ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Wsus for remote vpn and on-premise users

    IT Discussion
    patching wsus
    7
    42
    2.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DashrenderD
      Dashrender @1337
      last edited by

      @pete-s said in Wsus for remote vpn and on-premise users:

      @fredtx

      If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

      Why are you assuming that? WSUS will allow you to download from MS based on what you allow.

      1 Reply Last reply Reply Quote 0
      • FredtxF
        Fredtx @Dashrender
        last edited by

        @dashrender said in Wsus for remote vpn and on-premise users:

        The following assumes your server has 16 or fewer hardware cores in it.
        Windows Server standard licenses allow for 2 VMs per 16 cores worth of processor licensing.
        Therefore, if you have 4 VMs today, you are required to have a minimum of 32 cores worth of licensing.
        If you have more than one DC on that single server hardware - you might consider reassigning that VM as a non DC and as WSUS instead, to save you needing to buy another license.
        No real value in two DCs in a VM on the same host. I mean there is a tiny bit of value, but worth the cost of another license - probably not.

        Looks like I have 1 2019 Standard license available so no need to buy additional license, and I can create a vm just dedicated for wsus.

        There is only 1 DC at our main site on the same esxi host that the future wsus server will be on.

        So as of now, it's looking like 1 WSUS Upstream server at main site, that remote servers will download updates from via site to site vpn. And if possible, configure existing wsus settings for workstations to download updates from MS. If it's not possible, create a replica, which would only be used to tell the workstations which updates are approved, and will not store updates on the hard drive of the server?

        1 Reply Last reply Reply Quote 0
        • IRJI
          IRJ @1337
          last edited by

          @pete-s said in Wsus for remote vpn and on-premise users:

          @fredtx

          If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

          If that is the case, what functionality does WSUS bring to the table?

          95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

          FredtxF DashrenderD scottalanmillerS 3 Replies Last reply Reply Quote 4
          • FredtxF
            Fredtx @IRJ
            last edited by

            @irj said in Wsus for remote vpn and on-premise users:

            95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

            That's another topic I want to get to as well. The topic of when and how to schedule/approve patching for your business in a Windows environment? And what is best practice? That may need to be a different post though.

            DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
            • DashrenderD
              Dashrender @IRJ
              last edited by

              @irj said in Wsus for remote vpn and on-premise users:

              @pete-s said in Wsus for remote vpn and on-premise users:

              @fredtx

              If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

              If that is the case, what functionality does WSUS bring to the table?

              95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

              I agree 99.9% of the time - the other .1% is what bites - when you have a bad patch and have to uninstall it.

              scottalanmillerS 1 Reply Last reply Reply Quote 0
              • DashrenderD
                Dashrender @Fredtx
                last edited by

                @fredtx said in Wsus for remote vpn and on-premise users:

                @irj said in Wsus for remote vpn and on-premise users:

                95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

                That's another topic I want to get to as well. The topic of when and how to schedule/approve patching for your business in a Windows environment? And what is best practice? That may need to be a different post though.

                Unless your company really is prepared for you and others to spend days testing all new patches before deploying them - then the best practice is to deploy ASAP after MS releases them. Zero and near zero day exploits start hitting within hours of updates being released.

                1 Reply Last reply Reply Quote 3
                • notverypunnyN
                  notverypunny
                  last edited by

                  An option that nobody has mentioned is doing split-brain dns for your WSUS.

                  Assuming that you've got a domain, setup something like updates.company.com with the appropriate security and forwarding externally and the necessary entries on your internal Windows DNS. Make sure that everything is setup with SSL and you're golden. So if the folks are out of the office, they'll still be pulling updates from your WSUS server, under your control. Hell, depending on how your firewall handles hairpinning, it might be best to forget about the entries in the internal DNS and just have everyone connect to the public IP, eliminating any instances of it having to deal with VPNs.

                  1 Reply Last reply Reply Quote 1
                  • scottalanmillerS
                    scottalanmiller @Fredtx
                    last edited by

                    @fredtx said in Wsus for remote vpn and on-premise users:

                    I've been tasked with implementing patch management for our company. I worked at an MSP prior to this role (sys admin), and we handled patch management through our RMM agents. My current company does not have rmm agent/management, so I'm looking at implementing WSUS.

                    Why not add an RMM?

                    1 Reply Last reply Reply Quote 2
                    • scottalanmillerS
                      scottalanmiller @IRJ
                      last edited by

                      @irj said in Wsus for remote vpn and on-premise users:

                      @pete-s said in Wsus for remote vpn and on-premise users:

                      @fredtx

                      If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

                      If that is the case, what functionality does WSUS bring to the table?

                      95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

                      Yup, I'm a huge opponent of WSUS. Most of the time (nearly all of the time) it consumes huge resources, wastes ITs time, puts patching at risk, breaks things in dangerous ways, undermines security, and makes what should be simple hard and often generates more licensing needs for no reason.

                      It has its place, but it is so rare that it is actually beneficial. It has so many cons and effectively no pros. And only an organization with such insane scale could ever possibly truly test patches, WSUS is basically zero benefits with a HUGE invitation to problems.

                      1 Reply Last reply Reply Quote 1
                      • scottalanmillerS
                        scottalanmiller @Fredtx
                        last edited by

                        @fredtx said in Wsus for remote vpn and on-premise users:

                        @irj said in Wsus for remote vpn and on-premise users:

                        95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

                        That's another topic I want to get to as well. The topic of when and how to schedule/approve patching for your business in a Windows environment? And what is best practice? That may need to be a different post though.

