SUS and Group Policy

[fish]

Been trying to install SUS today and get it working. I've read the white paper and got SUS Server working and I've changed the group default policy to have updates and I've configered them. How long does it take for a client machine to pick up the group policy as amended and is there anything I can do to force it.

Any thoughts??

[pebbledash]

fish said:

Been trying to install SUS today and get it working. I've read the white paper and got SUS Server working and I've changed the group default policy to have updates and I've configered them. How long does it take for a client machine to pick up the group policy as amended and is there anything I can do to force it. Any thoughts??

is this the active directory group policy or one, limited to SUS

[fish]

Active directory domain policy.

[pebbledash]

There is no exact answer. (that I can remember or find) but i seem to recall about 15 mins is the default, I will try and check

but the good news is that it is configurable

it can be found in the Grop policies under:-

Computer Configuration\Administrative Templates\System\Group Policy

and

User Configuration\Administrative Templates\System\Group Policy branches;


however, it can also be directly set in the registry..



HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System to set Computer refresh.

Or,

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System to set User refresh.


Create a DWORD value with a name of GroupPolicyRefreshTime, and set it to a number between 0 and 648000 minutes.

Create a DWORD value with a name of GroupPolicyRefreshTimeOffset, and set it to a number between 0 and 1440 minutes. (this offset prevents many clients from trying to refresh at the same time.)


>> Edited by pebbledash on Monday 27th September 14:39

[pebbledash]

ok.

By default the Refresh time is as follows:-

workstations and member servers 90 min... (oops not 15 )
domain controllers are 5 mins

the refresh offsets are default at:

0 for domain controllers
30 mins for member servers.

so the actual time for ALL workstations to commit a change could in theory be 2 hours.. 90Mins + 30Mins

[fish]

thanks I'll wait a bit longer rather than muck it up more.

Hopefully it'll work then.

[pebbledash]

fish said:

thanks I'll wait a bit longer rather than muck it up more. Hopefully it'll work then.

obviously a re-boot makes it imediate, or if you are on the Machine you can Force and update

secedit /refreshpolicy machine_policy

and/or

secedit /refreshpolicy user_policy

an /enforce switch on either forces an update even if there are no changes



>> Edited by pebbledash on Monday 27th September 15:16

[fish]

Policy has worked now to leave some PC's on tonight and see if the updates work....