TABLE OF CONTENTS Active Directory is the most efficient way to implement WSUS in your environment, especiallyif you have a lot of client machines to update. One of Active Directory s key features is itsability to help administrators push out client changes to multiple machines quickly and effectivelyusing Group Policy. Group Policy is Active Directory s central mechanism for making changes anddistributing them in a global fashion. By design, its architecture is one to many, which is ourfocus for defining the client-server relationship between AU clients and WSUS.
Microsoft recommends that you use the power of the Group Policy Object (GPO) when rolling outWSUS to multiple computers. It also recommends that you refrain from editing your default domain ordefault domain controller GPO to make these changes.
Use the Group Policy Management Console (GPMC) when creating and managing GPOs. To obtain thelatest GPMC, go to microsoft.com/downloads and search for GPMCService Pack 1.
Consider using separate GPOs when dealing with computers that fall into different WSUScomputer groups due to computer function or application software. This way, you only affect onecomputer group when making GPO changes for installation and reboot times.
In a complex environment, you may have to create many computer-specific GPO s to accommodatevarying client types and the different ways in which you want them updated and rebooted. With thisin mind, try to organize your organizational unit (OU) structure in such a manner that all theobjects in that OU will apply that GPO, and refrain from...
