SUS can be used in both small and large environments by using different architectures.

Scenario 1 is appropriate for small- or medium-size organizations with a single LAN. One SUS server gets its packages from the Microsoft Windows Update site, and all client systems get approved packages from that SUS server.

Scenario 2 is appropriate for geographically dispersed organizations or those with so many client systems that a single SUS server would be overloaded. A parent SUS server gets its packages from the Microsoft Windows Update site, and then subordinate child SUS servers retrieve all approved packages from the parent. At least one child server is located at each remote site, and child servers can also be located on the local LAN if SUS needs to serve large numbers of clients.

Scenario 3 applies to geographically dispersed organizations that have direct Internet connections (through a firewall) at each remote site. In this scenario, the clients get the list of approved packages from the central SUS server, but then download the packages directly from one of the Microsoft Windows Update sites located around the world.

Back to associated article: Software Update Service to Ease Patch Distribution