Migration from Software Update Services to Windows Server Update Services Jeff Alexander IT Pro Evangelist Microsoft Australia Scott Korman WSUS MVP SEC316

Our time today Review WSUS Capabilities WSUS Demo Migration Scenarios ConsiderationsTools Migration Demo

WSUS continues to support… Single server Multiple servers Autonomous vs. Replica Client policy settings Language selection Download only update descriptions – binaries stay on Windows Update Microsoft Windows updates

New WSUS Capabilities Solution and infrastructure Target groups (Client or Server) Port configuration (not just 80) Detect only evaluation More products (Microsoft Windows and other Microsoft products) Update classifications selection Download updates to server only after approval (default) Reporting New client policy settings

New Client Configurations Polling frequency Target group Reboot behaviors Allow local admin to configure AU settings except for disable Non-administrators can install updates (like administrators) Update at shutdown (Microsoft Windows XP SP2 and later only)

WSUS Review

Migration …

Migration Scenarios Single server WSUS and SUS 1.0 on a single server Multiple servers WSUS and SUS 1.0 on separate servers Multiple SUS 1.0 servers to a single WSUS server Multiple SUS 1.0 servers to multiple WSUS servers

Environment Considerations Ease of updating client settings E.g., policy or scripted New clients coming into environment which are not yet WSUS compatible Branch office scenarios Targeting group model

Migration Considerations WSUS and SUS 1.0 can not synchronise metadata with each other Only one way SUS 1.0 to WSUS migration Migration of update approvals overwrites any pre-existing approvals per target group What doesn’t migrate proxy server settings Internet Information Services (IIS) settings

Single Server Migration For customers with few servers Requires WSUS to be initially installed on a different port than SUS 1.0 Requires updating all clients as they connect once the WSUS server is installed Potentially requires redirecting clients to a different port on the same server Clients will still use SUS 1.0 for updates until redirected to the WSUS port, or SUS 1.0 is decommissioned

SUS 1.0 server WSUS server SUS client Single Server Migration WSUS server SUS 1.0 server WSUS client SUS client directed to port 8530 WSUS client directed to port 8530 WSUS server Port 8530 WSUS selfupdate tree Port 80 SUS selfupdate tree Port 80 WSUS selfupdate tree WSUS client directed to port 8530 A C

Separate Server Migration More flexibility in client self update deployment options More flexibility in configuring the server port Clients continue to use SUS 1.0 until client policy changes to point to new WSUS server Requires another Windows Server

SUS 1.0 server Separate Server Migration WSUS server Port 80 SUS selfupdate tree Port 80 WSUS selfupdate tree SUS client WSUS client SUS client WSUS client A C

Multiple SUS server migration To a single WSUS server Take advantage of target groups Consolidate Windows Servers To multiple WSUS servers Maintain organisational structures with different administrators Support branch offices

SUS 1.0 server Multiple SUS Server Migration Port 80 SUS selfupdate tree WSUS server Port 80 WSUS selfupdate tree SUS client WSUS client “Test” SUS client WSUS client “Test” SUS 1.0 server Port 80 SUS selfupdate tree SUS client WSUS client “Production” Production target group Test A C A C

What are the Migration capabilities Enabled through the Migration tool Content and approvals to all computers group Content and approvals to a specific target group Content only Approvals only Remember … Tool is in %programfiles%\Update Services\Tools You must synchronise your WSUS server before using the migration tool Tool must be run on the target WSUS server

Migration Tool WSUSUTIL.EXE migratesus /content /content Migrate content from a SUS 1.0 Migrate content from a SUS 1.0 /approvals /approvals Migrate approvals from the SUS 1.0 server “target_group” Apply approvals to the target group "target_group". Requires /approvals to be specified. /log /log Log the migration activities to the file

Content and Approvals to All Computers Group Syntax: wsusutil.exe migratesus /content path_to local_SUS_content /approvals SUSserver name /log filename Example: wsusutil.exe migratesus /content c:\sus\content\cabs /approvals sus1 /log local_migration.log

Content and Approvals to a Specific Target Group Syntax: wsusutil.exe migratesus /content path_to local_SUS_content /approvals SUSserver _name "WSUS_target_group name" /log filename Example: wsusutil.exe migratesus /content c:\sus\content\cabs /approvals sus1 "all desktops" /log local_migration.log

Content Only Syntax: wsusutil.exe migratesus /content path_to local_SUS_content /log filename Example: wsusutil.exe migratesus /content c:\sus\content\cabs /log local_migration.log

Approvals Only Syntax: wsusutil.exe migratesus /approvals SUS server_name /log filename Example: wsusutil.exe migratesus /approvals sus1 /log local_migration.log

Migrate Approvals Scott Korman WSUS MVP

WSUS Resources WSUS homepage: WSUS Server download Deployment and Operations Guides SDK and Troubleshooter Online Documentation Newsgroups Microsoft Update:

WSUS Community Resources Support Forums: Wiki: List:

Reporting Rollup Tool Status data merged on central server Sample tool using WSUS API To be released by Monday

We invite you to participate in our online evaluation on CommNet, accessible Friday only If you choose to complete the evaluation online, there is no need to complete the paper evaluation Your Feedback is Important!

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.