Install and Configure Windows Server Update Services on Windows Server 2012 R2
This article is for those looking for a detailed and straightforward guide on installing and configure Windows Server Update Services on Windows Server 2012 R2.
In this guide, we will consider the case when you already have a server with the Windows Server 2012 R2 operating system installed on it.
You can read more about how to install Windows Server 2012 R2 in my guide “Install Windows Server 2012 R2”.
You can learn how to install Active Directory Domain Services on Windows Server 2012 R2 by reading “Install Active Directory Domain Services on Windows Server 2012 R2”.
Before starting the installation of the Windows Server Update Services role, you must give the server the correct name according to your organization’s standards, and then specify a static IP address in the network connection settings. In addition, the server must be added to the domain.
In my “Basic Setup of Windows Server 2012 R2” guide, you can read about how to perform basic Windows Server 2012 R2 configuration and add a server to a domain.
Please note that before installing updates on production servers, you must test the installation of updates on test servers.
Go to the future update server and log into the system under an account with administrator rights.
The first step is to think over which folder the updates will be downloaded to. It is best to use a folder on a separate local drive to store downloaded updates. The amount of free space on the dedicated disk must be at least 10 Gb.
Let’s create a new folder for updates.
Go to an additional local disk and right-click on the free space, in the menu that opens, select “New”, then “Folder”.
Specify a name for the new folder and press the “Enter” button.
The new update folder is ready.
You can now begin installing the Windows Server Update Services role.
Open “Server Manager”, click on the “Manage” button in the upper right corner of the screen, and select “Add Roles and Features”.
Click on the “Next” button.
Select the installation type “Role-based or feature-based installation” and click on the “Next” button.
Next, select the server on which the role will be installed.
Click on the “Next” button.
Select the “Windows Server Update Services” role.
In the next step, the Role Installation Wizard will warn you that several components need to be installed to install the Windows Server Update Services role.
Click on the “Add Features” button.
Click on the “Next” button.
At the stage of adding components, we leave all the default values.
Click on the “Next” button.
Next, the “Role Installation Wizard” invites you to familiarize yourself with additional information regarding the “Windows Server Update Services” role.
Click on the “Next” button.
Now you need to choose where the update service will store its service data. To do this, you can use SQL Server or store the data in the Windows Internal Database (WID). WID has no database size limit and does not require an additional license to use.
This manual will use the Windows Internal Database for data storage.
We select “WID Database” and “WSUS Services”.
Click on the “Next” button.
We indicate the path to the previously created folder where you plan to store the downloaded updates.
Click on the “Next” button.
In the next step, the “Role Installation Wizard” will warn you that the “Internet Information Services” webserver role will be additionally installed for the “Windows Server Update Services” role.
At the stage of adding components, we leave all the default values.
Click on the “Next” button.
In order to start the installation of the selected role, click on the “Install” button.
The installation of the selected role and the components required for it has begun.
The installation of the Windows Server Update Services role is now complete.
Now click on the “Launch Post-Installation tasks” button in order for the “Role Installation Wizard” to launch the tasks for the initial configuration of the new role.
The process of performing tasks on the initial configuration of the new role has begun.
The process of performing tasks for the initial configuration of a new role is now complete.
Click on the “Close” button.
Now you need to do some basic configuration of the Windows Server Update Services role.
Go back to the “Server Manager”, click on the “Tools” button in the upper right corner of the screen and select “Windows Server Update Services”.
Click on the “Next” button.
Further, it is proposed to participate in the quality improvement program.
Uncheck “Yes, I would like to join the Microsoft Update Improvement Program” and click on the “Next” button.
Now you need to select the source from where your server will download updates for their further distribution on the local network. To do this, you can use Microsoft servers or download updates from another server with the Windows Server Update Services role on your local network.
In this guide, the server will download updates over the Internet from Microsoft’s servers.
Select “Synchronize from Microsoft Update” and click on the “Next” button.
Next, you can specify the settings for connecting to the Internet through a proxy server.
This manual does not use a proxy server.
Click on the “Next” button.
Now you need to connect to the update source to get information about available updates.
Click on the “Start Connecting” button.
The process of connecting to the update source is now complete.
Click on the “Next” button.
Next, you need to select which languages you want to download updates.
Select the required languages and click on the “Next” button.
Now you need to choose which products you want to download updates.
This guide will install updates for the Windows Server 2012 R2 operating system.
Select which products you plan to install updates, and click on the “Next” button.
Next, you need to select the desired updates by classification.
We select all classifications except “Drivers” and “Update Rollups”.
Please note that updates that belong to the “Drivers” and “Update Rollups” classifications are not recommended to be installed using the update server in order to be able to fully control the installation process and, thus, to minimize errors during the update.
Click on the “Next” button.
Now you need to select a schedule according to which your server will download updates for their further distribution on the local network.
