Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Windows Update Group Policy - What changes did you make?

I'm new to Patch Manager and the one area I am still trying to decide what I should change is my group policy. I understand or believe that most of this needs to remain, but what about settings like 'Configure Automatic Updates'. Can I remove that and just have the clients download the updates when I schedule using the Update Management Wizard? What changes have you folks made that seems to work best for you?

Thanks in advance for any thoughts, advice, etc!

Find more posts tagged with

Accepted answers

jrouviere

At a minimum, it's a best practice to set three things via Group Policy:

1) Provide the WSUS publishing certificate.

2) "Specify intranet Microsoft update service location" to tell the client where the WSUS server lives.

3) "Allow signed updates from an intranet Microsoft update service location" to trust 3rd party signed certificates with the cert from #1.

If you're only doing Microsoft Updates instead of Third Party Updates you really only need #2.

The rest is your preference. So in your case it looks like you want Patch Manager to manage the updates with the Update Management Wizard and the Management Tasks, if that's the case, make sure you have the above three policies set (if you're doing Third Party Updates) and you can leave the rest alone unless you know something you need to adjust for your environment.

All comments

jrouviere

At a minimum, it's a best practice to set three things via Group Policy:

1) Provide the WSUS publishing certificate.

2) "Specify intranet Microsoft update service location" to tell the client where the WSUS server lives.

3) "Allow signed updates from an intranet Microsoft update service location" to trust 3rd party signed certificates with the cert from #1.

If you're only doing Microsoft Updates instead of Third Party Updates you really only need #2.

kapplah

As i've got the same question and to clarify your answer:

It is not neccessary (or even wanted) if I specify the schedule in the GPO/registry? The one and only really needed setting is the location of the WSUS server? Scheduling and Installation Option (download, download & install, install, ...) is fully configured via SPM and the respective Tasks?

Thank's a lot,

Alex

jrouviere

Hello Alex,

In short "Yes".

If you would like to use Patch Manager to schedule everything with Update Management and you are only working with Microsoft Updates then all you would need to configure from the client side (or via Group Policy) is the location of the WSUS server.

Typically Patch Manager is being used with Third Party Updates at which point you would also need the certificate and the Allow signed updates policy I outlined.

My normal suggestion would be to also configure the schedule with group policy, but if you want Patch Manager to manage updates directly instead, it's not necessary.

jheric

What if you don't use a WSUS server? All our clients are in the field and don't talk back to WSUS, hence the need for a web based third party patch manager.

jrouviere

All of the Third Party content for Patch Manager is published and stored in WSUS.

Patch Manager can still help with the management on the client side, but the clients would need to be reaching out to Microsoft Update directly or you would need to expose the WSUS server so that those clients can connect.

Additionally Patch Manager can only communicate with your nodes via WMI or the Patch Manager agent.

There are some technical hurdles you'll need to address to be able to help patch external machines, especially for Third Party updates. There are three main components:

Patch Manager - Patch Manager has to publish to WSUS for the Third Party content.
WSUS - The client machines have to be able to get the content from WSUS.
Clients - If you're using Patch Manager to manage the machines then Patch Manager would need a way to communicate with those machines, let's just assume using the agent at this point and port 4092.

If you're able to connect to the clients if they reach out via VPN then I think it would be easy enough, but the requirements are ultimately the same.

jheric

Hmm, WSUS is turned off in our environment.

I have been able to push patches (and third party patches) to people in the field just fine. They all have the Advanced Monitoring Agent installed.

These field users do not have VPN and do not communicate with our network very often if at all.

This scenario is the exact reason why I chose Solarwinds Patch Manager. I needed a web based patch manager to push patches to computers that don't talk back to our network.

The goal is to have one centralized patch management solution that I can coordinate the delivery of patches on a specified date. Basically I want to eliminate the random windows update patching and rebooting of computers. I want to control when and what patches each computer gets.

The next hurdle is controlling Windows 10 Feature Updates. We are all on 1709 16299. I manually changed the settings of these computers to defer Feature Updates for 365 days. How can I control that through other means? GP? How can Solarwinds detect feature updates and push those out.

I know for a fact that 1803 breaks our construction software. But once that is tested and fixed, I would like to push 1803 out to all users and freeze 1809 until that is properly tested.

jrouviere

Hello Jheric,

There are definitely some things that I'm not understanding here. If I were in Support I would want to take a look at your setup so that I could better understand it.

Are you perhaps using the MSP tools? N-Central Patch Management?

https://www.solarwindsmsp.com/products/n-central

That would be very different with regards to what I was discussing.

https://www.solarwindsmsp.com/products/n-central/patch-management

jheric

This is the product we are using:

Solarwinds Remote Monitoring and Management RMM (it used to be Logic Now/Control Now/Max Remote Management)

https://www.solarwindsmsp.com/products/rmm