WSUS 3.0 SP2 Reports

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

You can use Reports in Windows Server Update Services (WSUS) 3.0 SP2 to monitor the WSUS network, including updates, client computers, and downstream servers. If a WSUS server has replica servers, you can roll up client status information for the replica servers to the upstream server.
You can generate update reports from the following areas of the WSUS administration console:

1. General reports on the Reports page.
   
2. Reports about specific updates. (Right-click the update (or go to the Actions pane) and click Status Report.)
   
3. Reports on specific computers. (Right-click the computer (or go to the Actions pane) and click Status Report.)
   

Note
Generating detailed reports for large numbers of computers and/or updates can be memory intensive. Detailed reports are most effective for subsets of computers or updates. If you must create a very large report, and you are concerned about CPU and memory resources on the WSUS server, you can generate the report on a non-WSUS server that has the WSUS administration console installed.

In this topic:

• The Reports page
  
• Enable reporting rollup from replica servers
  

The Reports page

---

You can generate of the following reports in WSUS:

 

Report name	Function
Update Reports	View update status
Computer Reports	View computer status
Synchronization Reports	View the results of the last synchronization

Update reports

---

Update reports provide the status of the updates. You can run update reports in the following ways: summary, detailed, tabular, and tabular for approved updates. You can filter an update report by update classification, product, target computer group, and update installation status.
An update report displays information about the most recent contact between client computers and the WSUS server. We recommend that you generate this report the day after you approve updates, so that it reflects the latest approvals.

Note
To immediately connect a client computer to a WSUS server, you can run the wuauclt /detectnow command. This command is mainly used to update the status for a particular computer. After you issue this command on the client computer, you can get the computer status by running an update status report. For more information about wuauclt, seeManage WSUS 3.0 SP2 from the Command Line.

To run an update report

---

1. In the WSUS administration console, select the Reports node.
2. In the Reports pane, click one of the options in the Update Reports section: Update Status Summary, Update Detailed Status, Update Tabular Status, or Update Tabular Status for Approved Updates.
3. In the Updates Report window, you can select the updates that you want to see by classification, product, computer group, and update installation status.
4. Click Run Report.
   

   Note
   See the Update Status Report Terminology for WSUS 3.0 SP2 section for information about the status values that are shown on the report.

5. To change the view of an Update report to a detail, summary, or tabular view, click Report View in the Updates Report toolbar.

Update Status Summary View

---

The Update Status Summary view contains the elements that are listed in the following table.

Elements displayed in the Update Status Summary view

Column name	Description
Updates Report tree view	The tree that lists all the updates in the report.
Title	The title of the update.
Description	The description of the update.
Classification	The classification of the update.
Products	The products to which the update applies.
MSRC Severity Rating	Microsoft Security Response Center rating.
MSRC Number	Microsoft Security Response Center identification number.
More information	Redirection to the relevant website.
Approval Summary for Computer Group	The list of groups and approvals.
Group	The computer group.
Approval	Approval status (Approved, Not approved, Declined).
Deadline	The date by which the update must be installed.
Administrator	The administrative action.

Enable reporting rollup from replica servers

---

You can roll up the computer and update status from replica servers to their upstream server.

To enable reporting rollup from replica servers

---

1. In the WSUS administration console on the upstream server, click Options, and then Reporting Rollup.
2. Select the Roll up status from replica downstream servers check box, and then click OK.

Note
During the client scan, if the server detects that the client computer changed group membership (or name, IP address, or operating system version), it marks the client computer as needing a full rollup. The downstream server will roll up these changes to the upstream server during the next rollup after scan on the client computer.

Computer reports

---

Computer reports show you the status of computers. You can run computer reports in four ways: summary, detailed, tabular, and tabular for approved updates. You can also filter a computer report by update classification, product, target computer group, and update installation status.

To run a status report for computers

---

1. In the WSUS administrative console, select the Reports node.
2. In the Reports pane, click one of the options in the Computer Reports section: Computer Status Summary, Computer Detailed Status, Computer Tabular Status, or Computer Tabular Status for Approved Updates.
3. In the Computers Report window, you can select the updates that you want to see by classification, product, computer group, and update installation status.
   Note that for the Computer Tabular Status for Approved Updates report, the scope of the update approvals and the set of computers that are considered for the report is based on the selected target group.
   
