Migration from 2003 to 2008R2 - Questions from a first-timer

Question

How is everybody doing. 
I'm managing for the very first time a WSUS server.
Right now there's a WS2003x64 SP2 STD handling this role. The issue is that this server has gotten out of control: MMC crashes all the time due to different causes. For example: when I try to delete more or less 20 PCs it crashes, when I try to run the cleanup
utility it also happens, when this occurs all the actions that were started don't happen and WSUS stays the same.
This made me recommend the option of starting a new server (I've said to use a 2008R2 which I believe will have SP1 installed, don't know if it makes a difference here). Here's my thinking, I'd like to get any recommendation regarding these steps:
1- Install OS and role (with IIS, WID and Report Viewer 2008): do the role automatically install all neccesary tools for report creation and PCs reporting to the WSUS? After that update WSUS to SP2.
The server will use a different IP than the actual.
2- Create all the neccesary Computer Groups: will use a couple of groups for testing and then split all servers and user computers in
Critical (for servers), Download & Choose Install
(for servers), Automatic Install (for servers) and Workstations
(automatic install), Critical Workstations (DL & choose) and use client-side targeting to fill them.
3- Apply GPOs on the OUs hosting each type of computers: here I have a question; can I have the same computer apply to two different WSUS? On my mind the computer status should be the same on both so it shouldn't be a problem.
4- Choose the products and type of updates to syncronize.
5- Start synchronization with Windows Update to retrieve available updates.
And that should be it. Will this work? I guess I'm missing info here regarding implementation, let me know and I'll tell you what my plan is.
Thanks.

Answer 1

When I start synchronizing the server: which updates for approval will show? All the available ones on Windows Update catalog or only the ones that are missing on the computers/servers on our environment?
The Windows Update Agent will flag any update that is Not Installed and could be installed as "Needed". That does not, however, mean that the update should be installed, or that it would be installed even if you approved it.
Rule #1: Do not approve updates that are superseded. That will solve 90% of the issues right off the top.
Rule #2: Do not approve updates that are not listed as "Needed". (You can approve them later if you want them available for future systems.)
Rule #3: Consider approving updates in small to medium quantity batches. I suggest focusing on only Security Updates to start with. As the WSUS server downloads the updates, the clients will start to see these updates as available for installation. If you
approve a large number of updates, the download may take several days. Invariably this results in a client installing small batches of updates over several days, which has a unique tendency to totally annoy the person trying to use the computer to do real
work.
Regarding WSUS functionality: When I approve an update and it installs automatically due to GPO setting the 4th option. Now I have to uninstall it because it crashes an application being used in the company.
This can be a real problem -- which is why the most important part of patch management is TEST TEST TEST. Identify a PILOT group of highly-trusted and aware users for doing your initial deployment. If they don't encounter any issues in 48-72 hours, then
it's appropriate to unleash the updates on the rest of the organization.
When Automatic Updates searches again for new patches, will WSUS push and install the same update again?
Well, that depends. If you identify an update that is defective, the very first thing you should do is decline the update. This will prevent most future installations of the update. Clients that have already downloaded the update will still try to install
it until they discover it has been declined. If the update is declined, and you then uninstall the update, the client will not attempt to install the update again because it does not have an approval. If you don't remove the approval and remove the update,
the client will most definitely attempt to (re)install that update at the next opportunity.
When does it stop pushing updates? Can I configure that?
When you remove the approval for installation via the WSUS console.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.