implementing partching using wsus(Installing and configuring wsus)

 

Exercise 1 - Install and Configure WSUS

Windows Server Update Services (WSUS) provides a cost effective patch management solution to deploy updates to domain-joined Windows servers and workstation in a corporate network. WSUS is fully integrated in Windows Server 2012 and can be enabled on Windows clients by configuring settings in Group Policy Objects - GPO.

To get a better understanding of this technology, please refer to your course material or use your preferred search engine to research this topic in more detail.

Task 1 - Initialize Disk Storage for WSUS

In this task, you will use PLABDM01 as the designated server to run Windows Server Update Services. To prepare this server to assume the role of WSUS server, you must prepare the disk volume that will be used for storage of operating system updates. To configure the disk on PLABDM01 server, follow these steps:

Step 1

Ensure you have powered on the required devices and connect to PLABDM01.

From Server Manager Dashboard, click on Tools > Computer Management.

Figure 1.1 Screenshot of the PLABDM01 desktop
Figure 1.1 Screenshot of the PLABDM01 desktop: Tools > Computer Management menu-options are highlighted on the Server Manager console.

Step 2

On the Computer Management console, on the left pane, click Storage node and click Disk Management.

On the right-details pane, scroll down a bit to see the list of available disk volumes.

Then right-click Disk 1 and select Online.

Figure 1.2 Screenshot of the PLABDM01 desktop
Figure 1.2 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking the label area of an offline disk) > Online menu-options are displayed on the Computer Management console.

Step 3

Right-click on Disk 1's unallocated partition and choose New Simple Volume.

The New Simple Volume Wizard will launch.

Click Next twice on the wizard, keeping the default settings.

Figure 1.3 Screenshot of the PLABDM01 desktop
Figure 1.3 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking the unallocated portion of a disk) > New Simple Volume menu-options are displayed on the Computer Management console.

Step 4

When you reach the Assign Drive Letter or Path options, make sure drive letter E is selected.

Click Next.

Figure 1.4 Screenshot of the PLABDM01 desktop
Figure 1.4 Screenshot of the PLABDM01 desktop: Assign Drive Letter or Path page on the New Simple Volume Wizard is displayed showing the required settings performed and the Next button highlighted.

Step 5

Keep the default Format Partition options and click Next.

Click Finish to close the Completing the New Simple Volume Wizard page.

Wait for the formatting process to be completed before installing WSUS.

Figure 1.5 Screenshot of the PLABDM01 desktop
Figure 1.5 Screenshot of the PLABDM01 desktop: Format Partition page on the New Simple Volume Wizard is displayed showing default settings and the Next button highlighted.

Close Computer Management.

Keep all devices powered on in their current state and proceed to the next task.

Task 2 - Install and Configure WSUS

To install the Windows Server Update Services server, follow these steps:

Step 1

Connect to PLABDM01.

Click on the Start button and select Windows PowerShell from the menu.

Figure 1.6 Screenshot of the PLABDM01 desktop
Figure 1.6 Screenshot of the PLABDM01 desktop: PowerShell icon highlighted on the Start.

Step 2

On the Windows PowerShell prompt, type the following:

cd\
Add-WindowsFeature UpdateServices,UpdateServices-WidDB,UpdateServices-Services -IncludeManagementTools

Press Enter.

Figure 1.7 Screenshot of the PLABDM01 desktop
Figure 1.7 Screenshot of the PLABDM01 desktop: Command typed-in to install the update services on the server is displayed on the Windows PowerShell window.

Note: Please wait while the services are being installed. This will take a few moments.

Step 3

Windows indicates that the services and their dependencies were successfully installed.

Close Windows PowerShell window.

Figure 1.8 Screenshot of the PLABDM01 desktop
Figure 1.8 Screenshot of the PLABDM01 desktop: Status of the installation is displayed on the Windows PowerShell window.

Step 4

Reopen Server Manager Dashboard, click the Tools menu and select Windows Server Update Services.

Figure 1.9 Screenshot of the PLABDM01 desktop
Figure 1.9 Screenshot of the PLABDM01 desktop: Tools > Windows Server Update Services menu-options are selected on the Server Manager console.

Step 5

On Complete WSUS Installation dialogue box, select Store updates locally box.

In Content directory path type:

e:\Updates

Select Run.

