Troubleshoot– Windows 2008 R2 Server Manager Roles and Features – I

Troubleshooting Event ID 333

Event ID 333 basically occurs when system registry fails to flush operation to the disk. In most of the cases, Event ID 333 is more of a byproduct rather than an issue itself.
Event id 333 occurs when there is some performance issue or when memory/disk is not keeping up with the load. Generally when the issue occurs, you would see other Event IDs as well pointing towards the actual cause that triggered Event ID 333.
There are 4 likely causes for getting 333:
· Memory pressure- Physical or Virtual memory bottleneck, low System PTEs, Working set trimming etc.
· Disk pressure – Bottleneck, performance issue etc.
· Filter driver – Bad driver keeping registry from being flushed.
· Lock Pages In Memory – This behaviour can result if the SQL service account is given the user right ‘Lock Pages in Memory’

Troubleshooting


The following are the troubleshooting steps for this issue. Please note, all the steps do not fit in all scenarios and should not be applied as silver bullets.

Event Log

First this is to check for the Event IDs. Look for any other Event id related to disk, memory, server (SRV) in System log. Key event ids are: 2019, 2020, 51, 55, 52, 58

 Perfmon

· Look for key counters:
- Memory\%Committed Bytes in Use
- Memory\Available Mbytes
- Memory\Cache Bytes
- Memory\Commit Limit
- Free System Page Table Entries
- Memory\Pool Nonpaged Bytes
- Memory\Pool Paged Bytes
Physical disk or Logical Disk
- %disk Time
- Avg. Disk Bytes/Transfer (Read and Write)
- Avg. Disk Queue Length
- Avg Disk sec/Transfer
- Disk bytes/sec
- Split IO/sec
Paging File\%Usage
System\%Registry Quota in use

Disk

· Enable disk write cache
Enable disk write cache to increase disk performance. (Refer to KB 324446)
- This would enable the caching of data in memory instead of immediate write to disk. This reduces the load (queue length) on the disk and system can schedule flush the data to disk later.


· Perfmon
Monitor disk sec/transfer, idle time, split I/O, Data byes/sec
- Split I/O counter represent how fragment the drive is. It is best to defrag the drive as it has a major hit on the disk performance.
- Sec/Transfer represents the time it takes to transfer data. It gives the disk throughput
· Configure RegistryLazyFlushInterval to 60 secs. (Reference: KB317357 and KB324446)
- Setting value to 60, tells system to write registry changes to disk after 60 seconds. The more the number of writes, the more disk I/O. The value 60 is recommended by Microsoft.

· Event logs
Check for any disk related event ids. Most common sources are fdisk, disk. Common causes are corrupt/bad sector, controller issue or driver issues.
- Upgrade firmware drivers for controller,
- Run chkdsk if required if we have event if pointing to corrupt sector/cluster on the disk.

 

Memory

There could be contention in either physical or virtual memory on the system. The causes can be several and they do not have straight forward troubleshooting. It is recommended to have an understanding of memory concept before making changes as it can easily make the system unstable.

· Boot.ini
- On Windows 2003 x86 server, check Boot.ini, if we have /3GB switch in place and also keep the role of the server in mind. Try to modify the switch by adding /USERVA so that we can give more room to kernel memory. Visit the link to understand /3GB and /UserVA switches: http://technet.microsoft.com/fr-fr/library/cc784475(WS.10).aspx
- On windows 2008, we don’t have boot.ini
- Use of /PAE and /3GB is not recommended as it has adverse effect on system performance.

· SQL Server Consideration
- Configure SQL to use less memory for the buffer pool.

- SQL Server has it own memory manager (MM) and it doesn’t use windows MM. IT can be set to reserve X amount of memory, which windows cannot use.

- Configure Perfmon with SQL object and monitor the memory specific counters. This is when we have low physical memory issue on Windows system.
- 918483 How to reduce paging of buffer pool memory in the 64-bit version of SQL Server 2005 You can enable the lock pages in memory permissions to prevent SQL Server 2005 64-bit buffer pool memory from being paged out of physical memory
http://support.microsoft.com/?id=918483

· Disable Hot Add memory
- When the Hot Add Memory feature is enabled, the operating system pre-allocates kernel resources to handle any future memory that may be added to the computer. Kernel resources are allocated based on the capabilities of the computer instead of on the RAM that is actually installed. The kernel may allocate significant resources to RAM that may never be installed. Therefore, the Hot Add Memory feature may cause the maximum size of the paged pool to be much smaller than expected.
- To disable the feature: http://support.microsoft.com/?id=913568

· Pool memory leak
Look for Event id 2020 or 2019 for paged-pool or nonpaged-pool exhaustion. Configure poolmon.exe with appropriate interval and monitor the tag which has highest consumption at the time of issue.
- There are few articles for pool memory exhaustion but it is not recommended to apply without getting the poolmon data. KB 312362 is for maximizing the Paged-Pool limit on the box in case of Event ID 2020. But this is helpful when we have high memory consumption and not memory leak.

· Increase page file
- Again this is helpful if we have perfmon data to confirm the need.


· Apply patch
- For NTOSKRNL.EXE, as memory manager is implemented in windows kernel and ntoskrnl.exe is the executable.
[KB 935926: A Windows Server 2003-based computer stops responding when the registry is in heavy use]

· Free system PTEs.
- Look for perfmon counter value Free System Page Table Entries

Filter driver
Check for 3rd party drivers on the box which are outdated. You can use msinfo32 or Microsoft MPS utility to list out the drivers.

Last Resort – Complete memory dump

If the above troubleshooting does not help, configure the box for generating manual complete memory dump and trigger it when issue occurs. Send the dump to Microsoft for analysis

Troubleshooting for Services issue on Windows 2008 R2

1. Diagnostic Policy Service fails with Access Denied

Solution:

· Navigate to the following key: HKLM\System\CurrentControlSet\Control\WDI\Config

· Grant full permission to the ‘NT Service\DPS’ account on the key.

Note: This is a Local account and not on domain. You need to change the location from domain to local while searching for the accounts.

2. Firewall service fail to start with Error Code 5

Run Procmon.exe and you would notice access denied logs on the following keys:

HKLM\System\CurrentControlSet\Services\SharedAccess\Epoch

HKLM\System\CurrentControlSet\Services\SharedAccess\Epoch2

Solution:

· Navigate to the keys and grant full permission to the following accounts:

NT Service\MPSSVC and NT Authority\Network Service

Note: These are Local accounts and not on domain. You need to change the location from domain to local while searching for the accounts.

· Start the Firewall Service. It should start successfully.

3. Windows Event Log service fail to start with Access Denied error

Again, Procmon.exe shows that we have access denied on C:\Windows\System32\WinEvt folder.

Solution:

· Navigate to the above mention folder and edit permissions

· Grant full permission to the local account NT Service\EventLog

Note: These are Local accounts and not on domain. You need to change the location from domain to local while searching for the accounts.

4. Multiple Services fail to start with dependency failure error

or Access denied while starting Base Filtering Service

Multiple Services on Windows 2008 R2 fail to start with dependency failure error. The following services fail to start:

IPsec Policy Agent (PolicyAgent)
Windows Firewall
IKE and AuthIP IPsec Keying Modules
Internet Connection Sharing (ICS)
Routing and Remote Access

Reason: These services are directly or indirectly dependent on Base Filterning Agent service, which is failing with Access Denied Error. We need to fix Base Filtering Agent first.

Solution:

· Navigate to the following registry key: HKLM\System\CurrentControlSet\Services\BFE

· Grant full permission to the NT Service\BFE account on the above mentioned key.

· Also ensure that the following subkey is inheriting permission for BFE account:

HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent

UNIX Memory Management - Interview Questions and Answers

1. What is the difference between Swapping and Paging?

Swapping: Whole process is moved from the swap device to the main memory for execution. Process size must be less than or equal to the available main memory. It is easier to implementation and overhead to the system. Swapping systems does not handle the memory more flexibly as compared to the paging systems.

Paging: Only the required memory pages are moved to main memory from the swap device for execution. Process size does not matter. Gives the concept of the virtual memory. It provides greater flexibility in mapping the virtual address space into the physical memory of the machine. Allows more number of processes to fit in the main memory simultaneously. Allows the greater process size than the available physical memory. Demand paging systems handle the memory more flexibly.

1. What is major difference between the Historic Unix and the new BSD release of Unix System V in terms of Memory Management?

Historic Unix uses Swapping - entire process is transferred to the main memory from the swap device, whereas the Unix System V uses Demand Paging - only the part of the process is moved to the main memory. Historic Unix uses one Swap Device and Unix System V allow multiple Swap Devices.

2. What is the main goal of the Memory Management?

It decides which process should reside in the main memory,

Manages the parts of the virtual address space of a process which is non-core resident,

Monitors the available main memory and periodically write the processes into the swap device to provide more processes fit in the main memory simultaneously.

1. What is a Map?

A Map is an Array, which contains the addresses of the free space in the swap device that are allocatable resources, and the number of the resource units available there.

This allows First-Fit allocation of contiguous blocks of a resource. Initially the Map contains one entry - address (block offset from the starting of the swap area) and the total number of resources.

Kernel treats each unit of Map as a group of disk blocks. On the allocation and freeing of the resources Kernel updates the Map for accurate information.

2. What scheme does the Kernel in Unix System V follow while choosing a swap device among the multiple swap devices?

Kernel follows Round Robin scheme choosing a swap device among the multiple swap devices in Unix System V.

3. What is a Region?

A Region is a continuous area of a process's address space (such as text, data and stack). The kernel in a "Region Table" that is local to the process maintains region. Regions are sharable among the process.

4. What are the events done by the Kernel after a process is being swapped out from the main memory?

When Kernel swaps the process out of the primary memory, it performs the following:

Kernel decrements the Reference Count of each region of the process. If the reference count becomes zero, swaps the region out of the main memory,

Kernel allocates the space for the swapping process in the swap device,

Kernel locks the other swapping process while the current swapping operation is going on,

The Kernel saves the swap address of the region in the region table.

5. Is the Process before and after the swap are the same? Give reason.

Process before swapping is residing in the primary memory in its original form. The regions (text, data and stack) may not be occupied fully by the process, there may be few empty slots in any of the regions and while swapping Kernel do not bother about the empty slots while swapping the process out.

After swapping the process resides in the swap (secondary memory) device. The regions swapped out will be present but only the occupied region slots but not the empty slots that were present before assigning.

While swapping the process once again into the main memory, the Kernel referring to the Process Memory Map, it assigns the main memory accordingly taking care of the empty slots in the regions.

6. What do you mean by u-area (user area) or u-block?

This contains the private data that is manipulated only by the Kernel. This is local to the Process, i.e. each process is allocated a u-area.

7. What are the entities that are swapped out of the main memory while swapping the process out of the main memory?

All memory space occupied by the process, process's u-area, and Kernel stack are swapped out, theoretically.

Practically, if the process's u-area contains the Address Translation Tables for the process then Kernel implementations do not swap the u-area.

8. What is Fork swap?

"fork()" is a system call to create a child process. When the parent process calls "fork()" system call, the child process is created and if there is short of memory then the child process is sent to the read-to-run state in the swap device, and return to the user state without swapping the parent process. When the memory will be available the child process will be swapped into the main memory.

9. What is Expansion swap?

At the time when any process requires more memory than it is currently allocated, the Kernel performs Expansion swap. To do this Kernel reserves enough space in the swap device. Then the address translation mapping is adjusted for the new virtual address space but the physical memory is not allocated. At last Kernel swaps the process into the assigned space in the swap device. Later when the Kernel swaps the process into the main memory this assigns memory according to the new address translation mapping.

