Plan WSUS Computer Groups

 

Applies To: Windows Server Update Services, Windows Small Business Server 2011 Standard, Windows Server 2008 R2, Windows Server 2003 with SP2, Windows Server 2008 R2 with SP1

WSUS allows you to target updates to groups of client computers, so you can ensure that specific computers always get the right updates at the most convenient times. For example, if all the computers in one department (such as the Accounting team) have a specific configuration, you can set up a group for that team, decide which updates their computers need and what time they should be installed, and then use WSUS reports to evaluate the updates for the team.

Note

If a WSUS server is running in replica mode, computer groups cannot be created on that server. All the computer groups that are needed for client computers of the replica server must be created on the WSUS server that is the root of the WSUS server hierarchy. For more information about replica mode, see Manage WSUS Replica Servers in the WSUS 3.0 SP2 Operations Guide.

Computer groups
Computers are always assigned to the All Computers group, and they remain assigned to the Unassigned Computers group until you assign them to another group. Computers can belong to more than one group.

Heirarchies
Computer groups can be set up in hierarchies (for example, the Payroll group and the Accounts Payable group below the Accounting group). Updates that are approved for a higher group will automatically be deployed to lower groups, in addition to the higher group itself. So in this example, if you approve Update1 for the Accounting group, the update will be deployed to all the computers in the Accounting group, all the computers in the Payroll group, and all the computers in the Accounts Payable group.

Because computers can be assigned to multiple groups, it is possible for a single update to be approved more than once for the same computer. However, the update will be deployed only once, and any conflicts will be resolved by the WSUS server. To continue with the previous example, if ComputerA is assigned to the Payroll group and the Accounts Payable group, and Update1 is approved for both groups, it will be deployed only once.

Server-side targeting and client-side targeting

You can assign computers to computer groups by using one of two methods, server-side targeting or client-side targeting. This process can be scripted and deployed to many computers at once. You must specify the targeting method you will use on the WSUS server by selecting one of the two options in the Computers section of the Options page.

Server-side targeting
You manually assign one or more client computers to multiple groups simultaneously.

Client-side targeting
You use Group Policy or edit the registry settings on client computers to enable those computers to automatically add themselves into the previously created computer groups.

For more information about server-side and client-side targeting, see the Create and manage WSUS computer groups [WSUS_SP2] section of the WSUS Operations Guide.