   • The updates that are considered for the report are those for which the selected target group has direct or inherited approval for installation.
     
   • The computers that are considered for the report are those that are direct members of the selected target group, and optionally, its child target groups.
     
4. Click Run Report.
5. You can change the view of a Computer report to a detail, summary, or tabular view by clicking Report View in the Updates Report toolbar.

Synchronization Results report

---

The Synchronization Results report enables you to see synchronization information for the WSUS server for a given time period, including errors that occurred during synchronization and a list of new updates. In addition, you can get general, status, and revision information for each new update.

To run a Synchronization Results report

---

1. In the WSUS administrative console, click Reports.
2. In the Reports pane, click Synchronization Results. By default, the report shows any synchronization that was done today.
3. To change the synchronization period for the report, in the Synchronization Report window, click Between these dates and specify the dates that you want included in the report.
4. Click Run Report.

The report has four components, which are described in the following table.

Components of the Synchronization Results report

Component name	Purpose
Report Options	Shows the start and end dates of the period that is shown in the report, the date of the report, and the server for which the report was made.
Synchronization Summary	Displays summary information for the numbers of new, revised, and expired updates in each synchronization.
New Updates	Displays the new updates that have been synchronized to the WSUS server during the report's time period. You can view the properties for each update by clicking the update. An update status report will be generated for that individual report.
Revised Updates	Displays the revised updates that have been synchronized to the WSUS server during the report's time period. You can view the properties for each update by clicking the update. An update status report will be generated for that individual report.
Expired Updates	Displays the updates that have been expired during the report's time period.

Printing a report

---

You can print the report in update summary, detailed, or tabular views, depending on how you have formatted the update status report.

Exporting a report

---

You can print a report in its original format, or you can export it to Microsoft Excel® or to a PDF format.

Important
Exporting a large report can be extremely time consuming and may exceed your computer's memory resources. If you are planning to export a report, consider limiting the size of the report to 200 pages or fewer. You can use different filters to reduce the size of the report, or you can choose the tabular format rather than the detailed format to reduce the number of pages to export.

To export a report to Excel or PDF format

---

1. Run the report you want to export.
2. On the report toolbar, click the down arrow associated with the Save icon.
3. You will see two options: Excel and Acrobat (PDF) file. Click one of the options.

Extending reports

---

You can customize WSUS reports as follows:

1. Use the WSUS APIs to create a custom report.
   
2. Use WSUS public views to create and extend custom reports.
   

Use WSUS APIs to create custom reports

---

For more information about WSUS APIs, see the Windows Server Update Services SDK on MSDN. You can use these APIs to create reports for updates, approvals, installation information, and such.

Use WSUS public views to create custom reports

---

For more information about public views, in addition to sample queries, see the WSUS SDK conceptual documentation on MSDN. If you are using SQL Server as the WSUS database, you can use the SQL Server Report Builder to generate custom reports by using these views, or you can access the views from the command line.
If you are using Windows Internal Database as the WSUS database, you can access it through the command line if you download the Microsoft SQL Server Command Line Query Utility and the SQL Server Native Client. To download and install packages, seethe Feature Pack for Microsoft SQL Server 2005 in the Microsoft Download Center.

Configure WSUS for Network Load Balancing

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

Network load balancing (NLB) is an optional feature of Windows Server that load balances network traffic for high availability. You can install Windows Server Update Services (WSUS) 3.0 SP2 in a network that uses NLB, but this configuration requires that you perform additional steps during WSUS setup.
After you install WSUS and configure a SQL Server database in a failover cluster, you can configure NLB. For more information about how to set up an NLB cluster, see Network Load Balancing.
In this topic:

• Install WSUS on the first front-end server and configure a remote database
  
  
• Set up additional front-end WSUS servers
  
  
• Configure the front-end WSUS servers
  
  
• Create a shared file location
  
  
• Configure IIS on the front-end WSUS servers
  
  
• Move the local content directory to the file share
  
  
• Configure NLB
  
  
• Test the WSUS NLB configuration
  
  
• Configure WSUS clients to sync from the DFS share
  
  

Install WSUS on the first front-end server and configure a remote database

Install WSUS on the first front-end server and configure it to use a remote database. This process is described in Install the WSUS 3.0 SP2 Server Software Through the User Interface.

