Configuring location based GPO for WSUS updates but only for some clients

Question

I would like to configure WSUS so that employees arrive in main location they use WSUS to download stuff, and when they are in other locations (different locations / home etc) they use Windows Updates.

It was suggested in this question to use subnets/locations to do that. This is fine solution however we decided that only about 10-15 computers will get automatic installation of updates, and rest will get an update/download only information.

So we're in situation where we should use a combination of GPO for Location and GPO for OU based (the automatic guys will get their own OU).

Is there a way to configure the windows clients so that WSUS will take it's information from 2 GPO's? Also what about Home / customers locations where we don't know the subnets? Can we somehow configure GPO so that computer when outside of known subnets/locations will turn on another GPO using Windows Updates from Microsoft but keeping our "choice" of automatic download vs download-only (depending on employee).

We choose to install everything for backoffice employees and download-only for programmers (which is 90% of company).

Solution 1

You need multiple GPOS.

1. Create 1 GPO to download using the WSUS server. Apply this to the site.
2. Create a group containing the computers that you want to auto update
3. create a GPO that sets the WSUS to auto install. Apply security filtering to the GPO that only lets the group in set 2 apply the policy. Apply this (as second priority to the GPO in step 1) to the site.

As far as connecting to WU, You need to have a company policy that remote users VPN in at some interval, to facilitate updates. create a replica server in your DMZ with no content so the systems will get the content from the microsoft update servers (so you won't need to be connected to the VPN to get the updates

Solution 2

I've done this with wsus and found that odd things go wrong. Do you want to use wsus to approve the updates but download from MS?

I set up something like this where the main office had its own wsus server and PCs in the branch offices had a secondary wsus server. The secondary server was configured not to download anything and the approvals were chained from the main server. I used GPO's to assign PC's to one or the other.

What I found what that users who took their laptops to the main office would show up once on the main server and never be able to connect to the secondary wsus server. I would have to delete the node from the main one to allow it to sync.

The same would occur for people who went to a branch office with their laptop.

Once a PC has contacted a particular wsus node it appears to 'stick' and you cannot switch over to another one.... but not always. Often this would correct itself. As far as I know this should work but I kept finding nodes which had not updated in months. Deleting the node in wsus would solve the issue.

in short - it didn't work well at all.

When people were offsite (but connected by vpn) the gpos should have directed the users directly to MS - but I would find that they would keep applying the old GPOs, sometimes for months before a gpupdate/force would correct the situation. This is a group policy problem but I never did find out why this occurred.

I switched over to a single server which feeds out the patches to everyone. Guess what? Noone noticed the difference but everything works perfectly.

Comments

[MadBoy]

We want to have 1 WSUS server in main location. We want updates to be approved by us for programmers and downloaded from WSUS when people are locally connected but they choose whether to install them or not. But we also want to download and install automatically for chosen computers (backoffice). When people are outside of company or branch offices they should get stuff from Microsoft but they should keep asking WSUS whether the updates were approved or not (if that's not possible then switching to MS to get everything).

[Ian Murphy]

The only way to do this is to have 2 wsus servers as the option to store locally or to pull from MS is an option on the server and not something you can force on the cliente using a GPO. The problem comes with switching back and forth. I found it didn't work very well. Give it a try, maybe you have better luck. You'll hit the problem of needing to apply a policy when its not in contact with the office to switch to not using wsus (or using the secondary wsus and accessing it by vpn)