TABLE OF CONTENTS When faced with machines that are not part of an Active Directoryforest, that sit in a workgroup, that are offset in a more secure part of your network like aDemilitarized Zone (DMZ), or have random one-off stand-alone machines that facilitate a third-partyapplication, local settings are your best bet for configuring WSUS client updates. Even if yourmachines sit in a legacy Windows NT 4.0 domain, an Active Directory WSUS server can still deployupdates to these machines as long as they have the correct local policy settings:
Local Group Policy
Local Machine Registry
System Policy
Control Panel
When using local settings to set your WSUS server location, Microsoft recommends using thefully qualified domain name of your server to insure correct name resolution (e.g., use http://WSUSServer.syngress.localinstead of http://WSUSServer).
If your non-Active Directory clients refer to a different Domain Name Server (DNS) or a DNSserver without a zone for the domain name your WSUS server resides in, consider using a localhosts file for name resolution.
Using the local Group Policy Editor, WSUS settings are saved and read from the policy sectionof the registry located under the following hive and key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\.
When using the AU User Interface (UI) or the Local Group Policy Editor, you may notice thatWSUS changes happen immediately. Although the same key is manipulated when using tools like regedit.exe and regedt32.exe,to edit the local registry directly, the AU Client may need to be restarted to read those settingsinto memory.
