Windows 10: WSUS and Definition Updates

In an environment that uses an application such as Citrix or Horizon and the machines are temporary and therefore do not auto patch through WSUS base image is patched on a regular basis but Defender updates are needed is the proper configuration within WSUS to auto approve only Definition Updates from specific classification or do you also need to select a specific product such as Microsoft Defender Antivirus?

:)

 

WSUS updates and defender definition updates problem with W10 LTBS 1607

Hello,

Environment

A number of windows 10 PRO are running and WSUS properly provides updates for them.

Recently a number of Dell 5070 WES clients with preinstalled W10 IOT (current version is W10 LTBS 1607 Enterprise edition) have been deployed.

Settings for WSUS

In products list:

In addition to other W10 editions selected W10, W10 LTBS and a number of other versions. I also selected Windows Defender.

In classification:

Selected Critical Updates, Definition Updates, Security Updates, Service Packs, Updates Rollups, Upgrades.

Definitions updates are set to be automatically approved.

W10 LTBS updates and definitions

WSUS recognizes Wyse 5070 devices as Windows 10 Enterprise 2016 LTBS but It does not show any current failed/needed updates for these devices Defender defenitions updates are not being deployed.

Online updates with Microsoft does work: patches/updates can be downloaded and installed and defender definitions are applied automatically.

 

The WSUS support thread

This thread is for all things WSUS (Windows Server Update Services). Discussion, installation questions, problems all go here.

What is WSUS? It's basically a big file cache for all your Windows/Microsoft updates, so all your updates are only ever downloaded over the internet once. Instead of getting your updates directly from Microsoft whenever you reinstall your operating system, you point Windows to your local WSUS server instead. This makes downloading the multi-gigabytes of updates way faster using your internal network and also saves your internet bandwidth, which is often metered and limited.

Note that it requires Windows Server to run. I recommend running the latest Server 2008 R2 for performance, stability and security, if you can. This is a 64-bit only OS. And yes, the server can update from it's own WSUS server too. *Cool

I've got links to a few resources below and I'll be adding more goodness to this post and the next one, as people make useful contributions to this thread.

Some WSUS resources to get you started:

The manual: http://technet.microsoft.com/en-us/library/dd939796(WS.10).aspx

WSUS home: http://technet.microsoft.com/en-us/wsus/default.aspx

WSUS forum: Technet forums - WSUS

WSUS wiki: www.wsuswiki.com


POINTING WINDOWS TO THE WSUS SERVER

Note that this procedure is all you have to do on Vista and 7. XP requires a little extra and the whole update process isn't as transparent or efficient.

- Click the Orb at the bottom left of the desktop aka 'Start' button
- In the search field enter GPEDIT.MSC
- In the Local Group Policy Editor (LGPE) console that appears, navigate to: Computer configuration > Administrative Templates > Windows Components > Windows Update
- Double click the Specify Intranet Microsoft update service location Group Policy setting. Note that Not Configured is showing in the State column






- The dialog box opens. Note that the Not Configured radio button is selected






- Enter the server details, by clicking the Enabled radio button and entering the same details in both Options fields. The server's name is the standard Windows name. My server is called afterburner *Smile






- Click OK. The main LGPE window now looks like below. Note that Enabled is now showing in the State column.





- Close the LGPE window

- Open the Windows Update window. It should now show You receive updates: Managed by your system administrator





Now, whenever you check for updates, Windows will access your WSUS server instead of looking over the internet to Microsoft's servers.
If you want to change it back at an time, simply change the Group Policy setting back to Not Configured.

 

definition update for windows denfender antivirus

Hi mknic,
I have literally just installed the definition update KB2267602 without any problem. I suggest as a first step checking all the Windows Defender settings to make sure they all have the 'green ticks' in each section.






ps. The only reason the 'Family Options' is not ticked is because I am the only user on my computer.

I also would suggest running the 'Troubleshoot' feature in the Update & Security settings which has a section dealing with update problems.