Applying Different Product Classifications To Different Groups

Question

Sorry if I'm missing the obvious here, but I see no way of applying different product classification updates to different groups of PCs either through WSUS or through GPOs.
Originally in my environment we had one WSUS policy which my predecessor had rolled into the Default Domain Policy.  In an effort to get away from this, and also to manage which types of updates get applied to which systems (critical and security updates
for some, and all updates to others) I created two new GPOs: WSUS > All Updates and WSUS > Selective Updates.
However, in configuring the GPOs I realized there is no way to designate the types of updates that are/aren't approved.  So I went back to WSUS, and under the Options screen I opened 'Products and Classifications' and then switched to the 'Classifications'
tab.  So here I can select/de-select individual update types, but there's no way for me to turn them on/off granularly.  In other words, this seems to be a global setting.
So my question is this: How do I set up WSUS to automatically approve and install *only* security and critical updates for one group of systems, and automatically approve and install *all* updates for another group of systems?  Do I need to use GPOs
in tandem with WSUS, or can WSUS do it on its own?  Where would I go to configure something like this.
Sorry for the detail, but I'm really not seeing anything obvious anywhere and I can't believe I'd have to build a secondary WSUS server just to set up multiple classification groups.
Thanks,
Bob

Answer 1

Sorry if I'm missing the obvious here, but I see no way of applying different product classification updates to different groups of PCs either through WSUS or through GPOs.
That's because you don't. The WSUS server has one repository of updates, defined by Product Category, Update Classification, and Language. Updates are then targeted to computers by placing computers in a target group and approving an update for
that target group. All computers in the target group will evaluate each approved update, and if the update is installable, the computer will download and install the update.
Originally in my environment we had one WSUS policy which my predecessor had rolled into the Default Domain Policy.  In an effort to get away from this, and also to manage which types of updates get applied to which systems (critical and security updates
for some, and all updates to others) I created two new GPOs: WSUS > All Updates and WSUS > Selective Updates.
So, all you really did here was declare two different WSUS Target Group(s). How you actually apply those GPOs to your client systems will determine which of either, or both, groups that a client system is a member of.
How do I set up WSUS to automatically approve and install *only* security and critical updates for one group of systems
You create an Automatic Approval rule to approve Security Updates and Critical Updates for THAT GROUP. (e.g. the "Selective Updates" group).
and automatically approve and install *all* updates for another group of systems?
You create an Automatic Approval rule to approve ALL update classifications for the "All Computers" group (note that you don't even need your "All Updates" group, you only need the "Selective Updates" group).
I will also take the moment here to severely warn you that approving ALL UPDATES for ALL COMPUTERS is a very dangerous thing to do, and frankly you don't even need a WSUS server to do that. Just enable Automatic Updates on the system and let 'em get their
updates from Microsoft directly and you'll have exactly the same behaviors with a lot less administrative overhead.
Additionally, based on the nature of the questions in this post, I would encourage you to thoroughly review these two resources in TechNet:
Understanding Patch and Update Management: Microsoft's Software Update Strategy
Manage Windows Server Update Services 3.0 SP2 in the WSUS Operations Guide
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.