Microsoft Patch Management WSUS 3.0 Group Policy Deployment (Part 3)

Note: The domain name, computer name etc. that i have used are for demo and a standalone lab only.

We are now ready to use Group Policy to deploy updates.

First, go to active directory users and computers and create 2 OU (Organizartional Units)

Update Group - Computers must be located on this OU

Update Test Group - Computers for update testing must be located on this OU

Open Group policy management and create 2 GPO (Group Policy Object) under the "Update" and "Updates Test" Groups.

To edit GPO right click on it and select EDIT.

Under computer configuration >>> Administrative Templates >>> Windows Components >>> Windows Update.

IMPORTANT: Both GPO settings of groups should be configured same as below, except for "Target group name for this computer". The value for WSUS Deploy Updates GPO should be "Deploy Updates"

If you are finished configuring the GPO. Launch again the Active Directory Users and Computers. Move the computers that you have chosen to be tested for new updates to the "Update Test Group".

On my case, the machine with the computer name "BBC5C249A514424".

Now going back to the WSUS 3.0 server. The computer should now be detected and should be on the list of Test Updates.

Let us now select and approve one update. Right click on it and select Approve.

Right click Test Updates and choose Approved for install.

The update is now approve to be deployed to those machines under Test Updates group.

To learn more, go to WSUS Home

To learn more about GPO, go to Windows Server Group Policy website