Note: Wait for the configuration of WSUS to be completed. This process will take a few minutes to finish.

Figure 1.10 Screenshot of the PLABDM01 desktop
Figure 1.10 Screenshot of the PLABDM01 desktop: Complete WSUS Installation dialog box is displayed showing the required settings performed and the Run button available.

On Complete WSUS Installation, click Close when the progress bar has reached the end.

Note: On the Server Manager Dashboard, you will notice a yellow exclamation point icon, appended to the flag. This indicates that additional required configuration is needed. WSUS will automatically launch a wizard to address this requirement.

Step 6

The WSUS configuration wizard page automatically opens.

On the Before you begin page, click Next.

Figure 1.11 Screenshot of the PLABDM01 desktop
Figure 1.11 Screenshot of the PLABDM01 desktop: Before You Begin page on the Windows Server Update Services Configuration Wizard.

Step 7

On Microsoft Update Improvement Program page, clear Yes, I would like to join the Microsoft Update Improvement Program check box.

Click Next.

Figure 1.12 Screenshot of the PLABDM01 desktop
Figure 1.12 Screenshot of the PLABDM01 desktop: Microsoft Update Improvement Program page on the Windows Server Update Services Configuration Wizard.

Step 8

Since this is the first WSUS server to be rolled out for this lab, accept the default setting to Synchronise from Microsoft Update option.

Click Next.

Figure 1.13 Screenshot of the PLABDM01 desktop
Figure 1.13 Screenshot of the PLABDM01 desktop: Choose Upstream Server page on the Windows Server Update Services Configuration Wizard.

Step 9

On Specify Proxy Server page, select Use a proxy when synchronizing. Enter the following information:

Proxy server name: proxy
Port number: 8080

Click Next.

Figure 1.14 Screenshot of the PLABDM01 desktop
Figure 1.14 Screenshot of the PLABDM01 desktop: Specify Proxy Server page on the Windows Server Update Services Configuration Wizard.

Step 10

On Connect to Upstream Server, click on Start Connecting.

On Connect to Upstream Server screen, please wait while it downloads update information from Microsoft.

Figure 1.15 Screenshot of the PLABDM01 desktop
Figure 1.15 Screenshot of the PLABDM01 desktop: Connect to Upstream Server page on the Windows Server Update Services Configuration Wizard.

Alert: Depending on the amount of updates, this can take up to 20 minutes to complete.

Step 11

On Choose Languages page, verify that only English check box is selected.

Click Next.

Figure 1.16 Screenshot of the PLABDM01 desktop
Figure 1.16 Screenshot of the PLABDM01 desktop: Choose Languages page on the Windows Server Update Services Configuration Wizard.

Step 12

Scroll down the list of products and select Windows 10 and Windows 8.1.

Click Next.

Figure 1.17 Screenshot of the PLABDM01 desktop
Figure 1.17 Screenshot of the PLABDM01 desktop: Products and Classifications dialog box is displayed showing the required settings performed and the OK button highlighted.

Step 13

On the Choose Classifications page, select only Critical Updates check box.

Choose Next.

Figure 1.18 Screenshot of the PLABDM01 desktop
Figure 1.18 Screenshot of the PLABDM01 desktop: Choose Classifications page on the Windows Server Update Services Configuration Wizard.

Step 14

On the Set Sync Schedule page, accept the default to Synchronise manually.

Click Next.

Figure 1.19 Screenshot of the PLABDM01 desktop
Figure 1.19 Screenshot of the PLABDM01 desktop: Set Sync Schedule page on the Windows Server Update Services Configuration Wizard.

Step 15

On the Finished screen, select Begin initial synchronisation check box and choose Next.

On the What's Next page, click Finish.

Figure 1.20 Screenshot of the PLABDM01 desktop
Figure 1.20 Screenshot of the PLABDM01 desktop: Finished page on the Windows Server Update Services Configuration Wizard.

Step 16

The Update Services console will automatically open.

If you don’t see it, click on the taskbar as it appears as a minimized icon.

Figure 1.21 Screenshot of the PLABDM01 desktop
Figure 1.21 Screenshot of the PLABDM01 desktop: Update Services window is displayed on the PLABDM01 Windows desktop.

Step 17

Expand PLABDM01 node.

