In the previous posts, we have seen the Installation and Configuration of the WSUS on Windows Server 2019. In this article, we will see how to configure client-side targeting in the WSUS server 2019.

Overview:

WSUS allows you to direct updates to groups of client computers. This capability can help you ensure that specific computers get the correct updates at the most convenient times continuously.

By default, each computer is already assigned to the All Computers group. Computers will also be assigned to the group of unassigned computers until you assign them to another group. Regardless of the group to which you assign a computer, it will also remain in the All Computers group.

Note: A computer can be in only one other group in addition to the All Computers group.

You can assign computers to computer groups by using one of two methods, server-side or client-side targeting, depending on whether or not you want to automate the process.

Server-side targeting:

With server-side targeting, you use the WSUS console to both create groups and then assign computers to the groups.

Client-side targeting:

With client-side targeting, you enable client-computers to add themselves to the computer groups you have created in the WSUS console using group policy.

Test lab setup:

  • WS2K19-DC01.mylab.local: Active Directory Domain Services with DNS
  • WS2K19-WSUS.mylab.local: WSUS server
  • WS2K19-SRV01.mylab.local: Member server

Create a computer group in the WSUS console:

Open the WSUS console and look under Computer > All Computers, you will see one default computer group called Unassigned Computers.

By default, there are two computer groups, All Computers, and Unassigned Computers. Besides the default groups, you can create as many computer groups as you want.

1 Verify existing computer groups

Right-click All Computers, and then click on Add Computer Group.

2 Add New Computer Group

In Group Name, type a name for your new computer group, and then click Add. For example: “2K19Servers”.

3 Type a name for new computer group

To use either client-side targeting or server-side targeting, you must set the options in the WSUS console.

Click on Options.

4 Click on Options

Click on Computers. A new window pops up.

5 Click on Computers

On General tab, choose Use Group Policy or registry settings on computers.

6 Use group policy or registry settings on computer for client-side targeting

Click Apply and OK.

Now we will enable the client-side targeting through the group policy. 

Create a Client-side targeting GPO:

On Domain Controller, open Server manager console.

Click on Tools, and select Group Policy Management.

7 Open group policy management console

In the previous post, we have created one GPO named “Test WSUS GPO” to apply the WSUS related settings. We will use the existing GPO to setup the client-side targeting settings. 

Right-click the WSUS Update Policy, click Edit.

8 Edit the GPO

Navigate to Computer Configuration > Policies > Administrative templates > Windows Component > Windows Update.

Double-click on Enable Client-side targeting policy.

9 Double click on Enable Client-side Targeting policy

Click on Enabled and in the Target group name for this computer field, type the name of the group which we have created earlier.

Click Apply and OK.

10 Type name of computer group

Close the group policy editor console.

By default, Group Policy refreshes in the background every 90 minutes, with a random offset of 0 to 30 minutes. If you want to update Group Policy sooner, you can go to a command prompt on the client computer and type: gpupdate /force.

11 Manually update the group policy on client

If everything works properly, the computer account of our member server will appear under the computer group name 2K19Servers in the WSUS console.

12 verify the result of client-side targeting policy in wsus

I hope this article will be helpful. Thank you for reading.

Related Articles: