Configure the WSUS server client computer for automatic update

All the above involves the configuration of the WSUS server, you also need to configure the client computer to automatically update through the WSUS server. How to configure client computers to automatically update through a WSUS server depends on your network environment: in a domain environment, you can use domain-based Group Policy Objects (GPOs); in a non-domain environment, you can use local Group Policy objects or modify directly Registry. When you deploy Group Policy for automatic updates, automatic updates in the Control Panel on the client computer become invalid.

When deploying through Group Policy in a domain, Microsoft recommends adding a Group Policy object for WSUS updates instead of modifying the default domain policy or the default domain controller policy. Automatic update is implemented by configuring the Windows Update management template in Group Policy. The specific location is in Computer Configuration -> Administrative Template -> Windows Component -> Windows Update. If you do not find this template, you can right click on the Administrative Template. Select Add/Remove Templates and select Add %systemroot%infwuau.adm Template.

In order for client computers to get updates from the WSUS server, you must deploy the following options in Group Policy:

Configure automatic updates. Must be set to Enabled, then choose one of the following:
• Notify the download and notify the installation. This option alerts the logged in administrative user before downloading and installing the update.
• Automatically download and notify the installation. This option automatically starts downloading updates and then alerts the logged in administrative users before installing the update.
• Automatically download and plan to install. If you configure automatic updates to perform a scheduled installation, you must also set the date and time of the subsequent execution plan installation.
• Allow local administrators to choose settings. If you select this option, local administrators are allowed to select configuration options from the line using Automatic Updates in Control Panel. For example, they can choose their own scheduled installation time, but do not allow local administrators to disable automatic updates. This option is only displayed if the automatic update component of the client computer has self-updated to a WSUS-compatible version.

Specify the location of the Intranet Microsoft Update Service. Must be set to Enabled and then configured as the WSUS server address in the corporate intranet.

In addition to this, you can configure other options, such as automatically updating the detection frequency, allowing automatic updates to be installed immediately, and more. Another important configuration option is to allow client target settings. With this option, when you configure computer grouping on the WSUS server to use client-side targeting, you can configure client computers that apply this group policy to automatically join the computer group configured by this option.