Click on Synchronizations node, and you can see the progress of downloading the updates from Microsoft on the bottom center pane.

Wait for the synchronization to complete. This will take a few minutes to finish.

Figure 1.22 Screenshot of the PLABDM01 desktop
Figure 1.22 Screenshot of the PLABDM01 desktop: The Update Services console is displayed showing the PLABDM01 > Synchronizations node-path selected on the navigation pane at the left and the Synchronization Status appearing on the lower-middle pane.

Step 18

When Synchronization is complete, you can see the details of the download.

Minimize Update Services console.

Figure 1.23 Screenshot of the PLABDM01 desktop
Figure 1.23 Screenshot of the PLABDM01 desktop: Update Services console is displayed showing status of synchronization on the lower-middle pane.

Keep all devices powered on in their current state and proceed to the next task.

Task 3 - Enable SSL for WSUS Server

For security reasons, it is important that you enable secure sockets layer for WSUS server to encrypt web network traffic between the server and the requesting clients. In addition, SSL verifies the identity of the WSUS server when Windows update clients make a connection to it.

To enable SSL on the WSUS server, perform the following steps:

Step 1

On PLABDM01 device, go to Server Manager Dashboard, click on Tools and select Internet Information Services Manager.

Figure 1.24 Screenshot of the PLABDM01 desktop
Figure 1.24 Screenshot of the PLABDM01 desktop: Tools > Internet Information Services (IIS) Manager menu-options are highlighted on the Server Manager console.

Step 2

Alert: If you get a prompt about updating to latest web platform components, click No.

On IIS Manager, click on PLABDM01 and on centre pane select Server Certificates.

On Actions pane, click Open Feature.

Figure 1.25 Screenshot of the PLABDM01 desktop
Figure 1.25 Screenshot of the PLABDM01 desktop: Internet Information Services (IIS) Manager console is displayed showing the required icon selected on the PLABDM01 Home pane in the middle and the Open Feature link available on the Actions pane at the right.

Step 3

On Actions pane, click Create Self-Signed Certificate.

Figure 1.26 Screenshot of the PLABDM01 desktop
Figure 1.26 Screenshot of the PLABDM01 desktop: Create Self-Signed Certificate link on the Actions pane at the right is available on the Internet Information Services (IIS) Manager console.

Step 4

On the Specify Friendly Name dialog box, use the following information:

Specify a friendly name for the certificate: PLABDM01-WSUS

Select a certificate store for the new certificate: Personal

Click OK.

Figure 1.27 Screenshot of the PLABDM01 desktop
Figure 1.27 Screenshot of the PLABDM01 desktop: Specify Friendly Name page on the Create Self-Signed Certificate dialog box is displayed showing the required values typed-in and the OK button highlighted.

Step 5

Expand Sites and then click on WSUS Administration.

On the centre pane, right-click on SSL Settings and choose Bindings...

Figure 1.28 Screenshot of the PLABDM01 desktop
Figure 1.28 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking an icon) > Bindings menu-options are selected on the Internet Information Services (IIS) Manager console with the required node-path selected on the navigation pane at the left.

Step 6

On the Site Bindings dialog box, select https and click Edit.

Figure 1.29 Screenshot of the PLABDM01 desktop
Figure 1.29 Screenshot of the PLABDM01 desktop: Site Bindings dialog box is displayed showing the required selection performed and the Edit button highlighted.

Step 7

On the Edit Site Binding dialog box, use the following information:

Hostname: plabdm01.practicelabs.com

Choose SSL certificate PLABDM01-WSUS from the drop down list.

Click OK.

Figure 1.30 Screenshot of the PLABDM01 desktop
Figure 1.30 Screenshot of the PLABDM01 desktop: Edit Site Binding dialog box is displayed showing the required values typed-in and the OK button highlighted.

Click Close to save changes in Edit Bindings.

Step 8

Back in the IIS Manager, click on WSUS Administration and on centre pane right-click on SSL Settings, and select Open Feature.

Step 9

On the SSL Settings dialog box, select Require SSL check box.

Then on Actions pane, click Apply.

Figure 1.32 Screenshot of the PLABDM01 desktop
Figure 1.32 Screenshot of the PLABDM01 desktop: SSL Settings pane is displayed showing the required settings performed and the Apply link available on the Actions pane.

