Here’s a very good blog post I came across with some WSUS best practices for anyone else looking to implement WSUS for the first time or review your patching strategies.
“Consultants should take time to test the patches in a non-production environment prior to being deployed to production. This will help to gauge the impact of such changes. Ideally you will have the following patching groups:
1. UAT (UAT1, UAT2, etc)
2. Test Environment (Test1, Test2, etc)
3. Development Environment (Dev1, Dev2 etc)
4. Production (Prod1, Prod2, etc)
If you have clustered environment like SQL, Exchange and SharePoint then create Prod1, prod2 group and place each node on each group. “
“System administrators should maintain a log, written or electronic, of all changes to the operating environment, to include hardware, system security software, operating system, and applications. Prior to any changes being implemented on a system, the system administrator should receive approval of stakeholders.”
“A scheduled maintenance window must be agreed with business so that application outage and server reboot can maintain a respectable Service Level Agreement (SLA). If you have a large infrastructure with thousands of servers and many regions working round the clock then you must consider application dependencies. A patching schedule can be considered in between every Friday of every month at 6:00 P.M. Friday to 6:00 A.M Monday. Setup maintenance window in system center or deadline for WSUS to make sure patches are applied when you want instead of when patch is available. In this way you will have a complete control over change windows approved by change advisory board (CAB). Do not allow end users to update patches on their client machine according to their wishes and happiness! then user will never install any patch. “
“Microsoft strongly recommends that you create the following backups before you install an update rollup, service pack and patch on Exchange and SQL:
- A full backup of all databases on the server.
- A full backup of transaction log and log backup
- A system state backup of the server.
- A snapshot of virtualized exchange server. Delete snapshot after successful patching and updating. “
Here are some other useful resources for WSUS:
- Best Practices with Windows Server Update Services 3.0
- Determine WSUS Capacity Reuirements
- Configure Automatic Updates by Using Group Policy
- How to Configure a Firewall for Software Updates
- How to Configure Automatic Approval Rules for Forefront Definition Updates
- WSUS 3.0 SP2 Security Settings
- Windows Server Update Services 3.0 SP2 Deployment Guide