Targeting "skip" <shofmann[ at ]kbb.com> 12/18/2008 7:48:41 PM Hello Running WSUS 3.0 sp1. I want to use GPO to target two different groups of servers. Group1 would contain all the DEV/QA servers and Group2 would contain all the production servers. My thoughts are to move all the DEV/QA servers to an designated OU (Dev/Qa) then move all the production boxes to a seperate OU (Prod) then create two different gpo's one for dev/qa and one for prod, then link the GPO's to the repsective OU. My goal is to approve critical updates to the DEV/QA group first, then wait a week for testing if all looks good in dev then approve the same critical update to the Prod group. Does this sound like a resonable solution? i am assuming that if i approve an update for one group that same update will not automatically be approved for another group? Many thanks for any recomendations

Re: Targeting "Danny Sanders" <DSanders[ at ]NOSPAMciber.com> 12/18/2008 8:45:18 PM That's what we do here. hth DDS "skip" <shofmann[ at ]kbb.com> wrote in message news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... [Quoted Text] > Hello > > Running WSUS 3.0 sp1. I want to use GPO to target two different groups of > servers. Group1 would contain all the DEV/QA servers and Group2 would > contain all the production servers. My thoughts are to move all the DEV/QA > servers to an designated OU (Dev/Qa) then move all the production boxes to > a seperate OU (Prod) then create two different gpo's one for dev/qa and > one for prod, then link the GPO's to the repsective OU. > > My goal is to approve critical updates to the DEV/QA group first, then > wait a week for testing if all looks good in dev then approve the same > critical update to the Prod group. > > Does this sound like a resonable solution? i am assuming that if i approve > an update for one group that same update will not automatically be > approved for another group? > > Many thanks for any recomendations > >

Re: Targeting "Lawrence Garvin \(MVP\)" <lawrence[ at ]news.postalias> 12/18/2008 9:25:34 PM "skip" <shofmann[ at ]kbb.com> wrote in message news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... [Quoted Text] > Hello > > Running WSUS 3.0 sp1. I want to use GPO to target two different groups of > servers. Group1 would contain all the DEV/QA servers and Group2 would > contain all the production servers. My thoughts are to move all the DEV/QA > servers to an designated OU (Dev/Qa) then move all the production boxes to > a seperate OU (Prod) then create two different gpo's one for dev/qa and > one for prod, then link the GPO's to the repsective OU. That's one possible solution. (Frankly, I'm surprised they're not already in such an organization! <g>) > Does this sound like a resonable solution? i am assuming that if i approve > an update for one group that same update will not automatically be > approved for another group? This is correct. One note concerning pushing updates to =DEV= servers. Make sure your developers are aware of such intent, as it's conceivable that an update applied to a DEV server may impact how code is developed/tested, which could result in different behavior on the production servers. Also, if the DEV server encounters "issues" as a result of an update, you could potentially impact development schedules. However the "best practice" would be that you have a pure *testing* environment set up that imitates your production servers, such that a catastrophic failure in the testing environment does not impact the day to day operations of the organization. Part of the key wrt to "Dev" servers is to answer the question as to whether "development" servers are part of a production environment. In some organizations, where development is a high productivity, or a time-constrained operations, the development servers may be viewed as every bit a "production" server, because of their need for continued access and availability. -- Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP Principal/CTO, Onsite Technology Solutions, Houston, Texas Microsoft MVP - Software Distribution (2005-2009) MS WSUS Website: http://www.microsoft.com/wsus My Websites: http://www.onsitechsolutions.com; http://wsusinfo.onsitechsolutions.com My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

Re: Targeting "skip" <shofmann[ at ]kbb.com> 12/18/2008 9:34:35 PM cool how big is your environment? "Danny Sanders" <DSanders[ at ]NOSPAMciber.com> wrote in message news:%23z%23xzFVYJHA.1272[ at ]TK2MSFTNGP04.phx.gbl... [Quoted Text] > That's what we do here. > > > hth > DDS > > "skip" <shofmann[ at ]kbb.com> wrote in message > news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... >> Hello >> >> Running WSUS 3.0 sp1. I want to use GPO to target two different groups of >> servers. Group1 would contain all the DEV/QA servers and Group2 would >> contain all the production servers. My thoughts are to move all the >> DEV/QA servers to an designated OU (Dev/Qa) then move all the production >> boxes to a seperate OU (Prod) then create two different gpo's one for >> dev/qa and one for prod, then link the GPO's to the repsective OU. >> >> My goal is to approve critical updates to the DEV/QA group first, then >> wait a week for testing if all looks good in dev then approve the same >> critical update to the Prod group. >> >> Does this sound like a resonable solution? i am assuming that if i >> approve an update for one group that same update will not automatically >> be approved for another group? >> >> Many thanks for any recomendations >> >> > >

