Exercises 18.1. Performing an immediate synchronization The server that runs WSUS is configured to synchronize weekly on Saturday at 12:00 p.m. Because of a virus outbreak, a critical update was released today. You need to manually update the WSUS server. Estimated Time: 20 minutes. 1. | Enter http://servername/SUSAdmin in your web browser. This opens the WSUS Administration web page.
| 2. | In the upper-right pane of the web page, click the Options icon.
| 3. | From the Options page, select the Synchronization Options icon.
| 4. | On the Synchronization Options page, click the Synchronize Now icon.
| 5. | The updates are downloaded to your WSUS server. This might take a while depending on the options you've selected and the number of updates currently available. A progress bar is displayed to indicate the progress.
| 6. | When the synchronization with the Microsoft Update site is complete, click the OK button.
|
18.2. Running a computer status report One of your remote users reports that she's having trouble connecting to a VPN server. You suspect that her computer didn't receive a recent hotfix. How can you verify this? Estimated Time: 20 minutes. 1. | Enter http://servername/SUSAdmin in your web browser. This opens the WSUS Administration web page.
| 2. | In the upper-right pane of the web page, click the Computers entry.
| 3. | From the Computers page, select the computer that was supposed to receive the hotfix.
| 4. | Click the Print Status Report icon; this will print a report showing every update installed by WSUS on the client computer.
|
Exam Questions | 1. | You are the lead administrator for a large manufacturer of farm machinery and related parts based in the upper Midwest. Your company has several small manufacturing plants spread out over a five-state area. Most of the end users are not computer savvy, so the client computers are somewhat locked down. All clients are running Windows XP, and all servers are running Windows Server 2003. The manufacturing plants are connected to headquarters via T1 lines in a hub-and-spoke configuration. Because of the large number of updates and security fixes that Microsoft is releasing on a regular basis, your staff is becoming overwhelmed with the workload of updating the client computers in the remote locations. You need to identify an automated solution to assist you in keeping your clients up-to-date. What do you do? (Pick two.) 
| A. | Install a Software Update Service (SUS) server in the HQ location. Configure the SUS server at HQ to synchronize with the Microsoft Windows Update website. |
| B. | Install a Software Update Service (WSUS) server in the HQ location. Configure the WSUS server at HQ to synchronize with the Microsoft Update website. |
| C. | Configure the clients to receive and install updates from the SUS server. |
| D. | Configure the clients to receive and install updates from the WSUS server. |
| E. | Configure the clients to receive and install updates from the Microsoft Update website. |
| | | | 2. | You are the system administrator for FlyByNight Airlines. Your network consists of a single Active Directory domain, with all servers running Windows Server 2003 and all clients running Windows XP Professional. You need to install Windows Server Update Services on a spare server named FlyBy1. FlyBy1 has a minimum amount of free hard drive space available, but you have no other servers, and your clients need to install several critical updates. What should you do?
| A. | On FlyBy1, make sure that only the locale used is selected. |
| B. | On FlyBy1, select the option to allow updates to be stored on Windows Update. |
| C. | On FlyBy1, select the option to allow updates to be stored on Microsoft Update. |
| D. | Modify the default home page for all clients to http://windowsupdate.microsoft.com. |
| | 3. | You are the system administrator for FlyByNight Airlines. Your network consists of a single Active Directory domain, with all servers running Windows Server 2003 and all clients running Windows XP Professional. You need to implement a solution for managing security updates on client computers. You plan to use a Windows Server 2003 computer to manage security updates. Your solution for managing security updates must meet the following requirements: Security updates must be installed automatically. You must be able to control which updates are available to install. Security updates must synchronize automatically with the latest updates offered by Microsoft.
