WSUS Design - Best Practices

-

my organization made of 5 branch offices, totalling approx 800 workstations , 30 (physical , virtual) servers.  our current wsus structure has 1 physical server @ each branch, update approval/denial process takes place, , branch's computers report to.

when looking redesign better administration, thinking of making virtual master wsus server @ 1 site - feed 1 physical replica server @ each branch.  in long run, not change - other taking away need 5 admins, needing 1 admin @ master level.

is thought of keeping 5 physical servers @ each branch overkill?  each have many other roles, wsus 1 more thing servers 'serve-up'.  thought keeping them - keep update download flows channeled through site server, not master (which in 4 cases remote site).

thanks advice.

-mark-

is thought of keeping 5 physical servers @ each branch overkill? 

unless have specific organizational reasons having distributed update approval strategy in organization, 5 autonomous wsus servers organization 830 systems significant overkill, , contribute great disparities in is, or not approved , installed branch branch.

whether need replica servers @ question answered. speaking, sites more 100 systems can benefit having onsite wsus server, don't mention distribution of systems across 5 sites is. also, there's an implied "central site" aside 5 branch offices, don't whether 830 systems identified include "central site", or if assumption of "central site" not valid.

generically speaking, install replica server on site more 100 systems manage, , sites less 100 systems can assigned central (upstream) wsus server updates. unless bandwidth availability site <100 systems less 5kb/sec per system -- in case should deploy replica server. overhead of maintaining wsus server outweighs bandwidth used distribute updates across connection, if sufficient bandwidth exists provide remote updating, that's more economical decision in long run. (exception: if you're paying bandwidth volume used, onsite replica server cheaper maintain!)

lawrence garvin, m.s., mcitp:ea, mcdba, mcsa
principal/cto, onsite technology solutions, houston, texas
microsoft mvp - software distribution (2005-2010)
mvp profile: http://mvp.support.microsoft.com/profile/lawrence.garvin
blog: http://onsitechsolutions.spaces.live.com


Windows Server  >  WSUS



Comments

Post a Comment

Popular posts from this blog

Edit Group Policy

-
i have pc has power settings pushed out default domain policy in ad environment. of course on local machine "some settings managed system adminstrator". the machine temporarily no longer in contact domain controller (it's been physically moved , not on same network now) can't updated gpo settings. i believe if edit local group policy won't make difference because of group policy processing , precedence. since it's temporary away ad network, still want use settings of ad user. is there somewhere in registry stored can edit power plan manually until can sync domain? (i need prevent sleeping while plugged in - it's set 1 hour) thanks! allen crist i found site: http://gpsearch.azurewebsites.net/#7916 i able add policy to hkey_local_machine\software\policies\microsoft\power using specs found on site. looks solved issue. i'll report if didn't. thanks! allen crist ...
Read more

Hyper-V VM not reaching OS 'Logon' screen

-
i trying migrate vm vmware hyper-v. so far have done following (seemingly successfully): prepare vmware vm conversion hyper-v format (vhd) within vmware workstation 8.0 environment following steps guide: http://social.technet.microsoft.com/forums/en/winserverhyperv/thread/ef8c12f7-c45d-442e-9a30-c43cd87df3b3   (i.e. remove vm tools, add new ide hard disk…) use vmdk2vhd application convert individual vmdk files vhd ones create new vm in hyper-v exporting in 3 newly converted vhd files at point have checked settings , powered on vm in hyper-v find although windows begins load expected manages reach screen prior login screen saying either of following messages: “windows starting up…” “the active directory rebuilding indices… please wait” to knowledge, albeit limited in area, vm should present me login screen since appears in vmware. if start vm in safe mode can login not desired affect. below details of vm: operating system: windows server 2003 (enterprise edit...
Read more

DNS question...

-
i new setting dns server....my domain name expl. "domain.com"....i set "a" record in forward lookup for  www.domain.com itself...."server's local ip"....i've added no other zones , i seem able resolve names except own....www.domain.com.....also, do i put my isp's dns ip's....for external dns's server can't resolve?....forwarding or in nic setup?......i want setup in my dns server don't have include them on client side..... thanks mark     not put isp dsn server address in settings on nic dc or clients. should point local dns server on dc. set dns forward public dns, such isp. bill Windows Server  >  Network Infrastructure Servers
Read more