principle you could write some software that detects the current location of the machine and reconfigures WinHTTP as necessary.

Harry Johnston
  • 5,875
  • 4
  • 35
  • 52
  • While an interesting solution, we have many subnets/sites/domains in our LAN that would make an intercepting proxy a pain to implement. Plus that would still require an additional server so we might as well go the dual WSUS route. – Dan Nov 17 '11 at 13:58
4

We ended up creating a second WSUS server as a replica of the main server with the one difference that any clients reporting to it download their updates directly from Microsoft (instead of it caching the downloads locally). We will most likely just use a GPO for all of our remote clients to report to this new WSUS server instead of using any DNS solutions; 99% of the time they are outside of the office so it's just simpler in the long run.

Dan
  • 1,278
  • 18
  • 27
0

Actually I don't think this is the idea of WSUS works. Since you can approve/reject updates in WSUS, the offsite users would not be affected by your policy.

Maybe MS Intune is the solution for this: Download from Microsoft, but you are still in control.

AndreasM
  • 1,083
  • 8
  • 13
  • 1
    You can have WSUS function in a mode where you approve/reject updates to decide what updates the clients receive, but the clients download directly from Microsoft. I could have remote clients point to a WSUS server that does just that and then local clients point to the traditional WSUS server. What I'm looking to do is have both of these rolled into one, but I'm not sure that it's possible :( – Dan Nov 17 '11 at 13:48