WSUS in larger environment Brandon 7/9/2007 3:56:05 PM My company is considering deploying WSUS in a 800+ user environment. We plan to have a WSUS Master at our 1st location and 1 downstream server at each satellite site. Our intersite bandwidth should be fine, I am wondering what policies/testing procedures larger companies have put in place when approving updates? Also what structure of computer groups has worked best? I have been checking around for best practices but am coming up short on any GOOD docos.

Re: WSUS in larger environment "Lawrence Garvin \(MVP\)" <onsitech[ at ]community.nospam> 7/10/2007 3:41:26 AM "Brandon" <Brandon[ at ]discussions.microsoft.com> wrote in message news:5360EA63-A18A-4D97-A835-D56DAE5A14A2[ at ]microsoft.com... [Quoted Text] > My company is considering deploying WSUS in a 800+ user environment. > We plan to have a WSUS Master at our 1st location and 1 downstream server > at > each satellite site. For 800 users.... you should consider the feasible solution of a single WSUS server at the corporate office. The necessity of remote WSUS servers is a complexity that should only be deployed if: [a] The bandwidth limitations to the remote site are less than 5kb/sec per PC at the remote site, or [b] The server infrastructure already exists, and there are a significant number of systems on the remote site. Some examples: [a] A remote site with 20 PCs and a 256kb/sec VPN over ADSL. Have the remote systems work from the central office server. [b] A remote site with 100 PCs and a 10Mbit/sec link -- the 100 pc count probably warrants a remote server, even though there's sufficent bandwidth. [c] A remote site with 50 PCs and a 128kb ISDN link. Definitely needs a remote WSUS server. > Our intersite bandwidth should be fine, I am wondering > what policies/testing procedures larger companies have put in place when > approving updates? It's less a function of site considerations than it is the existence of non-standard Line Of Business applications that cannot be sufficiently tested by Microsoft prior to a patch's release. In general, I recommend [a] local testing workstations, followed by [b] local deployment, and deploymen to remote sites only after a reasonable indication of success from local deployments is established. > Also what structure of computer groups has worked best? Groupings of computers is a personal preference, and organizational need thing -- and quite often is dictated by the Active Directory heirarchy already in place, since your target groups will be determined by policy assignment, which is dependent on the OU heirarchy. -- Lawrence Garvin, M.S., MCTS, MCP Independent WSUS Evangelist MVP-Software Distribution (2005-2007) https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E Everything you need for WSUS is at http://www.microsoft.com/wsus And, almost everything else is at http://wsusinfo.onsitechsolutions.com .....

Re: WSUS in larger environment Brandon 7/10/2007 2:16:05 PM I really appreciate your help. Thanks, Brandon "Lawrence Garvin (MVP)" wrote: [Quoted Text] > "Brandon" <Brandon[ at ]discussions.microsoft.com> wrote in message > news:5360EA63-A18A-4D97-A835-D56DAE5A14A2[ at ]microsoft.com... > > My company is considering deploying WSUS in a 800+ user environment. > > We plan to have a WSUS Master at our 1st location and 1 downstream server > > at > > each satellite site. > > For 800 users.... you should consider the feasible solution of a single WSUS > server at the corporate office. The necessity of remote WSUS servers is a > complexity that should only be deployed if: > [a] The bandwidth limitations to the remote site are less than 5kb/sec > per PC at the remote site, or > [b] The server infrastructure already exists, and there are a > significant number of systems on the remote site. > > Some examples: > [a] A remote site with 20 PCs and a 256kb/sec VPN over ADSL. Have the > remote systems work from the central office server. > [b] A remote site with 100 PCs and a 10Mbit/sec link -- the 100 pc count > probably warrants a remote server, even though there's sufficent bandwidth. > [c] A remote site with 50 PCs and a 128kb ISDN link. Definitely needs a > remote WSUS server. > > > > Our intersite bandwidth should be fine, I am wondering > > what policies/testing procedures larger companies have put in place when > > approving updates? > > It's less a function of site considerations than it is the existence of > non-standard Line Of Business applications that cannot be sufficiently > tested by Microsoft prior to a patch's release. In general, I recommend [a] > local testing workstations, followed by [b] local deployment, and deploymen > to remote sites only after a reasonable indication of success from local > deployments is established. > > > Also what structure of computer groups has worked best? > > Groupings of computers is a personal preference, and organizational need > thing -- and quite often is dictated by the Active Directory heirarchy > already in place, since your target groups will be determined by policy > assignment, which is dependent on the OU heirarchy. > > > -- > Lawrence Garvin, M.S., MCTS, MCP > Independent WSUS Evangelist > MVP-Software Distribution (2005-2007) > https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E > > Everything you need for WSUS is at > http://www.microsoft.com/wsus > > And, almost everything else is at > http://wsusinfo.onsitechsolutions.com > ..... > > > >