10. How the Swapper works?

The swapper is the only process that swaps the processes. The Swapper operates only in the Kernel mode and it does not uses System calls instead it uses internal Kernel functions for swapping. It is the archetype of all kernel process.

11. What are the processes that are not bothered by the swapper? Give Reason.

Zombie process: They do not take any up physical memory.

Processes locked in memories that are updating the region of the process.

Kernel swaps only the sleeping processes rather than the 'ready-to-run' processes, as they have the higher probability of being scheduled than the Sleeping processes.

12. What are the requirements for a swapper to work?

The swapper works on the highest scheduling priority. Firstly it will look for any sleeping process, if not found then it will look for the ready-to-run process for swapping. But the major requirement for the swapper to work the ready-to-run process must be core-resident for at least 2 seconds before swapping out. And for swapping in the process must have been resided in the swap device for at least 2 seconds. If the requirement is not satisfied then the swapper will go into the wait state on that event and it is awaken once in a second by the Kernel.

13. What are the criteria for choosing a process for swapping into memory from the swap device?

The resident time of the processes in the swap device, the priority of the processes and the amount of time the processes had been swapped out.

14. What are the criteria for choosing a process for swapping out of the memory to the swap device?

 The process's memory resident time,

Priority of the process and

The nice value.

15. What do you mean by nice value?

Nice value is the value that controls {increments or decrements} the priority of the process. This value that is returned by the nice() system call. The equation for using nice value is:
Priority = ("recent CPU usage"/constant) + (base- priority) + (nice value)
Only the administrator can supply the nice value. The nice() system call works for the running process only. Nice value of one process cannot affect the nice value of the other process.

16. What are conditions on which deadlock can occur while swapping the processes?

 All processes in the main memory are asleep.

All "ready-to-run" processes are swapped out.

There is no space in the swap device for the new incoming process that are swapped out of the main memory.

There is no space in the main memory for the new incoming process.

Windows 8 [32bit] Consumer Preview

Windows 8 Description-The next generation of Windows, a re-imagining of the operating system from the chip to the experience
This is a detailed preview of the next major release of Windows, code-named "Windows 8". From the chipset to the user experience, Windows 8 brings a new range of capabilities without compromise.
Windows 8 is designed to be the first Windows client to support systems on a chip (SoC) architectures, including ARM, and since it will be pre-installed on a range of next generation devices, it will also feature Metro, a NUI + GUI interface on the surface combined with a new application platform under-the-hood designed to enable the creation of immersive experiences.
The latest iteration of Microsoft's operating system brings an innovative new platform and tools to developers. Windows 8 apps can use a broad set of new libraries and controls, designed for fluid interaction and seamless connectivity. Apps can add new capabilities to Windows and to other apps, connecting with one another through the new interface.

Touch-First User Interface:· Metro style - Windows 8 introduces a new Metro style interface built for touch, which shows information important to you, embodies simplicity and gives you control. The Metro style UI is equally at home with a mouse and keyboard as well.
· Touch-first browsing, not just browsing on a touch device - Providing a fast and fluid touch-browsing experience, Internet Explorer 10 puts sites at the center on new Windows 8 devices.
More Ways to Engage With Powerful, Connected Apps:
· Powered by apps - Metro style apps built for Windows 8 are the focal point of your experience, filling your entire screen so there are no distractions.
· Apps can work together - Apps communicate with each other in Windows 8. For example, you can easily select and email photos from different places, such as Facebook, Flickr or on your hard drive.
· Your experience syncs across your devices - Live roams all the content from the cloud services you use most — photos, email, calendar and contacts — keeping them up-to-date on your devices. With SkyDrive, you can access your files, photos and documents from virtually anywhere with any browser or with Metro style apps in Windows 8.

Enhanced Fundamentals:· The best of Windows 7, only better - Windows 8 is built on the rock-solid foundation of Windows 7, delivering improvements in performance, security, privacy and system reliability. Windows 8 reduces the memory footprint needed - even on the lowest-end hardware - leaving more room for your apps.
· Preserving power-user favorites and making them better - For those who push the limits of their PC, Windows 8 features an enhanced Task Manager and Windows Explorer and new, flexible options for multimonitor setups.

New Developer Opportunities:· Windows Store - The Windows Store will allow developers to sell their apps anywhere Windows is sold worldwide, whether they’re creating new games or familiar productivity tools.
· Build using more languages - Windows 8 lets you leverage your existing skills and code assets to create great experiences using the programming language you prefer.
· Rich hardware integration leads to richer experiences, particularly for games - DirectX 11 gaming power underlies Windows 8, allowing the easy creation of full-screen games with smooth, flicker-free action.

New Generation of Hardware:· One Windows - many shapes and sizes - Support for ARM-based chipsets, x86 (as well as x32 and x64) devices, touch and sensors means Windows 8 works beautifully across a spectrum of devices, from 10-inch tablets and laptops to all-in-ones with 27-inch high-definition screens.
· Always connected - With Windows 8, new ultrathin PCs and tablets turn on instantly, run all day on a single charge and stay connected to the Internet so your PC is ready when you are. Next-generation system on a chip (SoC) support will also enable greatly extended standby and low-power states.
· Tap the full power of your PC - Windows 8 runs on PCs and is compatible with the devices and programs you use today on Windows 7, without compromise, to deliver the performance you expect of a PC.

Requirements:· 1 gigahertz (GHz) or faster 32-bit (x86) or 64-bit (x64) processor;
· 1 gigabyte (GB) RAM (32-bit) or 2 GB RAM (64-bit);
· 16 GB available hard disk space (32-bit) or 20 GB (64-bit);
· DirectX 9 graphics device with WDDM 1.0 or higher driver.
· Taking advantage of touch input requires a screen that supports multi-touch
Product Key: DNJXJ-7XBW8-2378T-X22TX-BKG7J

all part download and extract part first 

   Windows 8 [32bit]          Download
 

The Global Catalog Server in win 2003

An Overview on Global Catalog Servers

The Global Catalog (GC) is an important component in Active Directory because it serves as the central information store of the Active Directory objects located in domains, and forests. Because the GC maintains a list of the Active Directory objects in domains and forests, without actually including all information on the objects; and it is used when users search for Active Directory objects or for specific attributes of an object; the GC improves network performance and provides maximum accessibility to Active Directory objects.