Set up additional front-end WSUS servers

This step installs WSUS on additional front-end WSUS servers, but it does not create a WSUS database.

Important
You cannot assign more than four front-end WSUS servers to a single database instance.

To install WSUS on additional front-end servers

1. Follow the instructions in To run WSUS Setup from the command line to install the WSUS server software on the additional WSUS servers by using the command line. Use the following flags for the command:
   WSUS30-KB972455-xxx.exe /q FRONTEND_SETUP=1 SQLINSTANCE_NAME=server\instance CREATE_DATABASE=0
   where WSUS30-KB972455-xxx.exe is the executable program that matches the server operating system.
   

Note
If you use the default SQL Server instance, you must leave the instance name blank.

Configure the front-end WSUS servers

Each front-end WSUS server should use a proxy server, and should authenticate to the proxy server by using the same user name and password. You can configure these settings by using the WSUS administration console. For more information about how to configure WSUS to use a proxy server, see Configure the proxy server and Change the WSUS proxy server specification using the WSUS Administration Console.

Note
All front-end servers share this information and configuring the proxy server only needs to be done once from any node.

Create a shared file location

You should create a single shared file location that is available to all of the front-end WSUS servers. You can use a standard network file share and provide redundancy by storing updates on a RAID controller, or you can use a Distributed File System (DFS) share. The domain account of each front-end WSUS server must have Change permissions on the root folder of the file share. That is, if there is a WSUS server installed locally on the computer that has the DFS share, the Network Service account should have change permissions on the root folder. In addition, the user account of the administrator who will run movecontent should have Change permissions.
After you install a WSUS update, check the NTFS file system permissions for the WSUSContent folder. The NTFS file system permissions for the WSUSContent folder may be reset to the default values by the installer.

Note
For more information about how to set permissions on DFS shares, see article 308568 in the Microsoft Knowledge Base.

Configure IIS on the front-end WSUS servers

To access the updates or metadata that reside on the file share, you must configure Internet Information Services (IIS) on the front-end WSUS servers to allow for remote access. For more information, see Configure Internet Information Services (IIS) in this deployment guide.

Move the local content directory to the file share

You must move the content directories from the first front-end WSUS server to the file share. You do not have to repeat this step for additional front-end WSUS servers.

Important
You must manually update the registry on all machines other than the machine that movecontent is run on. The current storage location can be found or verified in the registry. It is stored in the ContentDir value in the HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup key.

To move the content directories to the file share

1. To open a Command Prompt window, click Start, point to All Programs, click Accessories, and then click Command Prompt.
   
2. Open the following WSUS tools folder:
   cd \Program Files\Update Services\Tools
   
3. Type the following command:
   wsusutil movecontent  Filesharename logfilename
   where Filesharename is the name of the file share to which the content should be moved, and logfilename is the name of the log file.
   

Configure NLB

To configure NLB, follow the instructions that are provided in Network Load Balancing Clusters in the Windows Server Technical Library.

Test the WSUS NLB configuration

You should make sure that at least one WSUS front-end server can synchronize. If the synchronization is successful, proceed to the next step. Otherwise, review the WSUS setup and NLB cluster setup. Correct any problems with the configuration and then retest the synchronization.

Configure WSUS clients to sync from the DFS share

You can find instructions for configuring WSUS client computers in Update and Configure the Automatic Updates Client Computer. However, for WSUS on NLB clusters, you should specify the virtual address of the NLB cluster instead of the individual servers. For example, if you set up client computers by using a Group Policy Object or Local Group Policy Object, the setting for the Specify intranet Microsoft update service location setting should be the virtual web address.

Important
If you use a DFS share, be careful when you uninstall WSUS from one, but not all, of the front-end servers. If you allow the WSUS content directory to be deleted, this will affect all the WSUS front-end servers.

Upgrade NLB

For information about upgrading a Network Load Balancing (NLB) cluster, see Upgrading an existing Network Load Balancing Cluster.

