If you’re like me and have a number of Windows PCs at home, and dread the time and bandwidth that is spent running Windows Update on each “patch Tuesday”… there is a solution! Set up a WSUS (Windows Server Update Services) server, download & cache the updates once, then enjoy downloading updates fast from your LAN.
WSUS is intended for PCs on a domain, under Active Directory. However, it is possible to use it without a domain controller of any kind, and without Active Directory. All you need is a machine to run WSUS (3.0 SP2 in this case), a LAN, and a few dozen GBs of extra storage space.
First, download WSUS 3.0 SP2 from Microsoft, and install it. The step-by-step wizard will guide you through the process and allow you to decide with products you would like to receive updates for, and for which languages. I suggest enabling auto-approval rules in the Options menu, so that you don’t have to manually approve each and every update every time.
Once WSUS is configured, and synchronization is complete, you’ll have to configure each machine to receive updates from your WSUS server. The easiest method is to use the Local Group Policy editor in Windows. The entries you need to edit are located in Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Update (see below for what values need to appear there). However, if you are using Home versions of XP/Vista/7, you may not have access to the Local Group Policy editor. In that case, you must manually make the following changes to the registry:
- Launch Regedit from Start > Run, and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
First and foremost, right click on the “Windows” folder (key) on the left side, and click “Export”. This will back up this section of the registry, so that if you break something you can change it back to the way it was (aka working).
- Create the “WindowsUpdate” key in “Windows” if it does not exist. Most likely, it will not exist.
- Also create the “AU” key in “Windows Update” if it does not exist. Again, it probably won’t be there already.
- You should now have the following path in existence (and listed at the bottom of regedit): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
- Move up one directory, to just the WindowsUpdate key. Create the following entries:
Create a DWORD named AcceptTrustedPubliserCerts with value 1
String named WUServer, value http://YOURSERVER (put your server’s IP address or DNS name here)
String named WUStatusServer, value the same as above (http://YOURSERVER)
- Navigate into the AU key, and create the following entries:
DWORD named EnableFeaturedSoftware, value 1
DWORD named IncludeRecommendedUpdates, value 1
DWORD named UseWUServer, value 1
- Restart the computer.
- Launch Windows Update, and check for updates. If your server is configured correctly, has finished synchronizing and downloading all updates (make sure they are all approved!), the computer should receive updates internally now!