Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Using Group Policy to Install the WSUS Signing Certificate for 3rd Party Updates

Most of the time, folks opt to use the Client Certificate Management task or Client Provisioning Wizard in the EminentWare product to deploy the WSUS signing certificate on all of the client machine. This of course requires that the EminentWare WMI provider is already installed.

As an alternate, you can also use Group Policy to install those certificates. Here are some helpful links from Microsoft:

http://technet.microsoft.com/en-us/library/cc770315(WS.10).aspx

http://msdn.microsoft.com/en-us/library/bb902479(VS.85).aspx

We have a number of customers that have successfully deployed the certificates this way.

John

Find more posts tagged with

Accepted answers

LGarvin

Just to clarify, the certificate must be installed in both the Trusted Root Certificate Authorities store and the Trusted Publishers store.

In addition, we have a step-by-step guide that will guide you through the entire process of configuring the GPO to distribute the certificate.

http://www.solarwinds.com/documentation/patchman/docs/Distributing%20the%20WSUS%20Publishers%20Self-Signed%20Certificate%20using%20Group%20Policy.pdf

All comments

solarwinds-admin

For Windows Server 2003 environments, this link may also be helpful:

http://www.bibble-it.com/2008/09/03/adding-trusted-publishers-certificate-with-group-policy

solarwinds-admin

Be careful in what order you do this. I modified my GPO after using the client certificate management tool and ended up with duplicate certificate errors when going into the certificates tab. It doesn't seem to cause issues but who knows what unexpected behavior may crop up down the road. Even though it says it failed to delete the cert (when I tell it to from the console) the error goes away.

You may also want to add the certificate to both the trusted publishers and trusted root certificate authorities. I had downloaded packages fail because the certificate wasn't from a trusted certificate authority even though it was a trusted publisher. (I'm also pretty sure the client certificate management tool puts it in both)

LGarvin

Just to clarify, the certificate must be installed in both the Trusted Root Certificate Authorities store and the Trusted Publishers store.

In addition, we have a step-by-step guide that will guide you through the entire process of configuring the GPO to distribute the certificate.

http://www.solarwinds.com/documentation/patchman/docs/Distributing%20the%20WSUS%20Publishers%20Self-Signed%20Certificate%20using%20Group%20Policy.pdf