Design the WSUS Server Layout

This topic describes simple Windows Server Update Services (WSUS) 3.0 SP2 deployments that use a single WSUS server and complex scenarios that include a WSUS server hierarchy or a WSUS server on an isolated network segment.
In this topic:

• WSUS deployment that uses a single WSUS server
  
  
• WSUS deployment that uses multiple connected WSUS servers
  
  
• WSUS deployment for disconnected networks
  
  
• WSUS deployment with Network Load Balancing clusters
  
  
• WSUS deployment with roaming client computers
  
  

WSUS deployment that uses a single WSUS server

The most basic WSUS deployment consists of a WSUS server that serves client computers on a private network, as shown in the following image:


The WSUS server connects to Microsoft Update to download updates. This process is known as synchronization. During synchronization, WSUS determines whether any new updates are available since the last synchronization. The first time that a WSUS server synchronizes, all updates are available for download. The first synchronization can take an hour or longer to complete. Subsequent synchronizations take significantly less time.

WSUS deployment that uses multiple connected WSUS servers

A WSUS deployment can consist of multiple connected servers. When you connect multiple WSUS servers, you create at least one upstream WSUS server and at least one downstream WSUS server. This configuration creates a hierarchy of WSUS servers, as shown in the following image:

You can synchronize a WSUS server to another WSUS server instead of to Microsoft Update. The WSUS server that connects to Microsoft Update is known as the root WSUS server.

Important
The downstream server must always synchronize to an upstream server. If you attempt to synchronize an upstream server to a downstream server, you effectively create a closed loop. This configuration is not supported.

A WSUS server hierarchy deployment offers the following benefits:

• You can download updates one time from the Internet and then distribute the updates to client computers by using downstream servers. This method saves bandwidth on the corporate Internet connection.
  
• You can download updates to a WSUS server that is physically closer to the client computers, for example, in branch offices.
  
• You can set up separate WSUS servers to serve client computers that use different languages of Microsoft products.
  
• You can scale WSUS for a large organization that has more client computers than one WSUS server can effectively manage.
  

Note
We recommend that you do not create a WSUS server hierarchy that is more than three levels deep. Each level adds time to propagate updates throughout the connected servers. While there is no theoretical limit to a hierarchy, only deployments with a hierarchy of five levels deep have been tested by Microsoft Corporation.

You can connect WSUS servers in Autonomous mode (to achieve distributed administration) or in Replica mode (to achieve centralized administration). You do not have to deploy a server hierarchy that uses only one mode: you can deploy a WSUS solution that uses both autonomous and replica WSUS servers.

Autonomous mode (distributed administration)

Distributed management by using autonomous mode is the default installation option for WSUS. In autonomous mode, an upstream WSUS server shares updates with downstream servers during synchronization. Downstream WSUS servers are administered separately and they do not receive update approval status or computer group information from the upstream server. By using the distributed management model, each WSUS server administrator selects update languages, creates computer groups, assigns computers to groups, tests and approves updates, and makes sure that the correct updates are installed to the appropriate computer groups.
The following image shows how you might deploy autonomous WSUS servers in a branch office environment:

Replica mode (centralized administration)

In replica mode, an upstream WSUS server shares updates, approval status, and computer groups with downstream servers. Downstream replica servers inherit update approvals and are not administered separately from the upstream WSUS server.
The following image shows how you might deploy replica WSUS servers in a branch office environment.

If you set up several replica servers to connect to a single upstream WSUS server, do not schedule synchronization to run at the same time on each replica server. This practice will avoid sudden surges in bandwidth usage.

WSUS deployment for disconnected networks

If the corporate network includes a network segment that is not connected to the Internet, you can deploy WSUS in the manner shown in the following drawing to support update management on that segment. In this case, you create a WSUS server that is connected to the Internet but is isolated from the intranet. After you download updates to the WSUS server, you can export the updates to removable media, hand-carry the removable media to a WSUS server on the disconnected network segment, and import the updates to that server.
This method of using WSUS is also appropriate for organizations that have high-cost or low-bandwidth links to the Internet. Downloading updates for all Microsoft products throughout an organization can be bandwidth intensive. This method enables organizations to download updates one time and then distribute updates locally by using inexpensive removable media. For more information about this scenario, see Configure a Disconnected Network to Receive Updates.

