WSUS 3.0 Architectural Diagram

Windows Server Update Services’ (WSUS) architecture can be configured many ways to meet an organization’s capacity requirements and network topology. In the example illustrated here, the organization has a small headquarters and a large subsidiary that manages its own IT infrastructure.

In the upper left, the Microsoft Update Web site provides the update packages and an update catalog that lists all available updates; descriptions of the problems they remedy; the URLs for the update files and integrity check data for ensuring the files are downloaded intact; the conditions for which the updates apply (e.g., the existence of a file of certain name, size, date, or the existence of a particular Registry entry) and whether a reboot is required after installation; and information on dependencies and which updates have been superseded by others.

The parent WSUS server is configured to periodically check Microsoft Update for changes to the catalog file and download any new updates for the product lines and software categories selected by the headquarters systems administrator. In this example, the parent WSUS server manages updates for client computers in the headquarters location. Each of these clients (which can include server OSs) are configured by Group Policy to periodically check with the headquarters WSUS server to see if there are any new updates for their particular software and hardware that have been approved for distribution to them.