Block WSUS 3.0 Install

Hi

I have a downstream W2K3 Enterprise Server running Windows Update Services
2.0, with most up to date SP (which I think is actually 2.5). I need to block
the v3.0 update from installing. Microsoft decided to make v3.0 incompatible
with v2.0, and the WSUS administrators for my upstream WSUS servers are
pushing v3.0 despite them using v2.0. So, if my system installs WSUS 3.0 then
I will be unable to sync with the upstream server.

Isnt there a registry fix or something that I can do to block the WSUS 3.0
upgrade? I also know that Microsoft put out a program that enables admins to
block XP SP3, and W2K3 SPs, maybe they created one for WSUS that I couldnt
find?

Thanks for the help!!!
-B

Brandon Rumer wrote:
:: Hi
::
:: I have a downstream W2K3 Enterprise Server running Windows Update
:: Services
:: 2.0, with most up to date SP (which I think is actually 2.5). I need
:: to block the v3.0 update from installing. Microsoft decided to make
:: v3.0 incompatible with v2.0, and the WSUS administrators for my
:: upstream WSUS servers are pushing v3.0 despite them using v2.0. So,
:: if my system installs WSUS 3.0 then I will be unable to sync with
:: the upstream server.
::
:: Isnt there a registry fix or something that I can do to block the
:: WSUS 3.0 upgrade? I also know that Microsoft put out a program that
:: enables admins to block XP SP3, and W2K3 SPs, maybe they created one
:: for WSUS that I couldnt find?
::
:: Thanks for the help!!!
:: -B


Perhaps try the WSUS Newsgroup

On the web:
http://www.microsoft.com/communities... date_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services

Xposted for your convenience.

> Brandon Rumer wrote:
> :: Hi
> ::
> :: I have a downstream W2K3 Enterprise Server running Windows Update
> :: Services
> :: 2.0, with most up to date SP (which I think is actually 2.5). I need
> :: to block the v3.0 update from installing. Microsoft decided to make
> :: v3.0 incompatible with v2.0, and the WSUS administrators for my
> :: upstream WSUS servers are pushing v3.0 despite them using v2.0. So,
> :: if my system installs WSUS 3.0 then I will be unable to sync with
> :: the upstream server.

Taking your words at face value, and not presupposing any misunderstanding
on what's actually happening in your environment....:

Why is your WSUS server obtaining updates for *installation* from an
*UPSTREAM* server? Your WSUS Server should be obtaining updates from it's
own metadata/content, at which point *you* would be deciding whether that
update is approved or not, unless its a replica in which case you have no
voice in the matter anyway.

Second, posting here won't help. Trying to 'block' the installation isn't
possible. The responsible thing to do is to educate the "WSUS
administrators...pushing v3.0" that the product *requires* the upstream
servers to be upgraded first.

If they won't listen, then straighten up your spine and go over their head
to somebody who will listen, pointing out that their practices are about to
break the entire enterprise-wide patching system.

One other note: Because of the several and dozen possible things that can go
wrong in an upgrade from WSUS v2 to WSUS v3 I cannot emphasize strongly
enough how much I discourage upgrading WSUS v2 to WSUS v3 using the
WSUS_distributed installer.

My suggestion would be to install the WSUS 3.0 SP1 package from the
downloaded executable AFTER reading the Release Notes TWICE. Then remove
your dependence on the 'upstream' server (which, as you've noted, if it's
WSUS v2 will be useless to you anyway), and point your newly upgraded WSUS
3.0 server direct to Microsoft.com for synchronization.

Note: WSUS 2.0 will quit synchronizing new content in April, 2009; so
upgrading is a near term necessity. Be the only guy in the organization with
a working WSUS Server.



--
Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Thanks for the help.

I have a replica WSUS Server.

I did talk to the WSUS admins who run the upstream servers. They said what
you would expect, "we didn’t approve it." If they weren’t on another
continent, I would totally throat-throttle them.

And yes, you were right. I guess it would download content from its own
database/content, wouldn't it?

Thanks for the suggestions on the upgrade to 3.0 SP1. I will definitely
follow them when I get to that point.

For now, it looks like the v3.0 SP1 is erroring out when it tries to install
via Scheduled Automatic Updates, so no worries. The v2.0 is still working,
and intact. I wish I would have the time to manage a WSUS server (and do away
with the replica), but for now, this works.

Much thanks!

[To keep track of things, it helps immensely if you include all of previous
message(s) in your replies to the newsgroup. Thank you.]

Brandon Rumer wrote:
> Thanks for the help.
>
> I have a replica WSUS Server.
>
> I did talk to the WSUS admins who run the upstream servers. They said what
> you would expect, "we didn’t approve it." If they weren’t on another
> continent, I would totally throat-throttle them.
>
> And yes, you were right. I guess it would download content from its own
> database/content, wouldn't it?
>
> Thanks for the suggestions on the upgrade to 3.0 SP1. I will definitely
> follow them when I get to that point.
>
> For now, it looks like the v3.0 SP1 is erroring out when it tries to
> install
> via Scheduled Automatic Updates, so no worries. The v2.0 is still working,
> and intact. I wish I would have the time to manage a WSUS server (and do
> away with the replica), but for now, this works.
>
> Much thanks!