WSUS deployment with Network Load Balancing clusters

Network Load Balancing (NLB) can increase the reliability and performance of a network. You can set up multiple WSUS servers that share a single SQL Server failover cluster, as shown in the following image. For more information about how to deploy WSUS with NLB, see the Configure WSUS for Network Load Balancing section of the WSUS Operations Guide.

WSUS deployment with roaming client computers

If the network includes mobile users who log on to the network from different locations, you can configure WSUS to let roaming users update their client computers from the WSUS server that is closest to them geographically. In this configuration, shown in the following image, one WSUS server is deployed in each region, and each region is a DNS subnet. All client computers are directed to the same WSUS server name, which resolves in each subnet to the nearest physical WSUS server. For more information about how to configure DNS to support roaming client computers, see the Configure WSUS for Roaming Client Computers section of the WSUS Operations Guide.

WSUS 3.0 SP2 Reports

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

You can use Reports in Windows Server Update Services (WSUS) 3.0 SP2 to monitor the WSUS network, including updates, client computers, and downstream servers. If a WSUS server has replica servers, you can roll up client status information for the replica servers to the upstream server.
You can generate update reports from the following areas of the WSUS administration console:

1. General reports on the Reports page.
   
2. Reports about specific updates. (Right-click the update (or go to the Actions pane) and click Status Report.)
   
3. Reports on specific computers. (Right-click the computer (or go to the Actions pane) and click Status Report.)
   

Note
Generating detailed reports for large numbers of computers and/or updates can be memory intensive. Detailed reports are most effective for subsets of computers or updates. If you must create a very large report, and you are concerned about CPU and memory resources on the WSUS server, you can generate the report on a non-WSUS server that has the WSUS administration console installed.

In this topic:

• The Reports page
  
  
• Enable reporting rollup from replica servers
  
  

The Reports page

You can generate of the following reports in WSUS:

 

Report name	Function
Update Reports	View update status
Computer Reports	View computer status
Synchronization Reports	View the results of the last synchronization

Update reports

Update reports provide the status of the updates. You can run update reports in the following ways: summary, detailed, tabular, and tabular for approved updates. You can filter an update report by update classification, product, target computer group, and update installation status.
An update report displays information about the most recent contact between client computers and the WSUS server. We recommend that you generate this report the day after you approve updates, so that it reflects the latest approvals.

Note
To immediately connect a client computer to a WSUS server, you can run the wuauclt /detectnow command. This command is mainly used to update the status for a particular computer. After you issue this command on the client computer, you can get the computer status by running an update status report. For more information about wuauclt, seeManage WSUS 3.0 SP2 from the Command Line.

To run an update report

1. In the WSUS administration console, select the Reports node.
   
2. In the Reports pane, click one of the options in the Update Reports section: Update Status Summary, Update Detailed Status, Update Tabular Status, or Update Tabular Status for Approved Updates.
   
3. In the Updates Report window, you can select the updates that you want to see by classification, product, computer group, and update installation status.
   
4. Click Run Report.
   

   Note
   See the Update Status Report Terminology for WSUS 3.0 SP2 section for information about the status values that are shown on the report.

   
   
5. To change the view of an Update report to a detail, summary, or tabular view, click Report View in the Updates Report toolbar.
   

Update Status Summary View

The Update Status Summary view contains the elements that are listed in the following table.

Elements displayed in the Update Status Summary view

Column name	Description
Updates Report tree view	The tree that lists all the updates in the report.
Title	The title of the update.
Description	The description of the update.
Classification	The classification of the update.
Products	The products to which the update applies.
MSRC Severity Rating	Microsoft Security Response Center rating.
MSRC Number	Microsoft Security Response Center identification number.
More information	Redirection to the relevant website.
Approval Summary for Computer Group	The list of groups and approvals.
Group	The computer group.
Approval	Approval status (Approved, Not approved, Declined).
Deadline	The date by which the update must be installed.
Administrator	The administrative action.

Enable reporting rollup from replica servers

You can roll up the computer and update status from replica servers to their upstream server.

