Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Essentially I was wondering if it's possible to use the local gpedit.msc on Windows 7 and Windows Server 2008R2 machines to configure clients to use a workgroup based WSUS installation. With this - I would still like to ensure users can use Windows Update manually but the WSUS does the majority of the work!

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Registry

Please see the article Configure Automatic Updates in a Non–Active Directory Environment.

  1. You're going to want to set these registry keys to the URL for your WSUS server (for example: http://wsus.local):

    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\WUServer
    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\WUStatusServer
    

    Note: The key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate does not exist on a fresh installation of Windows 7. You will have to create it if it doesn't exist.

  2. Then create a new DWORD named UseWUServer in the following key and set it to 1:

    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
    

This should be enough to tell the system to use your local WSUS installation.

Please see the article linked above for further options in configuring the Windows Update behavior.

Example

These are the default settings a Windows Small Business Server 2010 will set: enter image description here enter image description here

Group Policy

It should also be noted that these settings are also accessible through the Local Group Policy Editor under Computer Configuration\Administrative Templates\Windows Components\Windows Update: enter image description here
click to enlarge

In the group policy editor, we can also see the group policy that may be used to restrict access to Windows Update for a user. This would allow installation only directly through WSUS approval and automatic installation (which would have to be configured): enter image description here
click to enlarge

share|improve this answer
    
Would that by default go ahead and use WSUS, but still allow manual Windows Update checks? –  PnP Jun 27 '12 at 20:30
    
@TheD: It should. The access to Microsofts own update servers would have to be disabled separately. –  Oliver Salzburg Jun 27 '12 at 20:32
    
Many thanks Oliver –  PnP Jun 27 '12 at 20:33
    
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\WUServer HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\WUStatusSer‌​ver - Do I need to create these keys and folders? They don't exist in my Win7 box ? –  PnP Jun 27 '12 at 20:52
    
@TheD: The part up until Microsoft\Windows should exist, otherwise I would be a bit confused. If the folder WindowsUpdate does not exist, create it. –  Oliver Salzburg Jun 27 '12 at 20:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.