Login

Recent searches

No recent searches

Search options

Not available on mastodon.xyz.
mastodon.xyz is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon instance, open to everyone, but mainly English and French speaking.

Administered by:

Server stats:

790
active users

mastodon.xyz: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

#wsus

0 posts0 participants0 posts today
Public
Harry Sintonen

About 10 years ago it was found out that using #WSUS over clear text HTTP is a bad idea: It's trivial to get SYSTEM on the servers if you get in a privileged network position. This is presented as "WSUSpect: Compromising the Windows Enterprise via Windows Update" at Black Hat 2015. There's plenty of mature tooling for pulling this attack off.

So, you'd think that #Microsoft would promote secure configuration in all their documentation in regards of deploying WSUS, right? Unfortunately, this is not the case. You can easily end up reading this document:

learn.microsoft.com/en-us/wind

Examples use http:// url, and there is no recommendation to use HTTPS, and no warnings on how this will create a wholly insecure configuration.

However, if you're lucky you will locate the good documentation that mentions the importance of using HTTPS: learn.microsoft.com/en-us/wind

If you're lucky you'll locate this Microsoft documentation with this warning: "Warning Securing WSUS by using the SSL protocol is important for the security of your network. If your WSUS server does not properly use SSL to secure its connections, an attacker might be able to modify crucial update information as it's sent from one WSUS server to another, or from the WSUS server to the client computers. This will allow the attacker to install malicious software on client computers."
Public *
24😷-185

Just set up a #WSUS server and no computer of your domain shows up?

On each computer, but not the WSUS one, just be sure your #GPO is applied with "gpresult /r" then try these three #PowerShell lines:

$updateSession = new-object -com "Microsoft.Update.Session"
$updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates
wuauclt /reportnow

Huzzah.

#Windows
Replied in thread
Public
Walker

@SecurityWriter Obvious question. What if you dont want to move to a cloud based solution, or your network goes down?

Is Microsoft eventually depreciating local network services?

"While the WSUS role remains available in Windows Server 2025, we recommend organizations transition to cloud tools, including including Windows Autopatch and Microsoft Intune for client update management and Azure Update Manager for server update management," Froimovici said. #microsoft #wsus

Replied in thread
Public
GateLinker

@windowsonwindows
Thanks for the screenshot. 👍

Win2K was also the last NT-Windows without online registration or activation.

And it is still possible to get all published updates by a modern #WSUS server (if you manually fix some certificate issues).

Hmm ... I miss it, because unfortunately it runs more stable than #reactos and boots on Hyper-V too.

Public *
Kevin Severud

Still managing WSUS for Windows updates?
Using #WSUS for third-party updates?

The devs at Patch My PC have a tool for WSUS (works with both SQL Server and WID databases) used to verify that IIS, database, file permissions, and other settings are configured for best-practices guidance.

Ignore the name "MEM" nomenclature as Microsoft has now retired the "Microsoft Endpoint Manager", aka MEM, branding.

#PatchMyPC #SQLServer #WID #WUfB #SCCM #ConfigMgr
github.com/PatchMyPCTeam/MEM-P

Screenshot from GitHub site for MEM Patching Optimizer showing its logo as well as the following text: MEM Performance Analyser This tool run various tests against your WSUS environment, Including WSUS, SQL & IIS and provide feedback based on Microsofts best practices
Public
Thomas Lee ✅ :patreon:

@shwalsh13 Hardest ch was the last. Trying to manage #WSUS in #PowerShell 7. The WSUS team could not have shipped such a ore Powershell unfriendly module and object model if that was their aim. Even the RSAT tool feature name is different to ALL the rest. And I suspect MSFT will never revise it to use more modern protocol and support #.NET. Still with #Powershell7 there are ways around this

Public
NeighborGeek

#Microsoft has released an out of band patch for windows to fix a known issue for domain controllers running the November 2022 cumulative update.

This will not be published to #WindowsUpdate, so admins need to go get the update from the catalog and install it or import it to #WSUS / #configmgr

learn.microsoft.com/en-us/wind

learn.microsoft.comWindows message centerWindows message center
#infosec#WindowsServer
ExploreLive feeds
About