Patching, locally controlled, remotely delivered.
The options seem overwhelming, but guess what?
All you got to do is know where to go
and how to make them work for you.
I'm going to show you all the secrets
and tell you the best way to patch your systems.
All that and more coming up now.
Hello, everybody.
My name is Adam Gordon, an edutainers here at ITProTV.
Welcome back to our continuing conversations
around Windows Server.
And how do I do those pesky things?
I always wanted to know how to do,
but could never really figure out on my own.
We take a complex topic, we make it simple for you,
we explain the do's and don'ts,
giving you the power to go off
and make Windows work for you.
Remember, you can subscribe to our YouTube channel.
Check out this and all the other cool
and exciting conversations we have across this series.
Need more in depth training or want to know more
about the technicalities of a certain topic?
Well, check us out over at Itpro.tv where myself
and all the other edutainers I work with
are hanging out waiting for you.
We can train you on Windows and ever so much more.
All right, so in this episode,
we're taking a look at patching two ways.
We're going to be able to talk about
how we patch manage locally.
That's pretty simple, actually.
The Windows Update capabilities
that we're all familiar with are what we'll focus on there.
But we can also create a centralized patching solution
using what's called the Windows Server Update Service,
the WSUS capabilities.
It's a role that we install and configure.
We do that through Server Manager.
We're going to quickly take you on a tour
and show you how to do both
giving you maximum flexibility
when it comes to patching that infrastructure.
Join me here if you will.
We're on our Windows Server 2022 virtual machine,
where we do most of our conversations and demonstrations from.
I'm going to start out in Start Menu on the desktop here.
We're going to go into settings to be able to look
at the local Windows Update capabilities.
So join me here.
We're going to click Start.
We're going to go down here to our Settings icon.
That's our little gear right down there.
And we're going to open up the Settings area
centrally looking at the control panel.
We're going to come over here
to the Update and Security area
where we can look at Windows Update.
And we'll see the update capabilities are on display for us.
This is a pretty common view.
I'm sure most if not all of you are familiar with this
from your own systems,
whether you're doing this at work or not.
And a lot of times this is set to check automatically.
The system itself will often just check
one or more times a day for outstanding
and preexisting patches that Microsoft is teed up.
If they are available and we need them,
we'll download them.
They'll be listed here and staged
and they may even install automatically,
depending on the settings we choose.
We may need to click that we want to install them,
we may have to restart the system.
So we just have to pay attention to some of those details.
But majority this can actually be automated
depending on what we choose to do.
We do have the capabilities here below that area,
to pause updates for a period of time,
change the active hours where we are working
and don't want to have restarts getting
in the way of what we're doing,
we could see the past history of updates
that have been successful or an occasion have failed,
and we can add additional update controls
and modify settings here to achieve
those end results I was talking about, almost fully
if not fully automating this process as needed.
But the most simple thing to do
is simply check for updates,
and to see if there's anything out there
pending that we may need.
Now, this system was updated
right before we shot this episode.
So we're not probably going to have any updates.
But it's always good to check.
Microsoft may have put something out
in the last little bit you never know.
So it doesn't seem to be anything out there.
But you'll see we're set here,
it says to automatically download and install updates
except on metered connections,
meaning where there may be charges.
In that case, those updates will be downloaded,
but only the ones that are necessary
to keep Windows running smoothly, meaning securely.
The rest will be left until you're connected
or you're not going to be charged.
Now this is a pretty standard common
and easily understood if you will set of features
associated with Windows Update.
But what I get asked a lot about is this red text appear.
Most of us have been seeing this more and more.
*Some settings are managed by your organization.
I get asked this my customers and students all the time,
“Hey, what's going on with that?
Why are we doing that?
My company doesn't have policies that are managing updates
And/or they're not aware that there are.”
But it's for one of two reasons.
Either it's because your company
is managing aspects of the Windows Update experience
using policies, typically group policies,
and or it's because your machine is running
a Windows Insider build.
This is the one most people don't realize.