Step 10

In this step, you will export the self-signed certificate to a file.

Click on PLABDM01.PRACTICELABS.COM and on the centre pane, right-click on Server Certificates and choose Open Feature.

Figure 1.33 Screenshot of the PLABDM01 desktop
Figure 1.33 Screenshot of the PLABDM01 desktop: Server Certificates icon is highlighted on the required PLABDM01 Home pane.

Step 11

On the Server Certificates pane, right-click on PLABDM01-WSUS on the middle pane and choose View…

Figure 1.34 Screenshot of the PLABDM01 desktop
Figure 1.34 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking a listed certificate) > View menu-options are selected on the Server Certificates pane of the Internet Information Services (IIS) Manager console.

Step 12

From Certificate dialogue box, go to Details tab.

Click Copy to File…

On the Welcome to the Certificate Export Wizard page, click Next.

Figure 1.35 Screenshot of the PLABDM01 desktop
Figure 1.35 Screenshot of the PLABDM01 desktop: Details tab on the Certificate dialog box is displayed showing the Copy to File button highlighted.

Step 13

From the Export Private Key page, click Yes, export the private key option button. Click Next.

Keep the default Export File Format options and click Next.

Figure 1.36 Screenshot of the PLABDM01 desktop
Figure 1.36 Screenshot of the PLABDM01 desktop: Export Private Key page on the Certificate Export Wizard is displayed showing the required selection performed and the Next button highlighted.

Step 14

In the Security page, click Password check box and then type the following in each text box:

Passw0rd

Click Next.

Figure 1.37 Screenshot of the PLABDM01 desktop
Figure 1.37 Screenshot of the PLABDM01 desktop: Security page on the Certificate Export Wizard is displayed showing the required password typed-in and the Next button highlighted.

Step 15

From the File to Export page, type:

C:\plabdm01

Click Next.

Figure 1.38 Screenshot of the PLABDM01 desktop
Figure 1.38 Screenshot of the PLABDM01 desktop: File to Export page on the Certificate Export Wizard is displayed showing the required filename typed-in and the Next button highlighted.

Step 16

In the Completing the Certificate Export Wizard page, click Finish.

Figure 1.39 Screenshot of the PLABDM01 desktop
Figure 1.39 Screenshot of the PLABDM01 desktop: Completion page on the Certificate Export Wizard is displayed showing certificate export specifications and the Finish button highlighted.

Click OK when notified that the export was successful. Click OK to close Certificate dialogue box. Close the IIS Manager console.

Keep all devices powered on in their current state and proceed to the next task.

Task 4 - Configure domain to trust self-signed certificate

To setup the self-signed certificate to be trusted by the Windows domain, follow these steps:

Step 1

Connect to PLABDC01.

From Server Manager Dashboard, Click on Tools menu and select Group Policy Management.

Figure 1.40 Screenshot of the PLABDC01 desktop
Figure 1.40 Screenshot of the PLABDC01 desktop: Tools > Group Policy Management menu-options are highlighted on the Server Manager console.

Step 2

Expand Forest: PRACTICELABS.COM, then expand Domains and finally expand PRACTICELABS.COM.

Note: Ignore the screen prompt about GPO links by choosing OK.

Right-click on Default Domain Policy, then select Edit…

Figure 1.41 Screenshot of the PLABDC01 desktop
Figure 1.41 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking policy domain node) > Edit menu-options are selected on the Group Policy Management console.

Step 3

In Group Policy Management Editor window, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities.

Right-click on details pane and then select Import…

Click Next in the Welcome to the Certificate Import Wizard page.

Figure 1.42 Screenshot of the PLABDC01 desktop
Figure 1.42 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking the details pane) > Import menu-options are displayed on the Group Policy Management Editor console with the required node-path selected on the navigation pane at the left.

Step 4

From the File to Import page, click in File name box and type:

\\plabdm01\c$\plabdm01.pfx

Click Next.

Figure 1.43 Screenshot of the PLABDC01 desktop
Figure 1.43 Screenshot of the PLABDC01 desktop: File to Import page on the Certificate Import Wizard is displayed showing the required file name typed-in and the Next button highlighted.

Step 5

From the Private key protection page, type:

Passw0rd

Keep the other default settings. Click Next.

In Certificate Store page, click Next.

