JetPatch uses Windows Server Update Services (WSUS) for patching Windows endpoints. A few benefits with using WSUS:

• Bandwidth is a major factor as downloading updates from the internet can be bandwidth-consuming. 
• Supporting environment without internet connectivity - servers that are not connected to the internet should get their updates from a local source.
• Can be extended in order to distribute patches for third-party applications like Chrome and Java.

For more information about WSUS supported configuration check the "WSUS Supported Configuration " section below.

Hardware specifications can be found here

JetPatch Interaction With WSUS

Note - WSUS must be configured as a Discovery Source for JetPatch to pull all the information above. (endpoints can be discovered in many different ways).

Pulling Data

The first thing JetPatch is doing with WSUS is to pull data on the environment:

1. Computers & Computer Groups - List of the endpoints and the computer group they are within. Only endpoints that are communicating with WSUS are applicable for patch activities. JetPatch will convert the Computer Groups to patching groups and will keep the association of the endpoints (if they are already assigned to groups).
2. Patches Information - For any patch that is available in the WSUS (based on the Products and updates Classifications configured) JetPatch will pull the title, KB ID, operating systems, superseded,  and more.
   Note - JetPatch pulls the metadata only and not the binaries if they exist on the WSUS server.
3. Patches Status - The understanding of which patches are needed on which endpoints with their status (already installed or needed).
4. Environment Information - It includes the WSUS configuration and Replicas/Downstreams if exist.

Some of the information above is consistently pulled via JetPatch in the ongoing.

Patch Approvals

After activation of a Remediation Plan, JetPatch will change the approval of the selected patches on the selected groups in WSUS.

There are a few types of approvals:

1. Install - Approval for Install
2. Remove - Approval for Remove
3. Decline - Update is removed from the default list of available updates. This operation affects all of the groups regardless of the chosen groups.

Note - If ITSM is configured, JetPatch will approve the patch in WSUS only after change request approval.

Patch Operations

When it is time for updating the endpoint, (based on each endpoint Maintenance Schedule) JetPatch application will send the needed commands and information to the JetPatch agent (Connector) which will operate the Windows Update Agent for his need.

Connector actions via Windows Update Agent:

• Check for updates
• Download updates
• Install/remove updates

When done, Connector will send the result to JetPatch (JetPatch does not need to wait for patch installation approval from WSUS)

WSUS Types

There are two types of WSUS -

• Main WSUS - WSUS will manage all of the update approvals, settings computers, and groups for the computers that are connected to it.
• Replica WSUS - A replica server mirrors update approvals, settings computers, and groups from its parent (usually Main WSUS). Updates can be approved only on the upstream server. For endpoints that are connected to a Replica WSUS configured for manual groups assignment (see below) - the group assignment must be done in the Replica WSUS.  Example Use-Case: Externally Facing WSUS Server

In some scenarios, WSUS (Downstream) can also synchronize with another WSUS (Upstream) for only pulling the updated information.  More information can be found here.

Configuration Options

There are many configurations ("Options") to apply to the WSUS. The most important settings are:

• Update Source and Proxy Server - You can choose the Upstream server from which your server synchronizes updates and the proxy to use if needed.
• Products and Classifications - Most Microsoft updates are published on the WSUS and it's important to specify which products (categories) you would like to patch as well as the classifications
• Update Files and Languages - You can specify where to store update files. Storing files locally requires sufficient disk space. More information can be found in Update Files
• Synchronization Schedule - You can synchronize updates manually or set a schedule for daily automatic synchronization. 
• Computers - You can specify how to assign computers to groups. This can be done via manual assignment in the WSUS server (Server-Side Targeting) or by specifying a registry setting on the endpoints (Client-Side Targeting). More information can be found in Assigning Endpoints to Groups in WSUS

Update Files

In the WSUS options, you can select how the update files will be stored and how they will be downloaded to the endpoint.

There are two main options:

1. Store update files locally on this server - "Download update files to this server only when updates are approved". After patch approved, the WSUS will download the update files. Endpoints in the environment will download the update from the managed WSUS.
   This option is good when:
   • In-prem architectures : When the endpoints do not have direct access to the Microsoft Update Center over the internet
   • You prefer internal bandwidth, between the endpoints to the WSUS.
2. Do not store update files locally; computers install from Microsoft Update - If WSUS is configured with this option the following should happen: After patch approval, the endpoints will receive an indication of which patches should be installed from the WSUS. However, the files themselves will be downloaded directly from the Microsoft Update Center over the internet.
   This option is good for On-Cloud architecture (or in cases your environment is mostly 'Work-From-Home') and the endpoints can use their own internet access and bandwidth, without the need to make more traffic between the WSUS to the computers. You can find the instruction in Configure WSUS to Make the Endpoints Download the Patches Directly from MSFT article

Note - for downstream WSUS only, there is another option of storing the update files locally on the server but they will be downloaded from the Microsoft Update and not from the upstream WSUS.

WSUS Supported Configuration

JetPatch will work properly with WSUS that:

• Number of overall patches in the system - below 100,000
• Options (configurations):
  
  • "Automatic Approvals" -> "Update Rules" -> no rules
  • "Computers" -> same configuration for the all of the WSUS instances, Pri,ary and Replicas.
• Primary-Replica architecture - only one level of hierarchy (Primary -> Replica -> Replica architecture is not suported)