Re: Targeting "Family" <shofmann[ at ]kbb.com> 12/19/2008 3:41:37 AM You nailed it! you described our organization to a tee, the line distinguishing dev from prod is blurry at best "Lawrence Garvin (MVP)" <lawrence[ at ]news.postalias> wrote in message news:%239yyZdYYJHA.4596[ at ]TK2MSFTNGP06.phx.gbl... [Quoted Text] > "skip" <shofmann[ at ]kbb.com> wrote in message > news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... >> Hello >> >> Running WSUS 3.0 sp1. I want to use GPO to target two different groups of >> servers. Group1 would contain all the DEV/QA servers and Group2 would >> contain all the production servers. My thoughts are to move all the >> DEV/QA servers to an designated OU (Dev/Qa) then move all the production >> boxes to a seperate OU (Prod) then create two different gpo's one for >> dev/qa and one for prod, then link the GPO's to the repsective OU. > > That's one possible solution. > (Frankly, I'm surprised they're not already in such an organization! <g>) > >> Does this sound like a resonable solution? i am assuming that if i >> approve an update for one group that same update will not automatically >> be approved for another group? > > This is correct. > > One note concerning pushing updates to =DEV= servers. Make sure your > developers are aware of such intent, as it's conceivable that an update > applied to a DEV server may impact how code is developed/tested, which > could result in different behavior on the production servers. > > Also, if the DEV server encounters "issues" as a result of an update, you > could potentially impact development schedules. > > However the "best practice" would be that you have a pure *testing* > environment set up that imitates your production servers, such that a > catastrophic failure in the testing environment does not impact the day to > day operations of the organization. > > Part of the key wrt to "Dev" servers is to answer the question as to > whether "development" servers are part of a production environment. In > some organizations, where development is a high productivity, or a > time-constrained operations, the development servers may be viewed as > every bit a "production" server, because of their need for continued > access and availability. > > > -- > Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP > Principal/CTO, Onsite Technology Solutions, Houston, Texas > Microsoft MVP - Software Distribution (2005-2009) > > MS WSUS Website: http://www.microsoft.com/wsus > My Websites: http://www.onsitechsolutions.com; > http://wsusinfo.onsitechsolutions.com > My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin >

Re: Targeting "Danny Sanders" <DSanders[ at ]NOSPAMciber.com> 12/19/2008 3:11:03 PM We have about 120 servers in VM ware and about 70 physical, this includes dev, test and production. We have our IT team in "guinea pigs" group (systems, network, help desk and Apps) and we test desktop patches out on us before releasing them to the rest of the 6000 users. hth DDS "skip" <shofmann[ at ]kbb.com> wrote in message news:0813C924-0DCB-4C71-B674-4F30561C6F74[ at ]microsoft.com... [Quoted Text] > cool how big is your environment? > "Danny Sanders" <DSanders[ at ]NOSPAMciber.com> wrote in message > news:%23z%23xzFVYJHA.1272[ at ]TK2MSFTNGP04.phx.gbl... >> That's what we do here. >> >> >> hth >> DDS >> >> "skip" <shofmann[ at ]kbb.com> wrote in message >> news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... >>> Hello >>> >>> Running WSUS 3.0 sp1. I want to use GPO to target two different groups >>> of servers. Group1 would contain all the DEV/QA servers and Group2 would >>> contain all the production servers. My thoughts are to move all the >>> DEV/QA servers to an designated OU (Dev/Qa) then move all the production >>> boxes to a seperate OU (Prod) then create two different gpo's one for >>> dev/qa and one for prod, then link the GPO's to the repsective OU. >>> >>> My goal is to approve critical updates to the DEV/QA group first, then >>> wait a week for testing if all looks good in dev then approve the same >>> critical update to the Prod group. >>> >>> Does this sound like a resonable solution? i am assuming that if i >>> approve an update for one group that same update will not automatically >>> be approved for another group? >>> >>> Many thanks for any recomendations >>> >>> >> >> >

Re: Targeting "Tom Steger" <me[ at ]work.com> 12/23/2008 7:42:10 AM We call it "Pre-Production" here... ;-) "Family" <shofmann[ at ]kbb.com> wrote in message news:DDBC35F0-6019-4946-814F-19320A6C0BBE[ at ]microsoft.com... [Quoted Text] > You nailed it! you described our organization to a tee, the line > distinguishing dev from prod is blurry at best > "Lawrence Garvin (MVP)" <lawrence[ at ]news.postalias> wrote in message > news:%239yyZdYYJHA.4596[ at ]TK2MSFTNGP06.phx.gbl... >> "skip" <shofmann[ at ]kbb.com> wrote in message >> news:F9F0724B-F5E7-472D-ADFB-D0E38F0E5DBD[ at ]microsoft.com... >>> Hello >>> >>> Running WSUS 3.0 sp1. I want to use GPO to target two different groups >>> of servers. Group1 would contain all the DEV/QA servers and Group2 would >>> contain all the production servers. My thoughts are to move all the >>> DEV/QA servers to an designated OU (Dev/Qa) then move all the production >>> boxes to a seperate OU (Prod) then create two different gpo's one for >>> dev/qa and one for prod, then link the GPO's to the repsective OU. >> >> That's one possible solution. >> (Frankly, I'm surprised they're not already in such an organization! <g>) >> >>> Does this sound like a resonable solution? i am assuming that if i >>> approve an update for one group that same update will not automatically >>> be approved for another group? >> >> This is correct. >> >> One note concerning pushing updates to =DEV= servers. Make sure your >> developers are aware of such intent, as it's conceivable that an update >> applied to a DEV server may impact how code is developed/tested, which >> could result in different behavior on the production servers. >> >> Also, if the DEV server encounters "issues" as a result of an update, you >> could potentially impact development schedules. >> >> However the "best practice" would be that you have a pure *testing* >> environment set up that imitates your production servers, such that a >> catastrophic failure in the testing environment does not impact the day >> to day operations of the organization. >> >> Part of the key wrt to "Dev" servers is to answer the question as to >> whether "development" servers are part of a production environment. In >> some organizations, where development is a high productivity, or a >> time-constrained operations, the development servers may be viewed as >> every bit a "production" server, because of their need for continued >> access and availability. >> >> >> -- >> Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP >> Principal/CTO, Onsite Technology Solutions, Houston, Texas >> Microsoft MVP - Software Distribution (2005-2009) >> >> MS WSUS Website: http://www.microsoft.com/wsus >> My Websites: http://www.onsitechsolutions.com; >> http://wsusinfo.onsitechsolutions.com >> My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin >> >