Figure 1.44 Screenshot of the PLABDC01 desktop
Figure 1.44 Screenshot of the PLABDC01 desktop: Private key protection page on the Certificate Import Wizard is displayed showing the required password typed-in and the Next button highlighted.

Step 6

Click Finish to close Completing the Certification Import Wizard page.

Click OK when prompted that the import was successful.

Figure 1.45 Screenshot of the PLABDC01 desktop
Figure 1.45 Screenshot of the PLABDC01 desktop: Completion page on the Certificate Import Wizard is displayed showing import specifications and the Finish button available.

Step 7

The self-signed certificate is now added.

Close Group Policy Management Editor and Group Policy Management Console windows.

Figure 1.46 Screenshot of the PLABDC01 desktop
Figure 1.46 Screenshot of the PLABDC01 desktop: Required node path is selected on the navigation pane at the left and the relevant certificate listed on the details pane at the right on the Group Policy Management Editor console.

Create Computer Groups for WSUS

Computer groups enable you to target updates to specific computers. In this exercise you will go through the steps of creating and assigning these groups.

Please refer to your course material or use your preferred search engine to research this topic in more detail.

Task 1 - Create Computer Groups

To create the computer groups, follow these steps:

Step 1

On PLABDM01, go back to Windows Server Update Services.

Press F5 to refresh the screen.

Alert: If a Connection Error is presented, go to Actions pane and click on Remove from Console. This error is caused by binding the self-signed certificate to PLADM01 - the Windows Server Update Services server.

Figure 2.1 Screenshot of the PLABDM01 desktop
Figure 2.1 Screenshot of the PLABDM01 desktop: Update Services console is displayed.

Step 2

On the Actions pane, click Connect to Server.

On Connect to server dialogue box, in the Server name box, type PLABDM01.PRACTICELABS.COM.

Select Use Secure Sockets Layer (SSL) to connect to this server check box.

Choose Connect.

Figure 2.2 Screenshot of the PLABDM01 desktop
Figure 2.2 Screenshot of the PLABDM01 desktop: Connect to Server dialog box is displayed showing the required settings performed and the Connect button highlighted.

Step 3

Expand the PLABDM01.PRACTICELABS.COM node.

The expand Computers and right-click on All Computers, and then select Add Computer Group...

Figure 2.3 Screenshot of the PLABDM01 desktop
Figure 2.3 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking the All Computers node) > Add Computer Group menu-options are selected on the Update Services console.

Step 4

On the Add Computer Group dialogue box, type Marketing and then choose Add.

Figure 2.4 Screenshot of the PLABDM01 desktop
Figure 2.4 Screenshot of the PLABDM01 desktop: Add Computer Group dialog box is displayed showing the required value typed-in and the Add button highlighted.

Step 5

You will be redirected back to Update Services window.

Click on Options node and then on centre pane select Computers.

Figure 2.5 Screenshot of the PLABDM01 desktop
Figure 2.5 Screenshot of the PLABDM01 desktop: Update Services console is displayed showing the required node-path selected on the navigation pane at the left and the Computers link available on the Options pane in the middle.

Step 6

On the Computers dialogue box, select Use Group Policy or registry settings on computers option button.

Click OK.

Figure 2.6 Screenshot of the PLABDM01 desktop
Figure 2.6 Screenshot of the PLABDM01 desktop: Computers dialog box is displayed showing the required selection performed and the OK button highlighted.

Keep all devices powered on in their current state and proceed to the next task.

Task 2 - Approve Downloaded Updates

To approve the downloaded updates, follow these steps:

Step 1

On PLABDM01, with the Update Services window open click on PLABDM01.PRACTICELABS.COM.

On the centre pane, under To Do section, click on X critical updates are waiting to be approved section,

Figure 2.7 Screenshot of the PLABDM01 desktop
Figure 2.7 Screenshot of the PLABDM01 desktop: Update Services console is displayed showing the required node selected on the navigation pane at the left and the x critical updates are waiting listed on the To Do pane in the middle.

Step 2

On the list of Critical Updates, choose any update and right-click on it and choose Approve.

Important: Select any Windows 10 critical update that has NOT been superseded by another update.