You need to implement a solution for managing security updates that meets the requirements. What should you do?
| A. | Publish the security updates by using a Group Policy object (GPO). Assign the GPO to the client computers that require updates. |
| B. | Install Windows Server Update Services (WSUS). Configure the WSUS software to synchronize daily with Microsoft. Use Group Policy to configure the appropriate Windows Update settings on the client computers. |
| C. | Install Microsoft Internet Security and Acceleration (ISA) Server on a Windows Server 2003 computer. |
| D. | Create a process to run Windows Update on all client computers. |
| | | | 4. | You are the lead administrator for a large manufacturer of farm machinery and related parts based in the upper Midwest. Your company has several small manufacturing plants spread out over a five-state area. Most of the end users are not computer savvy, so the client computers are somewhat locked down. All clients are running Windows XP, and all servers are running Windows Server 2003. The manufacturing plants are connected to headquarters via T1 lines in a hub-and-spoke configuration. You just installed Windows Server Update Services (WSUS) on a server named WSUS1. You enable WSUS1 to obtain and store security patches for distribution on the internal network. Now you need to ensure that all client computers receive future security patches from WSUS1 only. You open the Group Policy object (GPO) for the Clients OU. Which setting should you configure?
| A. | Computer Configuration\Software Settings\Software Installation |
| B. | User Configuration\Software Settings\Software Installation |
| C. | Computer Configuration\Administrative Templates\Windows Components\Windows Installer |
| D. | User Configuration\Administrative Templates\Windows Components\Windows Installer |
| E. | Computer Configuration\Administrative Templates\Windows Components\Windows Update |
| | 5. | You are the lead administrator for a pet food company based in the Southeast. Most of the end users are not computer savvy, so the client computers are somewhat locked down. All clients are running Windows XP, and all servers are running Windows Server 2003. You recently installed Windows Server Update Services (WSUS) to manage security updates. The server that runs SUS is configured to synchronize automatically every day at 7:00 a.m. New critical updates were released today at 9:00 a.m. You need to manually update the SUS server. What action should you take?
| A. | Log on to the WSUS server. Download the new security updates from Microsoft Update. |
| B. | Download the new security updates from Microsoft Update to your local computer. Copy and paste the updates on the WSUS server. |
| C. | On the WSUS home page, synchronize the server. |
| D. | Log on to the WSUS server. Run Wupdmgr.exe by using the appropriate command to manually synchronize the server. |
| E. | On the WSUS Synchronization Options page, synchronize the server. |
| | | | 6. | You are the administrator of a Windows Server 2003 network that consists of clients ranging from Windows NT 4.0 to Windows XP. You purchase and install a new Windows Server 2003, and install and configure WSUS. Your Windows 2000 SP3 and Windows XP SP2 clients are able to receive patches without any problems. However, it doesn't look like your Windows NT 4.0 SP6 clients are receiving any updates. What can you do to receive updates from WSUS for your Windows NT 4.0 clients?
| A. | Download a new client from the WSUS support page. |
| B. | Reconfigure Group Policy to support the Windows NT 4.0 clients. |
| C. | Manually edit the registry to connect to the WSUS server. |
| D. | Windows NT 4.0 is not supported by WSUS. |
| | 7. | You are the administrator for a small chemical firm. You currently have 15 Windows 2000 SP2 workstations, 5 Windows XP (no service packs) laptops, and 3 Windows 2003 Servers. You install WSUS on a Windows Server 2003 server named Patch. You must ensure that all client computers receive all Microsoft security patches, critical updates, and service packs. This needs to be accomplished as quickly as possible. What should you do? (Choose three.)
| A. | Download and install the latest version of the Automatic Updates client on the Windows 2000 workstations. |
| B. | Download and install the latest version of the Automatic Updates client on the Windows XP laptops. |
| C. | Download and install the latest version of the Automatic Updates client on the Windows 2003 servers. |
| D. | Modify the Windows Update settings of the Default Domain Controllers Group Policy object to point the client computers to http://Patches. |
| E. | Modify the Windows Update settings of the Default Domain Policy Group Policy object to point the client computers to http://Patches. |
| F. | Apply service pack 3 to the Windows 2000 SP2 workstations. |
| | | | 8. | You are the administrator of a Windows Server 2003 Active Directory domain with multiple sites. You have installed a WSUS infrastructure with a WSUS server at each site that pulls its patch information from your central WSUS server. You check the Microsoft website and see that they have released a critical update. You schedule this update to be applied at 3:00 a.m. When you come into the office the next morning, you check the Status of Updates report to see whether the patch application was successful. To your dismay, you see that less than 25% of the computers have the critical patch installed. What should you do to correct this?
