WSUS Question...

Matt-Page · 28 Oct 2013 at 17:42

Hi,

In work I need to find out what workstations/servers are not connected to, or have never reported in to our WSUS server. We believe we have a number of devices that are not connected to our wSUS server but need to know if there is a tool that will look at everything in AD, or via a IP range and report back what is not configured for WSUS.

Anyone done this or similar before?

Ta

Bry · 28 Oct 2013 at 18:19

Can you not just export a list of all computers in WSUS
Export a list of all computer objects in the domain

Then do a quick comparison via excel?

Hellsmk2 · 29 Oct 2013 at 09:00

As above... Bang both lists into excel, and use the remove duplicates function.

Matt-Page · 29 Oct 2013 at 09:18

Unfortunately we have numerous domains and I'm not convinced all computers have been joined to a domain.....

I'm fairly new here so I'm trying to sort a few things out, but there is a lot of debris.

We've got a tool called Solarwinds Patch manager, not sure if that is capable of such a task?

Hellsmk2 · 29 Oct 2013 at 13:36

You've got no easy way of doing it - if you have multiple domains you should be able to use the methods mentioned above to work out which aren't covered by your existing WSUS server(s). Easiest way to update the then is group policy.

I'd probably also set up a script to force computers to re-register with your update server and roll that via the same GP you implement for your WSUS client settings (bat file with "wuauclt.exe /resetauthorization /detectnow" should do the trick).

For your non-domain machines, I'm afraid that'd be a more manual process. I'd probably go down the route of using a reg file on each non-domain computer to force it to use the WSUS server. Loads of examples on the web:

http://community.spiceworks.com/topic/128245-updating-computers-using-wsus-without-joining-a-domain

[Edit] I wouldn't bother working out what isn't be updated - just go straight for the group policy route combined with a script to force clients to re-register, and test it on a couple of servers/ clients. If your policy is right, any problem servers will start reporting in without any further intervention.