And if you're running
in part of the Windows Insider program,
you see that because the Windows Insider
build capabilities have to be monitored
and maintained and operated by Microsoft.
The pushing of those new operating system loads
every week hum through Windows Update,
and Microsoft reconfigures your system,
controlling aspects of the Windows Update process
to allow those operating system updates to be delivered
and installed for you, typically once a week.
I do that on my physical laptop running windows 11.
I've done it for years throughout
the windows 10 release cycles as well.
And so I see that on my machine all the time.
And we see that if we're in the Windows Insider program.
You can tell that by viewing policies there,
and you'll get an answer to that question.
And you'll see you have opted in
for the Windows Insider Program,
or there are policies managing updates.
And the policies that are set are listed here,
so you can actually see what they are.
Notice they're set by group policy,
and notice we can tell what they are.
All right.
So we have debunked, hopefully the concepts associated
with the local use of Windows Update.
But I do want to show you
what some of those advanced options are.
Let's take a look here.
And you'll notice under Advanced Options,
that I have the ability to receive updates
for other Microsoft products when you update Windows.
So not just Microsoft Windows itself,
but Microsoft Office, for instance, can receive updates,
download updates over metered connections
where extra charges may apply.
Notice these are turned on.
If I want to turn them off, I can toggle on and off very simply.
I meant to say notice they're turned off.
But notice I can turn them on just by toggling.
And as I do that, I can easily then change the updates
and the cycle of those updates.
And this one, restart this device
as soon as possible when a restart is required.
When an update comes in and is installed,
they can opt in for that as well.
And then Update Notifications,
I can get that little pop up that says,
“Hey, there's a notification.”
That tells me that a restart is pending.
I can turn that on also.
And I can Pause Updates temporarily.
I can specify a date that I want to pause those updates
until, saying you know, I want to pause them for
let's say approximately about 30 days out.
And I can do that.
It's actually about 35 days out approximately.
And I can do that right from here.
And I can also go in and look at Delivery Optimization.
And I can allow downloads from other PCs,
where I might be able to get that file
because it's already available inside of my network
that have been downloaded off of the actual internet
or through the cloud,
where I might burn up a lot of bandwidth.
So if I allow downloads from other PCs,
I then have the option to specify
whether that is on my local network
or on my local network as well as PCs
that might be connected to the internet.
And to go even deeper,
there are additional advanced settings
that I can look at here that allow me to control
and throttle the actual amount of bandwidth
that is being devoted to this download activity
between two machines in an emergency
where maybe I don't have an internet connection,
but I have a local network connection
and I can move those files, but for whatever reason,
I'm not able to put them on storage media
and transfer them manually.
I can download them over the network
and I can throttle or control that amount of bandwidth
if necessary.
So we like the capabilities here.
There's multiple Advanced Settings.
Both download and upload can be controlled
and throttled as a percentage of bandwidth available
and devoted to this activity.
But they're buried several layers deep
and multiple screens that don't necessarily care
for the fact they're not all together in one place.
I think Microsoft could have done
a slightly better job making them visible.
But that's what we're here to do.
It's to discuss them and show you how to find them.
But they certainly are available,
you just have to know where to look
if you want to play around with them.
Viewing Update History, always very important
to take a look at the updates that have come in
whether the installation was successful or not.
But I also like to point out to my students
and customers in this area that we can uninstall updates
and we can then specify recovery options from here again.
Something a lot of people don't realize is available,
we can uninstall an update if necessary
and we can specify recovery options.
This is just the link to another area
where we can go in and work with recovery options
depending on what we're doing here.
You'll see we can troubleshoot from here
and do whatever else Microsoft may recommend
or make available.
And I can Change the Active Hours
for device management if I turn this on.
Current active hours are between eight and five.
And I can go ahead and I can then modify
if I choose to what active hours may be,
further centrally optimizing the capabilities
around delivering those updates.
If I want to pause updates, but only for seven days,
not for that calendar pick list that I showed you,
I can do this quickly right from here.
