I mean why not? It makes the load lighter on your WSUS Server if you have a large number of clients and it makes downloading the updates from each other faster than all downloading at once from the WSUS Server. Set WSUS to only download from peer to peer connections on the same LAN. If you are using Windows Defender or any other definition based product from Microsoft, you will want to enable “Automatic Updates detection frequency” and set the detection frequency to something fairly short like 1 or 2 hours so that the systems can find the latest definition files faster from WSUS (you must also set the auto-approval rule in WSUS for definition files or this won’t do anything). You may have to add more policies in if you have other OSes. I’ve only written this guide for Windows 10 options.
Take note of the words ‘through’ – meaning after the last mentioned OS, it no longer applies. Read the description and especially the requirements CRITICALLY as Microsoft has clarified which policies apply to which OS. Think about your Workstations, get out your notes of what workstations you have in your network and go through each of the policies in Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update. Set the alternate download server: (or )ĭownload files with no Url in the metadata if alternate download server is set: NOT CHECKEDįQDN should be used for proper DNS resolution in any circumstance and also is best practice and required for any public SSL Certificates. Set the intranet statistics server: (or ) Set the intranet update service for detecting updates: (or )
Specify intranet Microsoft update service location: Enabled Under: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update Create a GPO named “WSUS – Location” to JUST point to the FQDN of the WSUS Server on port 8530/8531 (or 80/443 for Server 2008) for all 3 locations (intranet update service, intranet statistics server, and the alternate download server).
0 kommentar(er)