To enable reporting rollup from replica servers

1. In the WSUS administration console on the upstream server, click Options, and then Reporting Rollup.
   
2. Select the Roll up status from replica downstream servers check box, and then click OK.
   

Note
During the client scan, if the server detects that the client computer changed group membership (or name, IP address, or operating system version), it marks the client computer as needing a full rollup. The downstream server will roll up these changes to the upstream server during the next rollup after scan on the client computer.

Computer reports

Computer reports show you the status of computers. You can run computer reports in four ways: summary, detailed, tabular, and tabular for approved updates. You can also filter a computer report by update classification, product, target computer group, and update installation status.

To run a status report for computers

1. In the WSUS administrative console, select the Reports node.
   
2. In the Reports pane, click one of the options in the Computer Reports section: Computer Status Summary, Computer Detailed Status, Computer Tabular Status, or Computer Tabular Status for Approved Updates.
   
3. In the Computers Report window, you can select the updates that you want to see by classification, product, computer group, and update installation status.
   Note that for the Computer Tabular Status for Approved Updates report, the scope of the update approvals and the set of computers that are considered for the report is based on the selected target group.
   
   • The updates that are considered for the report are those for which the selected target group has direct or inherited approval for installation.
     
   • The computers that are considered for the report are those that are direct members of the selected target group, and optionally, its child target groups.
     
4. Click Run Report.
   
5. You can change the view of a Computer report to a detail, summary, or tabular view by clicking Report View in the Updates Report toolbar.
   

Synchronization Results report

The Synchronization Results report enables you to see synchronization information for the WSUS server for a given time period, including errors that occurred during synchronization and a list of new updates. In addition, you can get general, status, and revision information for each new update.

To run a Synchronization Results report

1. In the WSUS administrative console, click Reports.
   
2. In the Reports pane, click Synchronization Results. By default, the report shows any synchronization that was done today.
   
3. To change the synchronization period for the report, in the Synchronization Report window, click Between these dates and specify the dates that you want included in the report.
   
4. Click Run Report.
   

The report has four components, which are described in the following table.

Components of the Synchronization Results report

Component name	Purpose
Report Options	Shows the start and end dates of the period that is shown in the report, the date of the report, and the server for which the report was made.
Synchronization Summary	Displays summary information for the numbers of new, revised, and expired updates in each synchronization.
New Updates	Displays the new updates that have been synchronized to the WSUS server during the report's time period. You can view the properties for each update by clicking the update. An update status report will be generated for that individual report.
Revised Updates	Displays the revised updates that have been synchronized to the WSUS server during the report's time period. You can view the properties for each update by clicking the update. An update status report will be generated for that individual report.
Expired Updates	Displays the updates that have been expired during the report's time period.

Printing a report

You can print the report in update summary, detailed, or tabular views, depending on how you have formatted the update status report.

Exporting a report

You can print a report in its original format, or you can export it to Microsoft Excel® or to a PDF format.

Important
Exporting a large report can be extremely time consuming and may exceed your computer's memory resources. If you are planning to export a report, consider limiting the size of the report to 200 pages or fewer. You can use different filters to reduce the size of the report, or you can choose the tabular format rather than the detailed format to reduce the number of pages to export.

To export a report to Excel or PDF format

1. Run the report you want to export.
   
2. On the report toolbar, click the down arrow associated with the Save icon.
   
3. You will see two options: Excel and Acrobat (PDF) file. Click one of the options.
   

Extending reports

You can customize WSUS reports as follows:

1. Use the WSUS APIs to create a custom report.
   
2. Use WSUS public views to create and extend custom reports.
   

Use WSUS APIs to create custom reports

For more information about WSUS APIs, see the Windows Server Update Services SDK on MSDN. You can use these APIs to create reports for updates, approvals, installation information, and such.

Use WSUS public views to create custom reports

For more information about public views, in addition to sample queries, see the WSUS SDK conceptual documentation on MSDN. If you are using SQL Server as the WSUS database, you can use the SQL Server Report Builder to generate custom reports by using these views, or you can access the views from the command line.
If you are using Windows Internal Database as the WSUS database, you can access it through the command line if you download the Microsoft SQL Server Command Line Query Utility and the SQL Server Native Client. To download and install packages, seethe Feature Pack for Microsoft SQL Server 2005 in the Microsoft Download Center.