I can resume updates just by doing that, very simple.
If I want more than a seven day pause,
I do that under Advanced Options as we were looking at.
All right.
So you've seen all the local features.
Let's take a look at what we want to do.
We want to scale this for the enterprise.
We want to set up a server
that becomes a single source of truth,
what we call the Window Software Updates Service, WSUS.
It is commonly affectionately referred to.
We want to be able to use that to gather and download
all these updates from Microsoft.
So we're still going to go out
and get all these updates from the internet.
We're going to load them all onto this server.
And then with this service
in the management console it provides,
we're going to then create a catalog of updates,
and allow ourselves to group the updates
into essentially packages that we want
to be able to make available and deploy.
We can then assign those updates to individual systems
or groups of systems in our organization.
Centrally managing controlling
that Windows Update experience,
but doing it all from behind our firewall,
securely on our local network.
Because the only server that's actually connected,
only system that is actually exposed to the outside world
directly will be the bridgehead server,
the WSUS server that downloads our updates.
If you ever wondered how all that works,
well, we're going to show you how to install
and configure the WSUS capability right now.
We need to go to the Server Manager.
To do that, we're going to go to our Start Menu.
Go to our Server Manager tile
where we can open the Server Manager from,
always pinned at the upper left hand corner
in our navigation area.
We'll open the Server Manager.
And once this sets up
and just checks quickly the current status of the system
and it's available for us to begin working with,
a little flashing blue line that's chasing across the screen
tells us that we're doing an update.
We're good to go here.
We're going to go over to Manage,
and we're going to have to install a role or feature
to add the Windows Server Update Service,
WSUS capability.
So we're going to walk through that wizard.
We'll click Add Roles and Features.
And notice we have this little before you begin screen
where it just tells us what we're about to do.
We're going to skip through that.
We are going to do a Role-based
or feature-based Install that is the default.
If we want to do a remote desktop services installation,
where we can add Remote Desktop capabilities
to this server, serving up services for those people
that need to consume them remotely
and allow remote connectivity into the server,
we can configure that separately.
So we're going to click and select the default.
We're going to select the machine
we want to target for the install.
In this case, the local server
that we are working with managing directly.
But if we had multiple servers,
some of which were remote, some are local,
and we're managing,
or one is local or managing all of them,
they'll be part of what we call a server pool.
You can see the Server Pool designation right here.
Just a fancy Microsoft term for a group of servers
that we want to manage.
And we will make the appropriate selection here.
Just pay attention
to the name of the server you're selecting
if there's more than one and target the appropriate one.
Notice, I could also select a virtual hard disk.
I could work with a virtual hard disk
and configure the WSUS or any server feature
or role that I want to install, making it available
and then using it in a separate deployment.
But I would have to make some additional choices.
I have some additional steps to follow
as you can see here.
And I have provide a path to the virtual hard disk
that I want to work with.
So we have options.
We'll stick with our server directly from the server pool.
It is highlighted by default.
We'll click Next.
We then have to choose, in this case,
the role that we want to install.
The list is alphabetized.
It will be at the very bottom
below Windows Deployment Services,
Windows Server Update Service, the WSUS service.
We'll click there.
Notice we have a bunch of dependencies that are required.
Rather long list by the way,
that are required for us to do the install.
Some of these may be installed already on your system
if you're using IIS and hosting a variety of websites,
others may not.
So the list may vary for you as you do this.
It'll be up to you.
Based on your current configuration,
.NET Framework is required,
Remote Server Admin Tools are required,
the configuration of the web server in a specific way is required,
and Process Activation Service will also be required.
I have to accept all these in order to do the install.
The nice thing is Microsoft is smart enough
to tell us what we need.
Make those selections.
I don't have to select the 30 or 40 individual elements,
making sure I got them all right.
I can simply just go ahead
and allow the selection to be made on my behalf.
So we like this a lot.
We'll click Add Features.
That has now been configured on the features list.
