SUS OU?

[Guest]

Running a test lab

I have a Windows 2k server that is running as a DOMAIN with AD, DHCP, and DNS. It does have access to the internet and I can surf.

I installed the SUSsp1.exe to make this server a SUS server for my computer clients. I successfully configured the SUS server to download updates to a local folder on the harddrive of my server.

I went to each client computer running XP pro & W2kpro including the server and in LOCAL COMPUTER POLICY > ADMIN TEMPLATES added the "wuau" policy and configured it where the windows update folder appears.

Now the tricky part, On the server I read I must create a SUS OU in Active Directory Users & computers. Which I did and linked the DEFAULT DOMAIN POLICY to this folder. Is this right or did I screw something up? Or is there a better way to do this?

 

[Marin Marinov]

Running a test lab

I have a Windows 2k server that is running as a DOMAIN with AD, DHCP, and DNS. It does have access to the internet and I can surf.

I installed the SUSsp1.exe to make this server a SUS server for my computer clients. I successfully configured the SUS server to download updates to a local folder on the harddrive of my server.

I went to each client computer running XP pro & W2kpro including the server and in LOCAL COMPUTER POLICY > ADMIN TEMPLATES added the "wuau" policy and configured it where the windows update folder appears.

Now the tricky part, On the server I read I must create a SUS OU in Active Directory Users & computers. Which I did and linked the DEFAULT DOMAIN POLICY to this folder. Is this right or did I screw something up? Or is there a better way to do this?

Hi Luis,
Since you have a domain you don't need to go to each client to point it
to the SUS server - you can do this with a GP in AD. So probably what
the document you read was saying is that you should put all "wanna-be-
SUS-clients" machines in an OU, create and link a new GPO to it and
configure the SUS-related settings. What you did won't do harm since the
Default Domain Policy is linked to the domain and hence applies to all
machines in the domain. Normally, you would want finer administration
and that's why the recommended approach is to create a separate GPO.

So, put the clients' computer accounts in the OU you created, unlink the
Default Domain Policy GPO, create and link a new one and configure it.
You can find a lot of useful SUS information and links at SUS home:

http://www.microsoft.com/windowsserversystem/sus/default.mspx

Another useful site is www.susserver.com.

HTH
--
Cheers,
Marin Marinov
MCT, MCSE 2003/2000/NT4.0,
MCSE:Security 2003/2000, MCP+I
-
This posting is provided "AS IS" with no warranties, and confers no
rights.

"True knowledge exists in knowing that you know nothing."
Socrates

 

[Marin Marinov]

<snip>
Luis, the client computer accounts have to be in this OU for this GPO to
apply. Also make sure your WinXPs are at least SP1 and Win2Ks are at
least SP3 or you install the automatic updates client. To configure them
with a GPO you should do the following:
1) Under computers right-click a computer account you want to move,
select Move and select the SUS OU. You shouldn't get an error, if you do
please copy it down *exactly* how it is stated.
2) Edit the SUS OU GPO to set the following:
- Specify intranet Microsoft update service location - set the
NetBIOS, FQDN, or IP address of the target SUS server in both fields. To
avoid name resolution problems use an IP address
- Configure Automatic Updates - set to "enabled" and select one of
the "auto download" settings (refer to the explain tab for more
information)
- If you need you can configure the other two settings also. Refer
to their Explain tabs for more details.

3) On the client machine either refresh GP using:
- For Win2K:
secedit /refreshpolicy machine_policy /enforce
- For WinXP:
gpupdate /force
and restart the "Automatic Updates" service or restart the machine. You
can then check on the client machine that it points to your SUS server
by viewing:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\

Value name: WUServer
Registry Value Type: Reg_SZ
This value sets the SUS server by HTTP name (for example,
http://IntranetSUS).

Value name: WUStatusServer
Registry Value Type: Reg_SZ
This value sets the SUS statistics server by HTTP name (for example,
http://IntranetSUS).

The values should be the ones you specified in the GPO.

I suggest you also review the "Software Update Services Deployment White
Paper" (if you haven't already done so) at:
http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx

Feel free to post again if you continue to have troubles with SUS.

HTH
--
Cheers,
Marin Marinov
MCT, MCSE 2003/2000/NT4.0,
MCSE:Security 2003/2000, MCP+I
-
This posting is provided "AS IS" with no warranties, and confers no
rights.

"True knowledge exists in knowing that you know nothing."
Socrates

 

[Guest]

Hi Marin
Got your message thanks.
1) On the domain server under AD Users & Computers, I did move the client computers from the original Computer OU to a newly created SUS OU without any problems or errors.
2) I did edit the the SUS GPO to reflect the domain server name ie http://raidserver1.
3) I did refresh the WinXPpro client using the gpupdate /force. I got the message (user policy refresh has completed).
4) At this point am going to reboot the server and the client computer any errors I'll let you know.

Thanks

 

[Guest]

Part 2

Hi Marin
Got your message thanks.
1) On the domain server under AD Users & Computers, I did move the client computers from the original Computer OU to a newly created SUS OU without any problems or errors.
2) I did edit the the SUS GPO to reflect the domain server name ie http://raidserver1.
3) I did refresh the WinXPpro client using the gpupdate /force. I got the message (user policy refresh has completed).
4) At this point am going to reboot the server and the client computer any errors I'll let you know.

5) Rebooted the server and the client computer. On the client side no errors found in the event log. On the server there is one error:
"One or more errors occure while loading the setting file
F:\inetpub\wwwroot\autoupdate\dictionaries\setting.txt" SOURCE=WUSYNCSERVICE, EVENT ID=107, ERROR=0X80070057
Let me know, thanks again

 

[Marin Marinov]

Part 2


5) Rebooted the server and the client computer. On the client side no errors found in the event log. On the server there is one error:
"One or more errors occure while loading the setting file
F:\inetpub\wwwroot\autoupdate\dictionaries\setting.txt" SOURCE=WUSYNCSERVICE, EVENT ID=107, ERROR=0X80070057
Let me know, thanks again

Have you sync-ed the SUS server at least once and approved a sample
patch for installation? I'm no expert in SUS troubleshooting but it
looks like it's having synchronization issues. I would suggest you post
in the microsoft.public.softwareupdatesvcs newsgroup - it more likely
that the guys there can give you a more precise answer.

Sorry I can't be of more help, Luis.
--
Cheers,
Marin Marinov
MCT, MCSE 2003/2000/NT4.0,
MCSE:Security 2003/2000, MCP+I
-
This posting is provided "AS IS" with no warranties, and confers no
rights.

"True knowledge exists in knowing that you know nothing."
Socrates

 

[Guest]

Hi Marin
Yes, I always sync my SUS server with Microsoft and select, approve a patch for installation. Still nothing. Thanks again

 

[Michael D. Ober]

You need to deinstall SUS from the first server before moving it. I ran
into this same problem when I moved our SUS server. Deinstall it on the new
server, desintall on the original server, and then install on the new
server. The problem is that the new SUS Server is looking to the old SUS
server still.

Mike Ober.

Hi Marin
Yes, I always sync my SUS server with Microsoft and select, approve a

patch for installation. Still nothing. Thanks againclient computers from the original Computer OU to a newly created SUS OU
without any problems or errors.