Figure 2.8 Screenshot of the PLABDM01 desktop
Figure 2.8 Screenshot of the PLABDM01 desktop: Context menu (that appears on right-clicking a listed unapproved critical update) > Approve menu-options are selected on the Critical Updates pane of the Update Services console.

Step 3

On Approve Updates dialogue box, click Marketing and select Approved for Install.

On the Approve Updates dialogue box, click OK.

Figure 2.9 Screenshot of the PLABDM01 desktop
Figure 2.9 Screenshot of the PLABDM01 desktop: Approve Updates dialog box is displayed listing status of the available updates.

Step 4

On the Approval Progress dialogue box, WSUS will approve the update.

Click Close when the result Success is displayed.

Figure 2.10 Screenshot of the PLABDM01 desktop
Figure 2.10 Screenshot of the PLABDM01 desktop: Approval Progress dialog box is displayed showing status of approval and the Close button highlighted.

Step 5

Look for a Windows 8.1 critical update.

Note: Choose a Windows 8.1 critical update that has NOT been superseded by another update.

In this step, right-click on any update and choose Approve.

Click OK to save changes in Approve Updates screen.

Figure 2.11 Screenshot of the PLABDM01 desktop
Figure 2.11 Screenshot of the PLABDM01 desktop: Approval Progress dialog box is displayed showing status of approval and the Close button highlighted.

Minimize Update Services console.

Configure GPO Policy for WSUS

In the following exercise you will implement the tasks to deploy WSUS updates via group policy.

To get a better understanding of this technology, please refer to your course material or use your preferred search engine to research this topic in more detail.

Task 1 - Create a GPO for Update Services Client

To configure a GPO for WSUS client, follow these steps:

Step 1

Connect to PLABDC01 device.

Open Server Manager Dashboard, click Tools menu and select Active Directory Users and Computers.

Figure 3.1 Screenshot of the PLABDC01 desktop
Figure 3.1 Screenshot of the PLABDC01 desktop: Tools > Active Directory Users and Computers menu-options are highlighted on the Server Manager console.

Step 2

Right-click on PRACTICELABS.COM and choose New > Organizational Unit.

Figure 3.2 Screenshot of the PLABDC01 desktop
Figure 3.2 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a listed domain) > New > Organizational Unit menu-options are selected on the Active Directory Users and Computers console.

Step 3

On the New Object-Organizational Unit dialog box, type WSUS Clients and click OK.

Figure 3.3 Screenshot of the PLABDC01 desktop
Figure 3.3 Screenshot of the PLABDC01 desktop: New Object - Organizational Unit dialog box is displayed showing the required value typed-in and the OK button highlighted.

Step 4

Go to Computers container, select PLABWIN10 and PLABWIN810 and then right-click on the selection and click Move.

Figure 3.4 Screenshot of the PLABDC01 desktop
Figure 3.4 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking multiple listed computers) > Move menu-options are selected on the Active Directory Users and Computers console.

Step 5

On Move dialogue box, select WSUS Clients and click OK.

Note: PLABWIN10 and PLABWIN810 will be used as test computers for distribution of updates via WSUS.

Figure 3.5 Screenshot of the PLABDC01 desktop
Figure 3.5 Screenshot of the PLABDC01 desktop: Move dialog box is displayed showing the required selection performed and the OK button highlighted.

Step 6

Click on WSUS Clients OU.

Verify that the two computers are present.

Close Active Directory Users and Computers.

Figure 3.6 Screenshot of the PLABDC01 desktop
Figure 3.6 Screenshot of the PLABDC01 desktop: Active Directory Users and Computers console is displayed listing the newly created organizational unit and its contents.

Step 7

From Server Manager, go to Tools and click Group Policy Management.

Figure 3.7 Screenshot of the PLABDC01 desktop
Figure 3.7 Screenshot of the PLABDC01 desktop: Tools > Group Policy Management menu-options are highlighted on the Server Manager console.

Step 8

Expand Forest: PRACTICELABS.COM > Domains > PRACTICELABS.COM.

Right-click on WSUS Clients then choose Create a GPO in this domain and link it here…

Figure 3.8 Screenshot of the PLABDC01 desktop
Figure 3.8 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a listed OU) > Create a GPO in this domain, and Link it here menu-options are selected on the Group Policy Management console.

Step 9

On the New GPO dialog box, type WSUS Updates and click OK.

