Wsus for remote vpn and on-premise users
-
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
-
@pete-s said in Wsus for remote vpn and on-premise users:
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
Exactly my point - I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
-
@dashrender said in Wsus for remote vpn and on-premise users:
I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.
This is a great question to which I have zero answers.
I'm sure you can run update via PowerShell - so for 100's of servers, I'm guessing that's how they would do them. Additionally, if uptime is that big of deal - then it's likely they have multiple servers running the same loads allowing them to take some of those servers offline while not affecting the service in general.
-
@fredtx said in Wsus for remote vpn and on-premise users:
Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.
I'm not sure that I follow. If WSUS isn't in place today, and RMM isn't in place today... seems like you are at a decision point that both are equally new and untried. Why go down the path of something bad instead of something better?
-
@fredtx said in Wsus for remote vpn and on-premise users:
I will have to stick with this solution for now.
Because it's a mandate from before you started that they just didn't get around to yet?
-
@fredtx said in Wsus for remote vpn and on-premise users:
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
Sure, but our point in the thread is that WSUS isn't a good means to that end. If anything, the purpose of WSUS is to avoid that goal (not exactly, but in practice.)
-
If you're starting from scratch I'd suggest taking a serious look at leveraging TacticalRMM (or something paid if you really want to spend money) instead of WSUS. (As mentioned by others)
If you do have to go the WSUS route for whatever reason(s) make sure to automate the maintenance scripts that microsoft references / provides in their online documentation. Why they don't integrate those scripts into the core product is something that I'll never understand but hey, they're making $$$ and I'm just a sysadmin.
-
@pete-s said in Wsus for remote vpn and on-premise users:
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
Agreed. Critical servers we tend to do by hand, and often.
-
@fredtx said in Wsus for remote vpn and on-premise users:
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
If they are critical, yes it is. In most cases.
But in one post you said that "best" had no place and WSUS, even though it is bad, HAD to be used as you didn't have the option to do something better (or even good.) Is "best" really on the table as a concern? At this point "adequate" is really the point to strive for (I'd consider WSUS the worst case scenario short of just giving up on updates.)
-
@notverypunny said in Wsus for remote vpn and on-premise users:
If you're starting from scratch I'd suggest taking a serious look at leveraging TacticalRMM (or something paid if you really want to spend money) instead of WSUS. (As mentioned by others)
Yup, that's EXACTLY what I was thinking. Free, no licensing overhead, way less effort to configure, maintain and use. Far easier to understand. Isn't limited to Windows should that ever matter. Does tons and tons of stuff outside of just patching and reporting.
This is what we use and as it is free, it always makes me wonder what role something like WSUS would ever play given that Tactical covers the features of WSUS you generally want without all of the cost and limitations.
-
You can use Windows Update for Business. No need for WSUS.
-
@obsolesce said in Wsus for remote vpn and on-premise users:
You can use Windows Update for Business. No need for WSUS.
Is there any type of reporting in that?
-
@dashrender said in Wsus for remote vpn and on-premise users:
@obsolesce said in Wsus for remote vpn and on-premise users:
You can use Windows Update for Business. No need for WSUS.
Is there any type of reporting in that?
Looks like there's some built-in reporting in Azure.
-
@dashrender said in Wsus for remote vpn and on-premise users:
@obsolesce said in Wsus for remote vpn and on-premise users:
You can use Windows Update for Business. No need for WSUS.
Is there any type of reporting in that?
Yes, multiple methods of reporting... reporting out the ass.
-
@obsolesce said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
@obsolesce said in Wsus for remote vpn and on-premise users:
You can use Windows Update for Business. No need for WSUS.
Is there any type of reporting in that?
Yes, multiple methods of reporting... reporting out the ass.
As long as you have Azure AD - pretty sure you can use WUfB without it.
-
@dashrender said in Wsus for remote vpn and on-premise users:
@obsolesce said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
@obsolesce said in Wsus for remote vpn and on-premise users:
You can use Windows Update for Business. No need for WSUS.
Is there any type of reporting in that?
Yes, multiple methods of reporting... reporting out the ass.
As long as you have Azure AD - pretty sure you can use WUfB without it.
Can't?
-
So a little background about this company I'm trying to implement patch management, is that it's growing through acquisitions. There's currently about 12 locations, and I just heard recently they acquired another company, which adds it to 13 locations. I'm wondering if implementing an RMM will benefit this company for the future? They are growing at a fast rate, and it doesn't appear to be slowing down.
-
@fredtx said in Wsus for remote vpn and on-premise users:
So a little background about this company I'm trying to implement patch management, is that it's growing through acquisitions. There's currently about 12 locations, and I just heard recently they acquired another company, which adds it to 13 locations. I'm wondering if implementing an RMM will benefit this company for the future? They are growing at a fast rate, and it doesn't appear to be slowing down.
In my opinion, RMM almost always makes sense. It's weird that internal IT departments use it so infrequently. What makes it logical for MSPs also makes it logical for internal IT. There is little different between an MSP and internal IT. Once in a great while that difference could be reflected in different tooling. But typically, it would not. The similarities are too close.
Most internal IT today is heterogeneous and that almost guarantees that RMM is the right approach over more "traditional" internal tools. Most internal tools are built around homogenous LAN environments, not disparate heterogenous environments.