                        Best practice (which is in my book that just came out, by the way) is ...

                        If you don't have a huge testing environment where you can test patches within ~24 hours of release, to patch blindly without delay.

                        If you create any delay, hesitation, or opportunity to not patch, you have a big problem. WSUS represents all of these. Basically, if you are asking the question, it means WSUS is wrong for you and you need immediate patching.

                        If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.

                        FredtxF 1 Reply Last reply Reply Quote 1
                        • scottalanmillerS
                          scottalanmiller @Dashrender
                          last edited by

                          @dashrender said in Wsus for remote vpn and on-premise users:

                          @irj said in Wsus for remote vpn and on-premise users:

                          @pete-s said in Wsus for remote vpn and on-premise users:

                          @fredtx

                          If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

                          If that is the case, what functionality does WSUS bring to the table?

                          95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

                          I agree 99.9% of the time - the other .1% is what bites - when you have a bad patch and have to uninstall it.

                          WSUS doesn't fix the .1%. It just delays it, which doesn't help things.

                          DashrenderD 1 Reply Last reply Reply Quote 1
                          • DashrenderD
                            Dashrender @scottalanmiller
                            last edited by

                            @scottalanmiller said in Wsus for remote vpn and on-premise users:

                            @dashrender said in Wsus for remote vpn and on-premise users:

                            @irj said in Wsus for remote vpn and on-premise users:

                            @pete-s said in Wsus for remote vpn and on-premise users:

                            @fredtx

                            If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?

                            If that is the case, what functionality does WSUS bring to the table?

                            95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.

                            I agree 99.9% of the time - the other .1% is what bites - when you have a bad patch and have to uninstall it.

                            WSUS doesn't fix the .1%. It just delays it, which doesn't help things.

                            WSUS can uninstall the patch - so sure, not fix it, but help with removal.

                            1 Reply Last reply Reply Quote 0
                            • FredtxF
                              Fredtx @scottalanmiller
                              last edited by

                              @scottalanmiller said in Wsus for remote vpn and on-premise users:

                              If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.

                              With me being in this new role for 2 weeks (first system admin role), and the majority of the computers/servers on Windows, I will have to stick with this solution for now.

                              Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.

                              DashrenderD scottalanmillerS 3 Replies Last reply Reply Quote 0
                              • DashrenderD
                                Dashrender @Fredtx
                                last edited by

                                @fredtx said in Wsus for remote vpn and on-premise users:

                                @scottalanmiller said in Wsus for remote vpn and on-premise users:

                                If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.

                                With me being in this new role for 2 weeks (first system admin role), and the majority of the computers/servers on Windows, I will have to stick with this solution for now.

                                Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.

                                What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.

                                FredtxF 1 Reply Last reply Reply Quote 1
                                • FredtxF
                                  Fredtx @Dashrender
                                  last edited by

                                  @dashrender said in Wsus for remote vpn and on-premise users:

                                  What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.

                                  Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.

                                  The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.

                                  1 scottalanmillerS 2 Replies Last reply Reply Quote 0
                                  • 1
                                    1337 @Fredtx
                                    last edited by 1337

                                    @fredtx said in Wsus for remote vpn and on-premise users:

                                    @dashrender said in Wsus for remote vpn and on-premise users:

                                    What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.

                                    Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.

                                    The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.

                                    We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.

                                    Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.

                                    DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
                                    • DashrenderD
                                      Dashrender @1337
                                      last edited by

                                      @pete-s said in Wsus for remote vpn and on-premise users:

                                      @fredtx said in Wsus for remote vpn and on-premise users:

                                      @dashrender said in Wsus for remote vpn and on-premise users:

                                      What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.

                                      Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.

                                      The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.

                                      We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.

                                      Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.

                                      Exactly my point - I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.

                                      FredtxF 1 Reply Last reply Reply Quote 1
                                      • FredtxF
                                        Fredtx @Dashrender
                                        last edited by

                                        @dashrender said in Wsus for remote vpn and on-premise users:

                                        I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.

                                        Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.

                                        And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.

                                        DashrenderD scottalanmillerS 2 Replies Last reply Reply Quote 0
                                        • DashrenderD
                                          Dashrender @Fredtx
                                          last edited by

                                          @fredtx said in Wsus for remote vpn and on-premise users:

                                          @dashrender said in Wsus for remote vpn and on-premise users:

                                          I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.

                                          Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.

                                          And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.

                                          This is a great question to which I have zero answers.

                                          I'm sure you can run update via PowerShell - so for 100's of servers, I'm guessing that's how they would do them. Additionally, if uptime is that big of deal - then it's likely they have multiple servers running the same loads allowing them to take some of those servers offline while not affecting the service in general.

                                          1 Reply Last reply Reply Quote 1
                                          • scottalanmillerS
                                            scottalanmiller @Fredtx
                                            last edited by

                                            @fredtx said in Wsus for remote vpn and on-premise users:

                                            Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.

                                            I'm not sure that I follow. If WSUS isn't in place today, and RMM isn't in place today... seems like you are at a decision point that both are equally new and untried. Why go down the path of something bad instead of something better?

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 1 / 3
                                            • First post
                                              Last post