Figure 3.9 Screenshot of the PLABDC01 desktop
Figure 3.9 Screenshot of the PLABDC01 desktop: New GPO dialog box is displayed showing the required value typed-in and the OK button highlighted.

Step 10

Right-click on WSUS Updates GPO link and select Edit.

Figure 3.10 Screenshot of the PLABDC01 desktop
Figure 3.10 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a GPO link) > Edit menu-options are selected on the Group Policy Management console.

Step 11

On the Group Policy Management Editor window, navigate to Computer Configuration > Policies > Administrative Templates > Windows Components and click on Windows Update.

On the details pane, right-click on Configure Automatic Updates and choose Edit.

Figure 3.11 Screenshot of the PLABDC01 desktop
Figure 3.11 Screenshot of the PLABDC01 desktop: Group Policy Management Editor console is displayed showing the required node-path selected on the navigation pane at the left and the relevant setting selected on the details pane at the right.

Step 12

On Configure Automatic Updates, use the following settings:

Click Enabled option button.

Configure automatic updating: 4-Auto download and schedule the install

Scheduled install day: 0 - Every day

Scheduled install time: 03:00

Click OK.

Figure 3.12 Screenshot of the PLABDC01 desktop
Figure 3.12 Screenshot of the PLABDC01 desktop: Configure Automatic Updates dialog box is displayed showing the required settings performed and the OK button highlighted.

Step 13

Back on the Group Policy Management Editor window, right-click on Specify intranet Microsoft update service location and choose Edit.

Figure 3.13 Screenshot of the PLABDC01 desktop
Figure 3.13 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a setting) > Edit menu-options are selected on the Group Policy Management Editor console.

Step 14

On Specify intranet Microsoft update service location, use the following settings:

Click on Enabled radio button.

Set the intranet update service for detecting updates:

https://plabdm01.practicelabs.com:8531

Set the intranet statistics server:

https://plabdm01.practicelabs.com:8531

Click OK.

Figure 3.14 Screenshot of the PLABDC01 desktop
Figure 3.14 Screenshot of the PLABDC01 desktop: Specify intranet Microsoft update service location dialog box is displayed showing the required settings performed and the OK button highlighted.

Step 15

Back on the Group Policy Management Editor window, right-click on Automatic Updates detection frequency, choose Edit.

Figure 3.15 Screenshot of the PLABDC01 desktop
Figure 3.15 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a setting) > Edit menu-options are selected on the Group Policy Management Editor console.

Step 16

On Automatic Updates detection frequency, use the following values:

Click Enabled option button.

Check for updates at the following interval (hours): 12

Click OK.

Figure 3.16 Screenshot of the PLABDC01 desktop
Figure 3.16 Screenshot of the PLABDC01 desktop: Automatic Updates detection frequency dialog box is displayed showing the required settings performed and the OK button highlighted.

Step 17

Again on the Group Policy Management Editor window, right-click on Enable client-side targeting and choose Edit.

Figure 3.17 Screenshot of the PLABDC01 desktop
Figure 3.17 Screenshot of the PLABDC01 desktop: Context menu (that appears on right-clicking a setting) > Edit menu-options are selected on the Group Policy Management Editor console.

Step 18

On Enable client-side targeting, click Enabled.

In Target group name for this computer, type:

Marketing

Click OK.

Figure 3.18 Screenshot of the PLABDC01 desktop
Figure 3.18 Screenshot of the PLABDC01 desktop: Enable client-side targeting dialog box is displayed showing the required settings performed and the OK button highlighted.

After defining the WSUS settings in GPO, close Group Policy Management Editor and Group Policy Management Console.

Keep all devices powered on in their current state and proceed to the next task.

Task 2 - Verify WSUS Client Functionality

To verify if the WSUS GPO policies apply to the client, follow these steps:

Step 1

Ensure you have powered on the required devices and connect to PLABWIN10 device.

Click on the Start button and type cmd to launch the command prompt.

Figure 3.19 Screenshot of the PLABWIN10 desktop
Figure 3.19 Screenshot of the PLABWIN10 desktop: Name of the program to run is typed in the search box on the Start menu.

Step 2

The following commands will force an update of the group policy, then initiate a registration and detection of WSUS server, then finally restart PLABWIN10 computer.

