I work on a classified program for Lockheed Martin and our network is completely isolated from the internet. Therefore, I have two WSUS servers; one connected to the internet which harvests the updates and the second is on the classified LAN. Each day, I check for updates on the internet WSUS server and if anything new pops up, I export the metadata and copy the files to DVD.
Setting up the WSUS servers was easy. However, understanding how the two WSUS servers interacted was a different story. Here are a few problems I encountered but have since resolved:
If you are finding that the updates on your disconnected WSUS server are not downloading even after you have imported the metadata and copied the files to the server, check and confirm the following:
- The WSUSContent directory should be exactly the same on both servers. That is if on WSUS server #1 the directory path is C:\WSUS\WsusContent\ it should be the same on WSUS server #2. If you have the updates going to a different drive letter, then the metatdata in the database from server #1 will not point to the right place when you import it into WSUS server #2. You can run C:\Program Files\Update Services\Tools\wsusutil.exe help movecontent as a possible solution.
- Within the Update Services application, select Options=>Update Files and Languages and make sure “Store update files locally on this server” is selected, “Download update files to this server only when updates are approved” is checked, and “Download Express installation files” is NOT checked. The express files require communication with the Windows Update website and since your disconnected WSUS cannot communicate with it, all the update files cannot be downloaded. Makes sure these settings are the same on BOTH servers. You may need to re-download all the updates on the internet connected WSUS server to re-sync the files if you at one point had this checked and later unchecked it. You will then need to copy those files to the disconnected WSUS server.
- Within the Update Services application, select Options=>Update Files and Languages and select the Update Languages tab at the top. Make sure the same languages are checked the same on BOTH servers.
Obviously, you have to match the approved updates on the internet connected WSUS server with the disconnected WSUS server. But I did notice when you approve an update on the disconnected WSUS server, it appears as if the server has to download the updates from itself. If you click between one of the Update views and the Server Name where the “Updates needing files” count is displayed, it takes a few seconds to update.