The Global Catalog server is the domain controller that stores a full copy of all objects in its host domain. It also stores a partial copy of all objects in all other domains within the forest. The partial copy holds the list of objects most frequently searched for. The first domain controller that is created in the first domain in a forest is by default the Global Catalog server. If a domain only has one domain controller, that particular domain controller and the GC server are the same server. If you add an additional domain controller to the domain, you can configure that domain controller as the GC server. You can also assign additional domain controllers to serve as GC servers for a domain. This is usually done to improve response time for user logon requests and search requests.

In order for Global Catalog servers to store a full copy of all objects in its host domain, and a partial copy of all objects in all other domains within the forest, GC replication has to occur between those domain controllers that are configured as GC servers. GC replication does not occur between domain controllers that are not GC servers.
The functions of the GC server are discussed in the following section. The functions performed by the GC server can be summarized as follows:

• GC servers are crucial for Active Directory's UPN functionality because they resolve user principal names (UPNs) when the domain controller handling the authentication request is unable to authenticate the user account because the user account actually exists in another domain. The authenticating domain controller would have no knowledge of the particular user account. The GC server in this case assists in locating the user account so that the authenticating domain controller can proceed with the logon request for the user.
• The GC server deals with all search requests of users searching for information in Active Directory. It can find all Active Directory data irrespective of the domain in which the data is held. The GC server deals with requests for the entire forest.
• The GC also makes it possible for users to provide Universal Group membership information to the domain controller for network logon requests.

Universal Groups are available when the domain functional level is raised or set to least Windows 2000 Native. Universal Groups can contain members that belong to different domains within the forest, and their Universal Group membership information is only stored in the GC. What this means is that only those domain controllers configured as GC servers would contain Universal Group membership information. The remainder of the domain controllers would not hold Universal Group membership information.
The universal group membership caching feature introduced in Windows Server 2003 Active Directory, enables a site that has no GC server to cache universal group membership information for users who log on to domain controllers within the site. In this manner, a domain controller can serve logon requests for directory information when a GC server is unavailable. The settings of the Active Directory replication schedule determine how often the cache is refreshed.

Planning the Location of Global Catalog servers

If you have a relatively small network that only has one physical location, the first domain controller installed for the domain would become the GC server. As aditional domain controllers are added to the domain, you can move the GC server role to a different domain controller. Placing the GC server in such an Active Directory environment is a fairly straightforward process.
The majority of larger networks however have many physical locations. Having high-speed reliable links that connect branch offices would be the ideal situation. Since most links use limited bandwidth, and some links are also unreliable, the need to create sites and site links to control replication traffic becomes essential.
You should configure at least one domain controller as the GC server in each site. Ensure that the domain controller is robust enough to deal with all Global Catalog queries and GC replication traffic. This is turn ensures the best possible network response time.
When Microsoft Exchange 2000 Server is being used, it is also recommended to configure a GC server for each site that has an Exchange server.
If you have multiple sites, you might want to deploy additional GC servers for a site if the following conditions are true:

• A slow WAN link or unreliable WAN link is used to connect to the other sites.
• A frequently used application uses port 3268 for GC queries.
• The users in the site are members of a Windows 2000 domain or a Windows Server 2003 domain operating in Windows 2000 native mode.

How to create additional GC servers

When you create the first domain controller for a new domain, that particular domain controller is designated as the GC server. Depending on your network, you might need to add an additional GC server(s). The Active Directory Sites and Services console is the tool used to add an additional GC server. You have to be a member of one of the following groups to create additional GC servers: Domain Admins or Enterprise Admins.
To create an additional GC server:

1. Click Start, Administrative Tools, and then click Active Directory Sites and Services.
2. In the console tree, expand Sites, and then expand the site that contains the domain controller which you want to configure as a GC server.
3. Expand the Servers folder, and locate and then click the domain controller that you want to designate as a GC server.
4. In the details, pane, right-click NTDS Settings and click Properties on the shortcut menu.
5. The NTDS Settings Properties dialog box opens.
6. The General tab is where you specify the domain controller as a GC server.
7. Enable the Global Catalog checkbox.
8. Click OK.

How to enable the Universal Group Membership caching feature

1. Click Start, Administrative Tools, and then click Active Directory Sites and Services.
2. In the console tree, click the particular site that you want to enable universal group membership caching for.
3. In the details pane, right-click NTDS Settings and click Properties on the shortcut menu.
4. The NTDS Settings Properties dialog box opens.
5. Check the Enable Universal Group Membership Caching checkbox.
6. Click OK.

How to remove the GC server role from a domain controller

1. Open the Active Directory Sites and Services console.
2. In the console tree, locate and click the domain controller currently configured as the GC server.
3. Right-click NTDS Settings and click Properties on the shortcut menu to open the NTDS Settings Properties dialog box.
4. Clear the Global Catalog checkbox.
5. Click OK.

How to disable the Universal Group Membership caching feature

1. Open the Active Directory Sites and Services console.
2. In the console tree, locate and click the site for which you want to disable the Universal Group Membership caching feature.
3. Right-click NTDS Settings and click Properties on the shortcut menu to open the NTDS Settings Properties dialog box.
4. Clear the Enable Universal Group Membership Caching checkbox.
5. Click OK.

