Wsus Implementation Plan 0909 un70

WSUS Implementation Plan NSF401 – Security Management Practices Sept. 23rd, 2009 WSUS Team Documentation Provided By: Jerry Freeman, Justin Fisher, Tim Rose and Mary Miley

1.

Overview This Implementation plan states the of the best use and practices when istering the WSUS server. This plan will also establish a guideline for recommended controls and safeguards to maintain the quality assurance of the WSUS server to better BSNSF’s mission.

1.1

Purpose This plan will act as a reference for s to ensure they follow best practices on optimizing the security, resource usage and set up of Windows Server Update Service.

1.2

Scope This plan will apply to the NSF WSUS server and the team overseeing its distribution of updates across the BSNSF network to client systems.

2.

Approach The following summarizes how to set up, manage and maintain the best performance out of the WSUS server.

2.1

2.2

WSUS Setup •

When possible, the WSUS network should be configured with the least number of tiers to reduce latency in ing updates.

•

Roaming clients that do not connect to the local intranet should be configured to retrieve updates from the internet facing the WSUS server.

•

More information on ordering for roaming clients configuration can be found in the, WSUS Deployment Guide (http://go.microsoft.com/fwlink/?LinkId=139832).

Resource Usage •

In order to best conserve resources it is important the server s the metadata as it synchronizes updates.

Then ing update files only after the update has been approved.

2.3

2.4

•

Regular use of the Cleanup Wizard will help keep unwanted updates to a minimum.

•

Separate WSUS servers can be implemented for networks with different sets of Microsoft products to limit the product updates on the network.

•

Click Options, click Automatic Approvals, click the Advanced tab, and then click Automatically decline updates when a new revision causes them to expire. Otherwise these will need to be declined manually on a periodic basis.

WSUS Security •

IPsec should be used to secure traffic over the network for WSUS connections. Otherwise SSL can be used on all systems that updates via the internet.

•

The WSUS server should be secured behind a firewall allowing access only to the domains needed by the WSUS.

•

WSUS should not have more file and folder permissions that is required to operate.

•

WSUS s should be able to perform any task needed but have a second group set up for WSUS reporters with read-only access.

Recommendations •

Configure email notifications for when updates become available. This will help in scheduling deployment in advance.

•

Client computers should be able to immediately patch updates that do not require a system restart.

•

When deploying large updates use BITS throttling, IIS throttling and targeting to control the rollout.

3.

Implementation Schedule Task to Perform

Date of Task

Duration Initia l

Confirm OS is installed and updated to current Service Pack Deploy WSUS Choose a WSUS Management style Determine what database software to use Determine where to store Updates Install WSUS 3.0 SP2 Server Configure Network / Proxy Server / Firewall Settings Install Required Software IIS 6.0 / .NET framework 2.0

SOURCES CITED “MICROSOFT WSUS DEPLOYMENT GUIDE”, A UTHOR : ANITA TAYLOR http://www.microsoft.com/s/details.aspx?FamilyID=22395ab7-9234-4effb9fd-48f152459aa2&displaylang=en “MICROSOFT WSUS OPERATIONS MANUAL ”, A UTHOR : ANITA TAYLOR http://www.microsoft.com/s/details.aspx?FamilyID=22395ab7-9234-4effb9fd-48f152459aa2&displaylang=en