WUA & Questions

[scarf]

WAPT SERVER : Debian 11 / WAPT 2.4
Console Administrator: Windows 10

Hello, I'm planning to test Windows Updates with WAPT instead of WSUS. Several questions come to mind.
WUA Questions:
- Can Windows updates be stored in a repository?
- When creating a WUA rule allowing, for example, 'critical' updates, does WAPT automatically add the new updates to the rule?
- Can machines that shouldn't perform any Windows Updates be excluded? GPO?

Another question:
- Can a system be decommissioned with WAPT?

Thank you; Best
regards

[sfonteneau]

- Can Windows updates be stored in a repository?

Currently, the WAPT server downloads the missing CABs and places them in /var/www/waptwua. If you have secondary repositories, this folder is replicated. Could you please provide the exact requirements behind your question so we can better answer?

- When creating a WUA rule allowing, for example, 'critical' updates, does WAPT automatically add the new updates to the rule?

No, however, on the agent you can put the following in the wapt-get.ini file:

Code: Select all

[waptwua]
allowed_severities= Important, Critical

The agent will automatically allow CAB tags by Microsoft as Important or Critical

- Can we exclude workstations that shouldn't perform any Windows Updates? GPO?

Simply enable waptwua with default_allow=False and do not allow any cabs on this machine

- Can you decommission with WAPT?

I didn't quite understand the question.

[scarf]

Thank you very much for your replies.

Storing them in a repository will save space on our WAPT server.

[waptwua]
allowed_severities= Important, Critical.

Could you elaborate further? Is the agent you're referring to the WAPT server? Assuming so, then critical or important updates will be installed automatically by all clients?

Regarding "decommissioning," thanks to the reporting, I've identified workstations that have been inactive for at least a year in order to remove them from WAPT. I'm wondering if it's possible, via WAPT, to have a workstation removed from Active Directory and GLPI when it's deleted?

Thank you very much and have a good afternoon.

[sfonteneau]

Thank you very much for your answers.
Storing them in a repository will save space on our WAPT server.

You can ask the wapt server not to download the cab files, but then you will have to do it in a separate script to put them on a repo.
It's not very useful for us, for example, with a lot of diversity, the waptwua repo represents 20 gigabytes.

allowed_severities= Important, Critical

Could you elaborate further? Is the agent you're referring to the WAPT server? Assuming so, then critical or important updates will be installed automatically by all clients?

No, it's directly on the park's Wapt agents:
https://www.wapt.fr/fr/doc/wapt-console ... wapt-agent

Regarding "decommissioning," thanks to the reporting, I've identified workstations that have been inactive for at least a year with a view to removing them from WAPT. I'm wondering if it's possible, via WAPT, to have a workstation removed from Active Directory and GLPI when it's deleted?

Thank you very much and have a good afternoon.

We did not plan for this type of operation.

[vcardon]

Regarding "decommissioning," thanks to the reporting, I've identified workstations that have been inactive for at least a year in order to remove them from WAPT. I'm wondering if it's possible, via WAPT, to also remove a workstation from Active Directory and GLPI when it's deleted?

Thank you very much and have a good afternoon.

Removing an item from inventory is a process specific to each organization; it is not advisable to want the process within the product itself.

However, you can create your own inventory output package and script what needs to be done when the package is applied to a workstation.

[scarf]

Thank you for your replies. Regarding WUA, I understand how to exclude it. However, I have another issue: I modified my WAPT policy (generate an agent tab) by adding Windows Updates (which were previously disabled). When checking my agent configuration, I noticed that those that were already configured before the policy change are not updating.

[sfonteneau]

Indeed, when you generate an agent, it generates a WaptUpgrade package.

However, the WaptUpgrade package does not update if the version is already correct on the agent.

Therefore, you can either generate configuration packages and apply them,

or perform a forced installation on the machines.