How to include additional attributes in the GC

The number of attributes in the GC affects GC replication. The more attributes your GC servers have to replicate, the more network traffic GC replication creates. Default attributes are included in the GC when Active Directory is first deployed. You can use the Active Directory Schema snap-in to add any additional attribute to the GC. Because the snap-in is by default not included in the Administrative Tools Menu, you first have to add it to the MMC before you can use it to customize the GC.
To add the Active Directory Schema snap-in in the MMC:

1. Click Start, Run, and enter cmd in the Run dialog box. Press Enter.
2. Enter the following at the command prompt: regsvr32 schmmgmt.dll.
3. Click OK to acknowledge that the dll was successfully registered.
4. Click Start, Run, and enter mmc in the Run dialog box.
5. When the MMC opens, select Add/Remove Snap-in from the File menu.
6. In the Add/Remove Snap-in dialog box, click Add, and then add the Active Directory Schema snap-in from the Add Standalone Snap-in dialog box.
7. Close all open dialog boxes.

To include additional attributes in the GC:

1. Open the Active Directory Schema snap-in.
2. In the console tree, expand the Attributes container, right-click an attribute and click Properties from the shortcut menu.
3. Additional attributes are added on the General tab.
4. Ensure that the Replicate this attribute to the Global Catalog checkbox is enabled.
5. Click OK.
   Troubleshooting GC Servers

A few common problems experienced with GC servers are listed below:

• Slow query response time: Adding an additional GC server to the location with the slow query response time can improve query response time. Users would be able to use the local GC server instead of using the slow WAN link.
• Replication latency problems between GC servers: You can add sites to assist with replication traffic.
• High Load: Where your GC servers are experiencing an excessive load, adding more GC servers to handle the load could assist with the problem. Remember though that adding additional GC servers, increases GC replication traffic.

How to configure WSUS 3.0 SP2 in window server 2003

Step 1: Confirm WSUS 3.0 SP2 installation requirements

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

Before you install or upgrade to Windows Server Upgrade Services 3.0 Service Pack 2 (WSUS 3.0 SP2), confirm that both the server and the client computers meet the minimum system requirements and confirm that you have the necessary permissions to complete the installation.

Server hardware and software requirements for installing WSUS 3.0 SP2

1. Confirm that the server meets the minimum system requirements for hardware, operating system, and other required software. Detailed system requirements are listed in the WSUS 3.0 SP2 System Requirements section of the WSUS 3.0 SP2 Deployment Guide. If you are using Server Manager to install the WSUS 3.0 SP2 Server, you can confirm that you meet the software requirements by following the steps in the Preparing to Install WSUS 3.0 SP2 section.
2. If you install roles or software updates that require you to restart the server when installation is complete, then restart the server before you install WSUS 3.0 SP2.

Client software requirements

Automatic Updates is the client of WSUS 3.0 SP2. Automatic Updates has no hardware requirements other than being connected to the network.

1. Confirm that computer on which you are installing Automatic Updates meets the WSUS 3.0 SP2 system requirements for Client computers. Detailed system requirements are listed in the WSUS 3.0 SP2 System Requirements section of the WSUS 3.0 SP2 Deployment Guide.
2. If you install software updates that require you to restart the computer, restart it before you install WSUS 3.0 SP2.

Permissions

The following permissions are required for the specified users and directories:

1. The NT Authority\Network Service account must have Full Control permission for the following folders so that the WSUS Administration snap-in displays correctly:
• %windir%\Microsoft .NET\Framework\v2.0.50727\Temporary ASP.NET Files
• %windir%\Temp
2. Confirm that the account that you plan to use to install WSUS 3.0 SP2 is a member of the Local Administrators group.

Preparing to install WSUS 3.0 SP2

You can install the WSUS server software using two different methods: through the user interface (Server Manager) or in unattended mode (WSUSSetup.exe). You must install WSUS on at least one server.

For more information about installing WSUS, see the Install the WSUS 3.0 SP2 Server section of the WSUS 3.0 SP2 Deployment Guide.

To prepare to install the WSUS 3.0 SP2 Server by using Server Manager

1. Log on to the server on which you plan to install WSUS 3.0 SP2 by using an account that is a member of the Local Administrators group.
2. Click Start, point to Administrative Tools, and then click Server Manager.
3. In the right side pane of the Server Manager window, in the Roles Summary section, click Add Roles.
4. If the Before You Begin page appears, click Next.
5. On the Select Server Roles page, confirm that Application Server and Web Server (IIS) are selected. If they have been selected, use the remainder of this step to confirm that the required role services are selected. Otherwise, install Application Server and Web Server (IIS) as follows.
1. On the Select Server Roles page, select Application Server and Web Server (IIS). Click Next.
2. If you are installing Application Role Services, on the Application Server page, click Next. On the Application Server Role Services page, accept the default settings, and then click Next.
3. If you are installing Web Server IIS, on the Web Server (IIS) page, click Next. On the Web Server (IIS) Role Services page, in addition to the default settings, select ASP.NET, Windows Authentication, Dynamic Content Compression, and IIS 6 Management Compatibility. If the Add Roles Wizard window appears, click Add Required Role Services. Click Next.
4. On the Confirm Installation Selections page, click Install.
5. On the Installation Results page, confirm that an “Installation succeeded” message appears for the role services that you installed in this step, and then click Close.

Step 2: Install WSUS Server or Administration Console

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

In Step 1: Confirm WSUS 3.0 SP2 installation requirements you confirmed that the server meets the minimum system requirements and that the necessary account permissions were granted You are ready to install WSUS 3.0 SP2. Start the installation of WSUS by using the applicable procedure for your operating system and kind of installation (by using either Server Manager or the WSUSSetup.exe file).

If you are using Server Manager

To start the installation of WSUSby using Server Manager

1. Log on to the server on which you plan to install WSUS 3.0 SP2 by using an account that is a member of the local Administrators group.
2. Click Start, point to Administrative Tools, and then click Server Manager.
3. In the right side pane of the Server Manager window, in the Roles Summary section, click Add Roles.
4. If the Before You Begin page appears, click Next.
5. On the Select Server Roles page, select Windows Server Update Services.
6. On the Windows Server Update Services page, click Next.
7. On the Confirm Installation Selections page, click Install.
8. When the WSUS Setup Wizard starts, skip the next section and see Using the WSUS Setup Wizard.

