WSUS Set client default download location

Meeee 141 Reputation points
2021-10-20T14:02:00.517+00:00

I am in the process of setting up a new WSUS server on windows 2019, I have set the server up and am looking at GPO options. We run a multi office environment which includes a lot of mobile people.

I was wondering is there a way to get configure the desktops / laptops to check the WSUS server for which updates they are allowed to install but to get them to pull the updates down direct from the intranet instead. Looking at the GPO options I have to set -
“Set intranet update service for detecting updates” & “Set the intranet statistics server” both to the new server, I am guessing this will then tell the workstations to check and then pull the updates from these servers?

Is there a way to check the server but pull direct from MS?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,083 questions
0 comments

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rita Hu -MSFT 9,626 Reputation points
    2021-11-02T09:02:57.37+00:00

    @Meeee
    I agree with @Adam J. Marshall

    Please tick the below option on the WSUS console. Then the clients will connect to the Internet to get the approved updates when the clients scan for updates from WSUS.
    145737-1.png

    It seems that it is a helpful solution. Please have a try if the issue haven't been resolved. Please don't forget to accept the helpful solution as an answer if the issue has been resolved. It will be helpful the others to save time researching.

    Thanks for your time and wish you have a nice day :)

    Regards,
    Rita

    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments
  2. Adam J. Marshall 8,621 Reputation points MVP
    2021-10-20T14:22:16.237+00:00

    You will want to check out my blog regarding this.

    https://www.ajtek.ca/wsus/externally-facing-wsus-servers/

    0 comments
  3. Meeee 141 Reputation points
    2021-10-20T15:38:10.29+00:00

    Thanks for the info, so basically I need to set up an additional server in the DMZ and then get the Workstations to pull the updates from here? There is no way for them to talk to the internal server via a VPN then pull the updates directly from microsoft updates rather than them pulling them from the internal server?

  4. Meeee 141 Reputation points
    2021-10-21T08:14:07.967+00:00

    Thanks, very helpful.
    just out of interest how can I set the WSUS server to - "You can set WSUS to not store updates and ALL updates download from Microsoft - both internal and external connections/vpn"

    Most of our staff are external so as long as they query the WSUS server for which updates are approved but download them directly from MS that would be fine.

    0 comments