WSUS Integration With AD

We chose to go the route of creating at least a seperate GPO for every target group. We also make sure that we keep the client update behaviour uniform within a single group, just to make it a little clearer when administrating.

The downside is that you have, depenmding on your requirements,  a whole collection of GPO's ( = more GPO processing overhead) that you only use for Windows Update targetting. In our case we even created seperate OU's just for for this purpose, though you should ideally avoid having your OU design be led by such a single specific requirement.

We initally had a lot of problems with computers not showing up in WSUS. This case down to the self-update of the Windows Update ckient not working correctly.

What I did was, I added a software installatie policy to the WSUS Target GPO's, that installs the latest version of the Windows Update Agent. Reinstalling the agent cured 99% of all other problems we had. 

To check if I really got em all, I made a vbscript that checks the Windows update client executable version, and the targeted group registry entry. . If its the new version, then I know the server either talked to the WSUS server itself at some point, or at least properly installed the latest version of the client. That covers most of any issues. 

There is always the odd server that refuses to talk to the WSUS server, usually cured with a manual reinstallation of the client if needed. What I did notice though, is that the Windows Update client service sometimes doesnt exit properly, in which case you need to kill the process beforehand.

It sucks that this doesn't exist.  While you can create a GPO for your OU's that point them to the WSUS server and configure settings that way, it's still not quite an integration because several problems still exist:

 1)  If you delete a computer out of active directory, it doesn't remove the computer from your WSUS database.  You have to manually go in and remove it.

2)  If a computer just decides, "I'm not going to talk to WSUS" but doesn't generate errors, it simply doesn't show up in WSUS at all.  It makes it difficult to reconsile  the computers in AD and the computers in WSUS.  Sure you can run an SQL  query against your database and then  compare that list against a list you've exported out of AD, but that is rather cumbersome. 

 Ideally, I'd like to be able to quickly and easily generate reports that tell me what computers are in WSUS but not AD, and what computers are in AD but not WSUS, so that I can quickly identify problems and/or yell at people that replaced a computer but never removed the old computer out of AD...