WSUS and domain controllers

Question

Has anyone arrived at a good GPO(s) for domain controllers to be updated by WSUS? Of course, one in which only half of the domain controllers at each facility receive the updates at one time and another half at a separate time.

Answer 1

Has anyone arrived at a good GPO(s) for domain controllers to be updated by WSUS? Of course, one in which only half of the domain controllers at each facility receive the updates at one time and another half at a separate time.
Well... the conventional wisdom is that Domain Controllers should not have automated installs, but rather monitored installs. So... AUOptions = '3', and a human being to launch the installs and monitor the reboot at a time when appropriate with consideration
to the other Domain Controllers.
However, if you must *schedule* these things, then you'll have to use Active Directory Security Group Filtering, create TWO GPOs for the Domain Controllers OU, and filter one GPO to one half (via Security Group 'A') and filter the other GPO to the other
half (via Security Group 'B').
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.