Type the following commands, press Enter after each line.

Gpupdate /force
Wuauclt /registernow /detectnow
Shutdown /r /t 0

Figure 3.20 Screenshot of the PLABWIN810 desktop
Figure 3.20 Screenshot of the PLABWIN810 desktop: Command Prompt window is displayed showing the commands to force an update of the group policy, then initiate a registration and detection of WSUS server, and then restart the PLABWIN10 computer typed-in.

PLABWIN10 will reboot.

Step 3

Connect to PLABWIN810 device.

Click on the Start button and type cmd to launch the command prompt.

Figure 3.21 Screenshot of the PLABWIN810 desktop
Figure 3.21 Screenshot of the PLABWIN810 desktop: Name of the program to run is typed in the search box on the Start menu.

Step 4

Like in PLABWIN10 device, you will type the following commands here on PLABWIN810.

Gpupdate /force
Wuauclt /registernow /detectnow
Shutdown /r /t 0

Figure 3.22 Screenshot of the PLABWIN810 desktop
Figure 3.22 Screenshot of the PLABWIN810 desktop: Command Prompt window is displayed showing the commands to force an update of the group policy, then initiate a registration and detection of WSUS server, and then restart the PLABWIN810 computer typed-in.

PLABWIN810 will now reboot.

Step 5

A 1 minute after the restart, reconnect to PLABWIN10 device.

Click Start and in Search programs and files box, type:

Updates

Press Enter.

Figure 3.23 Screenshot of the PLABWIN10 desktop
Figure 3.23 Screenshot of the PLABWIN10 desktop: Name of the program to run is typed in the search box on the Start menu.

Step 6

Depending on the critical update you had chosen earlier for PLABWIN10 and its availability on the PLABDM01 server, the update may have been detected or otherwise.

In the below screenshot, PLABWIN10 has detected 1 important update.

Important: Please note that although the update has been detected on the Windows client, the Update Server (PLABDM01) will have to successfully download the update first, from the Microsoft Update site.

Figure 3.24 Screenshot of the PLABWIN10 desktop
Figure 3.24 Screenshot of the PLABWIN10 desktop: Settings window is displayed listing the status of updates detected.

Step 7

Now connect to PLABWIN810 device.

Click on the Start button and type the following:

control panel

Press Enter.

Figure 3.25 Screenshot of the PLABWIN810 desktop
Figure 3.25 Screenshot of the PLABWIN810 desktop: Name of the program to run is typed in the search box on the Start menu.

Step 8

On the Control Panel window, click on System and Security link.

Note: Since Windows Update has been configured on PLABWIN810 device, ignore any prompt for a Windows Update, which may appear any time on screen.

Figure 3.26 Screenshot of the PLABWIN810 desktop
Figure 3.26 Screenshot of the PLABWIN810 desktop: Control Panel window is displayed showing the System and Security link highlighted.

Step 9

On System and Security window, click Windows Update link.

Figure 3.31 Screenshot of the PLABWIN810 desktop
Figure 3.31 Screenshot of the PLABWIN810 desktop: System and Security window is displayed showing the Windows Update link highlighted.

Step 10

On Windows Update screen, click on Change settings link.

Figure 3.32 Screenshot of the PLABWIN810 desktop
Figure 3.32 Screenshot of the PLABWIN810 desktop: System and Security window is displayed showing the Windows Update page.

Step 11

You can see here that this PLABWIN810 workstation is configured to receive updates.

It may take a few hours before updates are downloaded to this computer.

Click OK.

Note: Updates may not download immediately after the initial install of WSUS on the server. You may need to manually run WSUS synchronization again to force the WSUS server to download the updates available from Microsoft. The important thing here is that Windows Update Services server on PLABDM01 was able to synchronize with the Microsoft update site and build a list of updates that can be downloaded at the next synchronization.

Figure 3.33 Screenshot of the PLABWIN810 desktop
Figure 3.33 Screenshot of the PLABWIN810 desktop: System and Security window is displayed showing the Windows Update page.

Shutdown all virtual machines used in this lab, by using the power functions located in the Tools bar before proceeding to the next module. Alternatively you can log out of the lab platform.


 the devices you have  on in their current state and proceed to the next exercise.

Leave the devices you have powered on in their curren

Comments

Post a Comment

Popular Posts