Chapter 3. Managing Windows Updates

 In this chapter, we will cover the following recipes:

• Installing Windows Server Update Services
• Configuring WSUS update synchronization
• Configuring the Windows Update client
• Creating computer target groups
• Configuring WSUS auto-approvals
• Managing updates

Introduction

Windows administrators must manage Windows updates to ensure that the operating systems and software running on their computers are patched to resolve known bugs and are protected from known security vulnerabilities. Windows Server Update Services (WSUS) was a feature that was added in 2016 that enables the system administrators to manage the download and distribution of updates to the organization's computers.

Windows Software Update Services could be better named as Microsoft Software Update Services. WSUS manages not only Windows operating system updates but also updates for most Microsoft software products. Updates may apply to the Windows OS or any Microsoft software.

This chapter covers the installation and configuration of the WSUS server, the configuration of WSUS client computers, the management, approval, and installation of updates, and how to report on the status of the update installation.

Installing Windows Server Update Services

To use WSUS, you first install the Windows feature for update services, then perform the initial configuration. WSUS has dependencies that include the IIS web server and ASP.NET 4.6, so these dependencies are installed automatically if they are not present.

Getting ready

To follow this recipe, open a PowerShell session on server WSUS1. WSUS1 is a domain-joined server with internet access.

How to do it...

The steps for the recipe are as follows:

1. Install the Windows Update feature and tools, with -Verbose for additional feedback:

Install-WindowsFeature -Name 'UpdateServices' `
      -IncludeManagementTools -Verbose

2. Review the features that are installed on your server, noting that not only has Windows Software Update Services been installed, but Web Server (IIS), ASP.Net 4.6, and Windows Internal Database have as well:

      Get-WindowsFeature |
      Where-Object -FilterScript {($psitem.Installed)}

3. Create a folder for WSUS update content:

      $WSUSContentDir...

Configuring WSUS update synchronization

Once you have completed the installation of WSUS, you configure the update services by choosing the product updates your organization requires, and which classifications of updates to download and make available to the computers on your network. Once these are defined, you can synchronize updates manually or on a schedule, and your WSUS server will download the updates for the product categories and update classifications you have selected from the Microsoft Update servers to make available to the computers on your network. The first synchronization can take hours, depending on your selections, and then subsequent synchronizations will pull only the newest updates since the last synchronization.

Getting ready

For this recipe, you will download updates for the following products to your WSUS server:

• Windows Server 2016
• SQL Server 2016
• Windows 10

You will also choose which types of windows updates to download. In this recipe, you will select the following...

Configuring the Windows Update client

Windows computers download updates from Microsoft servers by default. To override this behavior, you can either configure the Windows Update client using GPO settings or manually update the registry of each client.

Getting ready

Run this recipe from WSUS1 with RSAT installed for working with Group Policy Objects.

$FeatureName = 'RSAT'
Install-WindowsFeature $FeatureName -IncludeAllSubFeature

How to do it...

The steps for the recipe are as follows:

1. Define and view the WSUS server URL using the properties returned from Get-WsusServer:

      $WSUSServer = Get-WsusServer
      $WSUSServerURL = "http{2}://{0}:{1}" -f `
                      $WSUSServer.Name, 
                      $WSUSServer.PortNumber,
                      ('','s')[$WSUSServer.UseSecureConnection]
      $WSUSServerURL

2. Create a Group Policy Object (GPO) and link it to your domain:

$PolicyName = "WSUS Client"
       New-GPO -Name $PolicyName
       New-GPLink -Name $PolicyName -Target "DC=RESKIT...

Creating computer target groups

Different types of computers in your organization require different approaches to software updating. Employee workstations run software that application servers do not. Some servers are mission critical and must only be updated after you test the updates thoroughly. Sometimes critical updates are released that must be applied immediately, while some may be optional.

To manage the distribution software updates, define computer target groups on your WSUS server and assign computers these target groups. Each computer target group can be configured to apply updates differently. You create a target group for the Domain Controllers in this recipe.

Getting ready

WSUS must be installed and configured on the update server, and clients must be configured to use the WSUS server to apply this recipe.

How to do it...

The steps for the recipe are as follows:

1. Create a WSUS computer target group for the Domain Controllers:

$WSUSServer = Get-WsusServer
      $WSUSServer.CreateComputerTargetGroup...

Configuring WSUS auto-approvals

WSUS organizes Windows updates under different classifications. You can view these classifications by using the Get-WsusClassification cmdlet. Two particularly important classifications you should check regularly are Critical Updates and Definition Updates. The Critical Updates classification includes updates that address severe security flaws and zero-day vulnerabilities. The Definition Updates classification includes definition files for Windows Defender to identify and remove malware.

These two classifications are important enough to approve them automatically. Auto-approval ensures WSUS installs these updates on client computers as soon as possible. In this recipe, you will create an auto-approval rule for these updates.

Getting ready

Run this recipe on the WSUS1 server.

How to do it...

Run this recipe to configure auto-approval of WSUS update:

1. Create the auto-approval rule:

$WSUSServer = Get-WsusServer
      $ApprovalRule = $WSUSServer.CreateInstallApprovalRule...

Managing updates

The WSUS administrator performs several tasks to manage update distribution. These tasks begin with the awareness of which updates are available, approved, installed or marked to be installed for each computer target group. For the available updates, the administrator must approve or reject the updates to control which updates are made available. This recipe covers listing installed updates, listing available updates, approving updates, and declining updates.

Getting ready

In this recipe, you manage updates using PowerShell. You should open a PowerShell session on WSUS1 to perform this recipe.

How to do it...

In this recipe you manage WSUS updates:

1. Open a PowerShell session, and view the overall status of all Windows updates on WSUS1:

      $WSUSServer = Get-WsusServer      $WSUSServer.GetStatus()

2. View the computer targets:

$WSUSServer.GetComputerTargets()

3. View the installed updates on DC1 using Get-Hotfix and Get-SilWindowsUpdate:

Get-HotFix -ComputerName DC1$CimSession = New-CimSession...