| A. | Schedule WSUS to apply the patch at 3:00 a.m. the next morning. |
| B. | Apply the patch manually. |
| C. | Do nothing, and check the report again tomorrow morning. |
| D. | Call Microsoft Support and open an incident. |
|
Answers to Exam Questions | 1. | B and D. WSUS can provide an automated way to keep your clients updated. SUS is no longer supported by Microsoft. Although you can have each client access the Microsoft Updates website directly, you can't control what patches are installed, or if they get installed. See "Microsoft Update." | | 2. | C. Whereas minimizing the amount of locales you download updates for will save a lot of storage space, in a limited storage scenario you want to minimize storage use as much as possible. WSUS supports the use of Remote Storage. This option allows you to approve the updates, and then allow the client computers to download them directly from Microsoft Updates. WSUS does not use Windows Update. See "Microsoft Update." | | 3. | B. You can use Windows Server Update Services to download all critical updates to servers and clients as soon as they are posted to the Windows Update website. Although the GPO method would apply updates to the clients, it wouldn't automatically synchronize them with the website. Creating a process for the clients to go to the Windows Update site would bypass the approval process, so it's not a good solution. ISA is a firewall product and would be of no use in this scenario. See "Configuring Clients for Automatic Updates." | | 4. | E. Automatic Updates clients can be configured to synchronize from an WSUS server rather than the Windows Update servers by modifying the clients' Registries or, more efficiently, by configuring Windows Update policies in a Group Policy Object (GPO). See "Configuring Clients for Automatic Updates." | | | | 5. | E. To perform an immediate synchronization, select Synchronize Now on the synchronization options page. Downloading the updates manually won't add the required information to the WSUS database. See "Installing Windows Server Update Services." | | 6. | D. WSUS doesn't support Windows NT 4.0. See "Configuring Clients for Automatic Updates." | | 7. | A, B, and E. Windows 2000 SP2 or earlier clients and Windows XP clients with no service packs are unable to connect to a WSUS server without manually updating the Automatic Updates client to a later version. Windows 2000 SP2 or later, Windows XP SP1 or later, and all versions of Windows Server 2003 clients either have the correct software installed or can connect to the WSUS server and automatically update to a newer version. By adding the WSUS server location to the Default Domain controllers GPO, only domain controllers would receive updates. See "Configuring Clients for Automatic Updates." | | 8. | C. WSUS provides on-the-fly status reporting of just about any common metric to allow you to check the patch status of your network. The only caveat is that you should wait at least 22 hours after a patch distribution so that the clients have a chance to report their statistics. For an individual client, you can expedite the reporting process by entering the Wuauclt /detectnow command. See "Managing Updates." |
Suggested Readings and Resources 1. Deploying Microsoft Windows Server Update Services. Microsoft Corporation. http://technet2.microsoft.com/WindowsServer/en/library/ace052df-74e7-4d6a-b5d4-f7911bb06b401033.mspx?mfr=true. 2. Morimoto, Rand, Noel, Michael, Lewis, Alex. Microsoft Windows Server 2003 Unleashed R2 Edition. Sams Publishing, 2006. ISBN 0672328984. 3. Step-by-Step Guide to Getting Started with Microsoft Windows Server Update Services. Microsoft Corporation. http://www.microsoft.com/downloads/details.aspx?FamilyId=3BA03939-A5A9-407B-A4B0-1290BA5182F8&displaylang=en. 4. Windows Server 2003 Deployment Guide. Microsoft Corporation. http://technet2.microsoft.com/WindowsServer/en/Library/c283b699-6124-4c3a-87ef-865443d7ea4b1033.mspx?mfr=true. 5. Windows Server 2003 Resource Kit. Microsoft Press, 2005. ISBN 0735614717. 6. Windows Server Update Services home page. http://www.microsoft.com/windowsserversystem/updateservices/default.mspx. |