If you are using the WSUSSetup.exe file

To start the installation of WSUS or the Administration Console by using the WSUSSetup.exe file

1. Log on to the server on which you plan to install WSUS 3.0 SP2 by using an account that is a member of the Local Administrators group.
2. Double-click the WSUSSetup.exe installer file.
3. When the WSUS Setup Wizard starts, see Using the WSUS Setup Wizard.

Using the WSUS Setup Wizard

The WSUS Setup Wizard is launched from Server Manager or from the WSUSSetup.exe file.

To continue installing WSUS

1. On the Welcome page of the Windows Server Update Services 3.0 Setup Wizard, click Next.
2. On the Installation Mode Selection page, select Full server installation including Administration Console if you want to install the WSUS server on this computer, or Administration Console only if you want to install the administration console only.
3. On the License Agreement page, read the terms of the license agreement, click I accept the terms of the License agreement, and then click Next.
4. You can specify where clients get updates on the Select Update Source page of the installation wizard. By default, the Store updates locally check box is selected and updates will be stored on the WSUS server in the location that you specify. If you clear the Store updates locally check box, client computers obtain approved updates by connecting to Microsoft Update. Make your selection, and then click Next.
5. 
6. 
   

5. On the Database Options page, select the software that will be used to manage the WSUS database. By default, the installation wizard offers to install Windows® Internal Database.

If you do not want to use Windows Internal Database, provide an instance of Microsoft SQL Server for WSUS to use by selecting Use an existing database on this server or Use an existing database server on a remote computer. Type the instance name in the applicable box. The instance name should appear as <serverName>\<instanceName>, where serverName is the name of the server and instanceName is the name of the SQL instance. Make your selection, and then click Next.

6. If you have opted to connect to a SQL Server, on the Connecting to SQL Server Instance page, WSUS will try to connect to the specified instance of SQL Server. When it has connected successfully, click Next to continue.
7. On the Web Site Selection page, specify the Web site that WSUS will use. If you want to use the default Web site on port 80, select Use the existing IIS Default Web site. If you already have a Web site on port 80, you can create an alternate site on port 8530 or 8531 by selecting Create a Windows Server Update Services 3.0 SP2 Web site. Click Next.

8. On the Ready to Install Windows Server Update Services page, review the selections, and then click Next.
9. The final page of the installation wizard will let you know if the WSUS installation completed successfully. After you click Finish the configuration wizard will start.

Step 3: Configure the network connections

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

After Step 2: Install WSUS Server or Administration Console, where you installed WSUS 3.0 SP2, the configuration wizard will launch automatically. You can also run the wizard later through the Options page of the WSUS Administration Console.

Before you start the configuration process, be sure that you know the answers to the following questions:

1. Is the server's firewall configured to allow clients to access the server?
2. Can this computer connect to the upstream server (such as Microsoft Update)?
3. Do you have the name of the proxy server and the user credentials for the proxy server, if you need them?

By default, WSUS 3.0 SP2 is configured to use Microsoft Update as the location from which to obtain updates. If you have a proxy server on the network, you can configure WSUS to use the proxy server. If there is a corporate firewall between WSUS and the Internet, you might have to configure the firewall to ensure that WSUS can obtain updates.

Note

Although Internet connectivity is required to download updates from Microsoft Update, WSUS offers you the ability to import updates onto networks that are not connected to the Internet.

Step 3 contains the following procedures:

• Configure your firewall.
• Specify the way this server will obtain updates (either from Microsoft Update or from another WSUS server).
• Configure proxy server settings, so that WSUS can obtain updates.

To configure your firewall

• If there is a corporate firewall between WSUS and the Internet, you might have to configure that firewall to ensure WSUS can obtain updates. To obtain updates from Microsoft Update, the WSUS server uses port 80 for HTTP protocol and port 443 for HTTPS protocol. This is not configurable.
• There are still some firewalls in the market which require access rules to be configured using IP addresses rather than DNS names. Due technical and security reason we don’t release the IP address range and therefore our official recommendation is to create exclusion list using the names that are specified in the KB 896226. If your firewall does not support exception list with DNS name the other option that you have is to use two WSUS servers. Place one server inside the corporate firewall and place the other server in the perimeter network. Configure the firewall to allow the server located in the perimeter network to communicate with the internal WSUS server. As the perimeter WSUS server can receive updates from the Windows Update domains, the internal WSUS server can receive updates from the perimeter WSUS server, and the client computers (and any other WSUS servers) can receive updates from the internal server.
• If your organization does not allow the required ports and protocols to be open to all Internet addresses, you can restrict access to specific domains. For more information, see the following Microsoft Support articles:
• Article ID: 896226
• Article ID: 885819

Note

These instructions about how to configure the firewall are meant for a corporate firewall positioned between WSUS and the Internet. Because WSUS initiates all of its network traffic, you do not have to configure Windows Firewall on the WSUS server.

Although the connection between Microsoft Update and WSUS requires ports 80 and 443 to be open, you can configure multiple WSUS servers to synchronize with a custom port.

The next two procedures assume that you are using the Configuration Wizard. In a later section in this step, you will learn how to start the WSUS Administration snap-in and configure the server through the Options page.

To specify the way this server will obtain updates

1. From the configuration wizard, after joining the Microsoft Improvement Program, click Next to select the upstream server.
2. If you choose to synchronize from Microsoft Update, you are finished with the Options page. Click Next, or select Specify Proxy Server from the navigation pane.
3. If you choose to synchronize from another WSUS server, specify the server name and the port on which this server will communicate with the upstream server.
4. To use SSL, select the Use SSL when synchronizing update information check box. In that case the servers will use port 443 for synchronization. (Make sure that both this server and the upstream server support SSL.)
5. If this is a replica server, select the This is a replica of the upstream server check box.
6. At this point, you are finished with upstream server configuration. Click Next, or select Specify proxy server from the left navigation pane.

