Using Windows Server Update Services

Windows Server Update Services is a free download you can install on a Windows server. It's used as a central location to download, approve, and deploy updates.

Tip When preparing for the 70-686 exam, you should have a solid understanding of WSUS. Microsoft has spent of a lot of time and energy creating and improving WSUS over the years, and it's used by enterprises of all sizes. Being free is good, but it's also easy to learn and works very well.

Figure below shows a typical configuration using WSUS in an enterprise. In the figure, the WSUS server retrieves updates from the Microsoft update site and all clients receive their updates from the WSUS server.

An administrator chooses which updates to download to WSUS. Once the updates have been downloaded, they can be tested, approved, and deployed to clients. WSUS allows you to organize computers in groups, so it's possible to approve an update for one group of computers but not another group.

Although Figure above shows only 12 network clients, your network could have many more. In a large network, you may even choose to use multiple WSUS servers.

Figure below shows a typical configuration when multiple WSUS servers are used. A single WSUS server is used to download updates from the Microsoft update site and is referred to as the upstream server. WSUS servers that receive updates from the upstream server are referred to as downstream servers. Downstream WSUS servers retrieve the updates from this server, and administrators of each downstream server can then choose to approve and deploy updates to their clients based on their needs.

This is useful in a large but decentralized environment where administrators in different locations need to make decisions on the management of the systems that are different from what may be needed in another location of the enterprise. In other words, an administrator of one downstream server can deploy an update to clients in her network, while an administrator for another downstream server can wait until further testing is completed before deploying updates to his network.