WSUS - Auto Download and Schedule Install

Question

Hey, so I have a couple questions regarding WSUS:  
1. Can computers be set to daily check for updates from an internal WSUS server and download them without installing, and then automatically install those
updates at a different, scheduled time, whether they are connected or not?  (I see the GPO called "Automatic Updates detection frequency"
that I can configured, but it doesn't say whether updates are downloaded during this operation or not) 
2. Can computers be configured so that
they will download updates from an internal WSUS server first and if it's not available, then reach out to Microsoft?

Answer 1

So that would mean the answer to my initial question is No.  I want an option called "Auto download and install at scheduled time".  
Let me clarify how this all works.
The Windows Update Agent periodically checks the WSUS server for updates. Updates it finds, it reports state for: Installed, Not Installed, Not Applicable. If a "Not Installed" update is approved and available, the WUA queues the installation files
for download if the Configure Automatic Updates policy is set to AUOption '3' or '4'.
The download occurs via Background Intelligent Transfer Service (BITS) subsequent to the WUA finding the update as available for download.
When the download of the update is completed, the WUA does one of two things:
If the Configure Automatic Updates policy is set to AUOption '4', then the WUA will schedule the update for installation at the scheduled time. This scheduled installation does NOT require access to the WSUS server to be conducted.
If the Configure Automatic Updates policy is not set to AUOption '4', then the update will be retained on the client computer until a user launches the Windows Update applet from Control Panel and initiates the installation.
If the Configure Automatic Updates policy is set to AUOption '2', then the files will not be downloaded, and a logged on user must initiate the download using the Windows Update applet in Control Panel. This setting is typically used for highly mobile
computers that have only sporadic connections to the network servicing the WSUS server.
The downloading of files using BITS can be controlled using the BITS download policies in Group Policy. You can restrict the bandwidth used for downloads (per client) and/or restrict when those downloads are performed. Ergo, if you want downloads to
occur at 8pm each night, simply block the ability to download files prior to 8pm.
Please note, however, that the files MUST be completely downloaded BEFORE a scheduled installation event for the updates to be installed at that event, and the amount of time required to complete those downloads is highly unpredictable and will change from
month to month and client to client.
Finally, there is one last possible methodology, but this one is fraught with much risk. You can configure clients with AUOption '2', so they do not automatically download update files upon discovery. Then configure an Approval Deadline at the time you want
those updates to be installed. In this scenario, and ONLY this scenario, when the client reaches the Approval Deadline, it will automatically download -and- install the updates that have deadlines configured. In addition, this methodology also gives you some
capability to configure the *DAY* that updates are installed, not just the time. However, as several threads in this forum will attest, there are MANY opportunities using deadlines for things to go sideways. Be sure to anticipate ALL POSSIBLE scenarios before
initiating the use of Approval Deadlines, and more importantly! TEST! TEST! TEST! prior to implementing this methodology throughout the entire organization.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.