In this tutorial, the server will download updates every day automatically.
We select “Synchronize automatically” and specify a convenient time for you to download updates to your server.
Click on the “Next” button.
You can now start the initial synchronization process with Microsoft servers.
We put a tick on the “Begin initial synchronization” item and click on the “Next” button.
Further, I will give recommendations for further configuring the Windows Server Update Services role.
Click on the “Finish” button.
The basic configuration of the Windows Server Update Services role is now complete.
Now you need to create a group policy that will distribute information about your update server to computers for subsequent download of updates from your server.
This guide will look at a single group policy for servers and workstations.
Please note that in a production environment, it is recommended to use individual group policies for each type of computer.
Go to the domain controller and log into the system under an account with domain administrator rights.
Open “Server Manager”, click on the “Tools” button in the upper right corner of the screen, and select “Group Policy Management”.
Right-click on the domain name and select “Create a GPO in this domain, and Link it here”.
Specify a name for the new group policy and click on the “OK” button.
Next, click on the new policy with the right mouse button and select “Edit”.
In the Group Policy Editor, go to the “Computer Configuration” section, then to the “Policies” subsection, then find the “Administrative Templates” section and select “Windows Components”, then “Windows Update”.
Next, double-click the left mouse button on the item “Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates”.
This setting allows you to wake up the system from sleep mode to install updates.
We select “Enabled”.
Please note that if the group policy is designed only for servers, then this setting can be omitted.
Click on the “OK” button.
Next, double-click the left mouse button on the “Configure Automatic Updates” item.
This setting allows you to select the settings for installing updates and the schedule according to which they will be installed.
We select “Enabled”.
In this guide, updates will be automatically downloaded and installed every day at 4:00 pm on all computers.
Please note that in a production environment, for important servers, it is not recommended to use automatic installation of updates in order to be able to fully control the installation process and, thus, to minimize receiving errors during the update.
In the “Configure automatic updating” section, select “Auto download and schedule the install”.
In the “Scheduled install day” section, select a convenient schedule for installing updates. “
Click on the “OK” button.
Next, double-click the left mouse button on the item “Specify intranet Microsoft update service location”.
This setting allows you to specify the address of your update server.
We select “Enabled”.
In the “Set the intranet update service for detecting updates” field, specify the address where your update server is available in the local network via the HTTP protocol, and port 8530.
In the “Set the intranet statistics server” field, specify the address where your update server is available in the local network via the HTTP protocol, and port 8530.
Click on the “OK” button.
Next, double-click the left mouse button on the “Automatic Updates detection frequency” item.
This setting allows you to set the interval for checking for new updates on your update server.
We select “Enabled”.
This guide will check for new updates once an hour.
In the “Interval (hours)” field, specify a convenient interval for installing updates.
Click on the “OK” button.
Next, double-click the left mouse button on the “Allow Automatic Updates immediate installation” item.
This setting allows you to immediately start installing updates after they have been downloaded and prepared for installation on target computers.
We select “Enabled”.
Click on the “OK” button.
Next, double-click the left mouse button on the item “Turn on recommended updates via Automatic Updates”.
This setting allows you to install on computers not only important updates but also recommended ones.
We select “Enabled”.
Click on the “OK” button.
Next, double-click the left mouse button on the item “No auto-restart with logged on users for scheduled automatic updates installation”.
This setting allows you to prohibit the automatic restart of the computer if the user is logged on to it.
We select “Enabled”.
Click on the “OK” button.
Now let’s check the application of Group Policy.
To do this, you need to run the Group Policy update on a computer that is subject to the new Group Policy and on which you want to install the updates.
In this guide, the computer on which the updates will be installed will be a server running Windows Server 2012 R2 operating as a domain controller.
Click “Start”, point to “cmd” in the search bar, then right-click on “Command Prompt” and select “Run as administrator”.
Let’s speed up the application of the new policy to the server using the command:
gpupdate /force
Group Policy update completed successfully.
Now let’s check that the server has received the necessary settings to download updates from the server on which the Windows Server Update Services role is installed.
Go to the “Start” menu and click the “Control Panel” button.
Next, go to the “System and Security” section.
Select the “Windows Update” section.
If you did everything correctly, then the “Windows Update” section under “You receive updates” should display “Managed by your system administrator”.
Now you need to create a new group of computers, allow the installation of certain updates on this group, and add computers to this group on which you plan to install updates.
We return to the server on which the Windows Server Update Services role is installed.
We go into the system under an account with administrator rights.
Open “Server Manager”, click on the “Tools” button in the upper right corner of the screen and select “Windows Server Update Services”.
Go to the “Computers” section and right-click on the “All Computers” subsection. In the menu that opens, select “Add Computer Group”.
In this tutorial, the “Servers” group will be used, where servers will be added to which updates need to be installed.
Specify a name for the new group of computers and click on the “Add” button.
