setting up OU structure RRS feed

  • Question

  • Guys,

    When installing Wsus, how should i setup my OU structure and link and create the policy's?
    Should i create a test ou structure for testing the patches for every os? If so, how should i get the approved patches to the production workstation and servers? 

    Tuesday, May 8, 2018 6:37 AM

All replies

  • there is really no need to change your OU structure in this case: you can use WSUS client side targeting feature to group computers into "WSUS computer groups" and then approve updates to pre-production group prior to deploying them for all client computers.

    Here is a simplified example of what you can do:

    Create a "common update settings" GPO that specifies WSUS location, update schedule and other update options. Link this policy to OUs containing your client computer accounts, so that the policy will apply to all clients.

    Create a security group for "test clients". Manually add test computers to this group.

    Create a pre-production update GPO, link it to computer OUs and use security filtering to limit GPO scope to "test clients" group. Turn on "Windows Update\Enable client-side targeting" policy. Type inn computer group name, for example "Pre-production". Create Pre-production group in WSUS. Computers that are members of the "test computers" security group will now automatically appear in pre-production group in WSUS. When new updates arrive, you can first approve them for pre-production group only. Once tested, updates can be approved for all computers group.


    Tuesday, May 8, 2018 9:26 AM
  •  Any thanks for the reply. Do you know if some decent blogs exist or tutorials about wsus and setting up ou's?
    Thursday, May 17, 2018 2:23 PM
  • My blog on June 1st will have a guide on how to setup, manage, and maintain WSUS. Reply back on June 1st so that I remember to post the URL.

    Adam Marshall, MCSE: Security
    Microsoft MVP - Windows and Devices for IT

    Friday, May 18, 2018 2:02 AM