But notice, I now have a WSUS area
that I have to configure some settings in as part of this.
We'll continue our walkthrough.
All those features are now going to be enabled.
The .NET Framework version 4.8 is selected.
We see the Remote Server Admin Tools are selected.
And that capability there under the Roll Admin Tools
for Windows Server Update Service Tools
has been selected right there.
And we'll see that we have some additional stuff
that is required, like the Process Activation Service.
All of that's been selected for us.
You don't have to worry about any of it.
We then have the Windows Server Update Service overview.
Says, “Hey, you're about to do this things
that you want to make sure that you should note.”
Says that at least one of your WSUS servers
has to be available and connected to the internet
to download from.
Microsoft Update, as I suggested would be the case.
Any other WSS servers
can then download from that original machine.
The bridge had servers I called it
that creates that connection out to the outside world.
And the WSUS server to server
and server to client communications
should be set up to use SSL,
which means they should use
a secure encrypted protocol connection
that will protect that traffic.
Okay, I'm game for all that.
Let's click Next.
We have to specify our role services
specific to the WSUS configuration.
Select which role or roles we want to install,
the Windows ID connectivity.
The windows internal database is what we're setting up
to manage those updates the WSUS services itself.
The internal database is going to be the option we choose
if we're not going to have a separate SQL Server
or an external database that we would connect to.
We do, we need the SQL Server connectivity option.
We'd have to then specify the name of the SQL Server.
It's really is dependent on the nature
of the systems you're running.
You might have to work with the database administrator
or the DB group in your organization
to figure out the best way to do this.
But the default is to use the internal database,
think of it as like SQL Lite.
We don't have to have a separate big SQL database running.
We install a local version that is licensed and available
as part of the WSUS install,
and we manage it all on the same machine.
So we're going to do that.
Click Next.
Then we have to specify
where we want the content to be stored.
You'll see here.
Store Updates in the following location
(choose a valid path on the machine or a remote path).
It says, if you choose to store updates locally,
updates are not downloaded
until the WSUS server approves them.
And we obviously can go ahead and save disk space
by clearing the checkbox here
and we will then not store them locally.
We will simply download them as needed.
So it's up to us to configure.
I'm not going to configure
and store them locally right now.
we're just going to uncheck that.
And just for purposes of a quick install,
show you that option, you can decide
on what path you want to put them in yourself.
We'll click Next.
We're then going to get this configuration going.
Remember, we can restart automatically,
if we choose to, but it will cut us off.
The server will automatically restart
when we're done if necessary without any warnings.
You just want to note that as part of this configuration.
You can see that right there.
You have to opt in if you want to do that.
I'll say, yes.
I'm going to go ahead and let that install kick off.
Now the install itself can take a while to run.
So be prepared for that.
Once the install is finished, we actually then get access
to the WSUS management capabilities.
There's a whole separate set of steps that will go on
with actually configuring WSUS
beyond the conversation we're having
in this initial episode.
But suffice it to say that you certainly can go through
and walk through all the WSUS configuration
setting up fully this ability.
And if you're not familiar with how to do it,
you could check out Microsoft's own documentation.
It's really straightforward, you can certainly come back,
check out our YouTube channel
where we may have another episode about how to do that.
And or you can always check us out
as I said over at ITPRO.TV
directly where we go in depth
and show you how to walk through complex solutions
like configuring and setting up WSUS to end to end
and we can show you how to do everything you need to do
to get it up and running fully.
All Right. That's going to finish cooking.
We're not going to wait around for it to finish.
It'll be done.
It takes about five minutes or so.
And when that's finished,
you can then restart the machine if necessary.
And you can then open up the WSUS management portal
and you can begin managing configuring your WSUS server.
I'm going to go get ready
for more exciting and cool demonstrations for use.
We continue our conversations on our YouTube channel
about everything you need to know
about how to optimize and manage your Windows Server experience.
But until you come back for another fun, exciting conversation,
I'm going to wish you happy servering, and I'll see you soon.