To configure proxy server settings

1. On the Specify Proxy Server page of the configuration wizard, select the Use a proxy server when synchronizing check box, and then type the proxy server name and port number (port 80 by default) in the corresponding boxes.
2. If you want to connect to the proxy server by using specific user credentials, select the Use user credentials to connect to the proxy server check box, and then type the user name, domain, and password of the user in the corresponding boxes. If you want to enable basic authentication for the user connecting to the proxy server, select the Allow basic authentication (password is sent in cleartext) check box.
3. At this point, you are finished with proxy server configuration. Click Next to go to the next page, where you can start to set up the synchronization process.

The following two procedures assume that you are using the WSUS Administration snap-in for configuration. These two procedures show how to start the WSUS Administration snap-in and configure the server from the Options page

.

To start the WSUS Administration Console

• To start the WSUS Administration Console, click Start, point to All Programs, point to Administrative Tools, and then click Windows Server Update Services 3.0.

Note

In order to use all the features of the console, log on as a member of either the WSUS Administrators or the Local Administrators security groups on the server on which WSUS is installed. Members of the WSUS Reporters security group have read-only access to the console.

To specify an update source and proxy server

1. On the WSUS console, click Options in the left pane under the name of this server, and then click Update Source and Proxy Server in the middle pane.

A dialog box will be displayed with Update Source and Proxy Server tabs.

2. In the Update Source tab, select the location from which this server will obtain updates. If you choose to synchronize from Microsoft Update (the default), you are finished with this wizard page.
3. If you choose to synchronize from another WSUS server, you have to specify the port on which the servers will communicate (the default is port 80). If you select a different port, you should ensure that both servers can use that port.
4. You may also specify whether to use SSL when synchronizing from the upstream WSUS server. In that case, the servers will use port 443 to synchronize from the upstream server.
5. If this server is a replica of the second WSUS server, select the This is a replica of the upstream server check box. In this case all updates must be approved on the upstream WSUS server only.
6. In the Proxy server tab, select the Use a proxy server when synchronizing check box, and then type the proxy server name and port number (port 80 by default) in the corresponding boxes.
7. If you want to connect to the proxy server by using specific user credentials, select the Use user credentials to connect to the proxy server check box, and then type the user name, domain, and password of the user in the corresponding boxes. If you want to enable basic authentication for the user connecting to the proxy server, select the Allow basic authentication (password in cleartext) check box.
8. Click OK to save these settings.

Step 4: Configure updates and synchronization

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

This section describes how to configure a set of updates that you want to download by using WSUS 3.0 SP2.

Step 4 Procedures

You can do these procedures by using either the WSUS Configuration Wizard or the WSUS Administration Console.

1. Save and download information about your upstream server and proxy server.
2. Choose the language of the updates.
3. Select the products for which you want to receive updates.
4. Choose the classifications of updates.
5. Specify the synchronization schedule for this server.

After you configure the network connection, you can download updates by synchronizing the WSUS server. Synchronization begins when the WSUS server contacts Microsoft Update. After the WSUS makes contact, WSUS determines whether any new updates have been made available since the last time you synchronized. When you synchronize the WSUS server for the first time, all the updates are available and are ready for your approval for installation. The initial synchronization may take a long time.

The procedures in this section describe synchronizing with the default settings. WSUS 3.0 SP2 also includes options that enable you to minimize bandwidth use during synchronization.

If you are using the WSUS Configuration Wizard

In Step 3: Configure the network connections, you completed configuration of the upstream server and the proxy server. This next set of procedures starts on the Connect to Upstream Server page of that configuration wizard.

To save and download your upstream server and proxy information

1. On the Connect to Upstream Server page of the configuration wizard, click the Start Connecting button. This both saves and uploads your settings and collects information about available updates.
2. While the connection is being made, the Stop Connecting button will be available. If there are problems with the connection, click Stop Connecting, fix the problems, and restart the connection.
3. After the download has completed successfully, click Next.

To choose update languages

1. The Choose Languages page lets you receive updates from all languages or from a subset of languages. Selecting a subset of languages will save disk space, but it is important to choose all of the languages that will be needed by all the clients of this WSUS server.

If you choose to get updates only for specific languages, select Download updates only in these languages, and select the languages for which you want updates.

2. Click Next.

To choose update products

1. The Choose Products page lets you specify the products for which you want updates. Select product categories, such as Windows, or specific products, such as Windows Server 2008. Selecting a product category will cause all the products in that category to be selected.
2. Click Next.

To choose update classifications

1. The Choose Classifications page allows you to specify the update classifications you want to obtain. Choose all the classifications or a subset of them.
2. Click Next

To configure the synchronization schedule

1. On the Set Sync Schedule page, you choose whether to perform synchronization manually or automatically.

If you choose Synchronize manually, you must start the synchronization process from the WSUS Administration Console.

If you choose Synchronize automatically, the WSUS server will synchronize at set intervals. Set the time of the First synchronization and specify the number of Synchronizations per day that you want this server to perform. For example, if you specify that there should be four synchronizations per day, starting at 3:00 A.M., synchronizations will occur at 3:00 A.M., 9:00 A.M., 3:00 P.M., and 9:00 P.M.

2. Click Next.
3. On the Finished page, you can start the WSUS Administration Console by leaving the Launch the Windows Server Update Services Administrations snap-in check box selected, and you can start the first synchronization by leaving the Begin initial synchronization check box selected.
4. Click Finish.

Important

You cannot save configuration changes that are made while the server is synchronizing. Wait until synchronization is finished and then make your changes.

If You Are Using the WSUS Administration Console

The following procedures explain how to perform the configuration steps by using the WSUS Administration Console.