Now you need to add computers to the new group on which you want to install updates.
In this guide, a server that acts as a domain controller is used as the computer where updates will be installed.
Go to the “Computers” section, then to the “Unassigned Computers” subsection. In the “Status” menu, select “Any” and click on the “Refresh” button.
This subsection displays all computers to which information about your update server has been propagated.
Right-click on the computer on which you want to install updates, and in the menu that opens, select “Change Membership”.
Specify the group of computers to which you want to add the computer and click on the “OK” button.
Go to the “Computers” section, then to the “Servers” subsection. In the “Status” menu, select “Any” and click on the “Refresh” button.
The computer has been successfully added to the “Servers” group.
Now you need to allow the installation of updates to the new group of computers.
In the “Updates” section, go to the “All Updates” subsection and select the updates required to install on the right side of the screen.
This guide will authorize all updates to the Windows Server 2012 R2 operating system.
Select the updates that need to be allowed for installation and click on the “Approve” button.
Now you need to select a group of computers on which you want to allow the installation of the selected updates.
Select “Servers” and select “Approved for Install” in the menu that opens.
Everything is ready for permission to install the selected updates to the “Servers” group.
Click on the “OK” button.
Updates were successfully allowed to be installed on the selected computer group.
Click on the “Close” button.
Now you need to wait, and after a while, only those updates that were allowed will be downloaded and installed on the specified group of computers.
Now you can create a rule to automatically allow new updates.
Please note that in a production environment for critical servers, it is not recommended to use rules for automatically allowing updates in order to be able to fully control the installation process and, thus, to minimize errors during the update.
In the “Options” section, select “Automatic Approvals”.
Click on the “New Rule” button.
In the “Step 1: Select properties” section, put a checkmark on the “When an update is in a specific classification” item to indicate for which classifications updates will be allowed automatically.
Then we tick the box “When an update is in a specific product” to indicate for which products updates will be automatically allowed.
In the “Step 2: Edit the properties” section, select “Any classification”.
Next, you need to select the desired updates by classification.
We select all classifications except “Drivers” and “Update Rollups”.
Please note that updates that belong to the “Drivers” and “Update Rollups” classifications are not recommended to be installed using the update server in order to be able to fully control the installation process and, thus, to minimize errors during the update.
Click on the “OK” button.
Now you need to select for which products you want to automatically allow updates.
In the “Step 2: Edit the properties” section, select “Any product”.
This guide will automatically allow updates for the Windows Server 2012 R2 operating system.
Select the products on which you plan to install updates, and click on the “OK” button.
Now you need to choose for which group of computers you want to automatically allow updates.
In the “Step 2: Edit the properties” section, select “All computers”.
In this tutorial, the “Servers” group is used as the group to which you want to automatically allow updates.
Select a group of computers for which you want to automatically allow updates, and click on the “OK” button.
Now you need to provide a name for the new rule.
In the “Step 3: Specify a name” section, specify a name for the new rule and click on the “OK” button.
The creation of a rule to automatically allow new updates is complete.
Check the box on the new rule and click on the “OK” button.
Now let’s check if the updates have been installed.
In a day we return to the computer on which the updates should have been installed.
In this guide, we used a domain controller as the computer to which the updates were installed.
We log into the system under an account with domain administrator rights and go to the “Start” menu.
Now go to the “System and Security” section.
Select the “Windows Update” section.
The updates were successfully installed on the server.
To complete the installation of updates, you must restart the server.
Click on the “Restart now” button.
My Courses
🎓 Dive into my comprehensive IT courses designed for enthusiasts and professionals alike. Whether you’re looking to master Docker, conquer Kubernetes, or advance your DevOps skills, my courses provide a structured pathway to enhancing your technical prowess.
My Services
💼 Take a look at my service catalog and find out how we can make your technological life better. Whether it’s increasing the efficiency of your IT infrastructure, advancing your career, or expanding your technological horizons — I’m here to help you achieve your goals. From DevOps transformations to building gaming computers — let’s make your technology unparalleled!
Refill My Coffee Supplies
💖 PayPal
🏆 Patreon
💎 GitHub
🥤 BuyMeaCoffee
🍪 Ko-fi
Follow Me
🎬 YouTube
🐦 Twitter
🎨 Instagram
🐘 Mastodon
🧵 Threads
🎸 Facebook
🧊 Bluesky
🎥 TikTok
💻 LinkedIn
📣 daily.dev Squad
🧩 LeetCode
🐈 GitHub
Is this content AI-generated?
Nope! Each article is crafted by me, fueled by a deep passion for Docker and decades of IT expertise. While I employ AI to refine the grammar—ensuring the technical details are conveyed clearly—the insights, strategies, and guidance are purely my own. This approach may occasionally activate AI detectors, but you can be certain that the underlying knowledge and experiences are authentically mine.