To choose products and update classifications

1. In the Options panel, click Products and Classifications. A dialog box appears with Products and Classifications tabs.
2. In the Products tab, select the product category or specific products for which you want this server to receive updates, or else select All Products.
3. In the Classifications tab, select the update classifications you want, or else select All Classifications.
4. Click OK to save your selections.

To choose update files and languages

1. In the Options panel, click Update Files and Languages. A dialog box appears with Update Files and Update Languages tabs.
2. In the Update Files tab, choose whether to Store update files locally on this server or to have all client computers install from Microsoft Update. If you decide to store update files on this server, you also decide whether to download only those updates that are approved or to download express installation files.
3. In the Update Languages tab, if you are storing update files locally, you choose to Download updates for all languages (the default), or to Download updates only in the specified languages. If this WSUS server has downstream servers, they will receive updates only in the languages specified by the upstream server.
4. Click OK to save these settings.

To synchronize the WSUS server

1. In the Options panel, click Synchronization Schedule.
2. In the Synchronization Schedule tab, you choose whether to perform synchronization manually or automatically.

If you choose Synchronize manually, you will have to start the synchronization process from the WSUS Administration Console.

If you choose Synchronize automatically, the WSUS server will synchronize at set intervals. Set the time of the First synchronization and specify the number of Synchronizations per day that you want this server to perform. For example, if you specify that there should be four synchronizations per day, starting at 3:00 A.M., synchronizations will occur at 3:00 A.M., 9:00 A.M., 3:00 P.M., and 9:00 P.M.

3. Click OK to save your selections.
4. In the navigation pane of the WSUS Administration Console, select Synchronizations.
5. Right-click or move to the Actions pane on the right side, and then click Synchronize Now.

If you do not see the Actions pane on the right side of the console, on the console toolbar click View, click Customize, and ensure that the Action pane check box is selected.

6. After the synchronization is complete, in the left panel, click Updates to view the list of updates.

Step 5: Configure client updates

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

In WSUS 3.0 SP2, the WSUS Setup automatically configures IIS to distribute the latest version of Automatic Updates to each client computer that contacts the WSUS server.

The best way to configure Automatic Updates depends on the network environment. In an environment that uses Active Directory directory service, you can use an existing domain–based Group Policy Object (GPO) or create a new GPO. In an environment without Active Directory, use the Local GPO. In this step, you will configure Automatic Updates and then point the client computers to the WSUS server.

The following procedures assume that your network runs Active Directory. These procedures also assume that you are familiar with Group Policy and use it to manage the network.

For more information about Group Policy, see the Group Policy Resources on Windows Server Tech Center.

Step 5 Procedures

In Step 4: Configure updates and synchronization, you completed configuration of the updates that you want to download. Use this set of procedures to configure automatic updates for client computers.

1. Configure Automatic Updates in Group Policy.
2. Point a client computer to the WSUS server.
3. Manually start detection by the WSUS server.

Perform the first two procedures on the domain–based GPO of your choice, and the third procedure at a command prompt on the client computer.

To configure Automatic Updates

1. In the Group Policy Management Console (GPMC), browse to the GPO on which you want to configure WSUS, and then click Edit.
2. In the GPMC, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update.
3. In the details pane, double-click Configure Automatic Updates.
4. Click Enabled, and then click one of the following options:
• Notify for download and notify for install. This option notifies a logged-on administrative user before the download and before you install the updates.
• Auto download and notify for install. This option automatically begins downloading updates and then notifies a logged-on administrative user before installing the updates.
• Auto download and schedule the install. This option automatically begins downloading updates and then installs the updates on the day and time that you specify.
• Allow local admin to choose setting. This option lets local administrators to use Automatic Updates in Control Panel to select a configuration option. For example, they can choose their own scheduled installation time. Local administrators cannot disable Automatic Updates.
5. Click OK.

To point the client computers to the WSUS server

1. In the Windows Update details pane, double-click Specify intranet Microsoft update service location.
2. Click Enabled, and type the HTTP URL of the same WSUS server in the Set the intranet update service for detecting updates box and in the Set the intranet statistics server box. For example, type http://servername in both boxes, and then click OK.

Note

If you are using the Local GPO to point the computer to WSUS, this setting takes effect immediately, and this computer appears in the WSUS Administrative Console after a short time. You can speed up this process by manually initiating a detection cycle.

After you set up a client computer, it will take several minutes before the computer appears on the Computers page in the WSUS Administration Console. For client computers configured with a domain-based Group Policy, it can take about 20 minutes after Group Policy refreshes (that is, applies any new policy settings to the client computer). By default, Group Policy updates in the background every 90 minutes, with a random offset of 0–30 minutes. If you want to update Group Policy sooner, you can go to a command prompt on the client computer and type gpupdate /force.

For client computers configured by using the Local GPO, Group Policy is applied immediately, and the update takes about 20 minutes.

If you begin detection manually, you do not have to wait 20 minutes for the client computer to contact WSUS.

To manually start detection by the WSUS server

1. On the client computer, click Start, and then click Run.
2. Type cmd in the Open box, and then click OK.
3. At the command prompt, type wuauclt.exe /detectnow. This command-line option instructs Automatic Updates to contact the WSUS server immediately.

Step 6: Configure computer groups

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

Computer groups are an important part of WSUS 3.0 SP2 deployments. Computer groups permit you to test updates and target updates to specific computers. There are two default computer groups: All Computers and Unassigned Computers. By default, when each client computer first contacts the WSUS Server, the server adds that client computer to both of these groups.

You can create as many custom computer groups as you need to manage updates in your organization. As a best practice, create at least one computer group to test updates before you deploy them to other computers in your organization.

Step 6 Procedures

1. Create a test computer group.
2. Move at least one computer into the test group.

To create a test group

1. In the WSUS Administration Console, expand Computers and select All Computers.
2. Right-click All Computers and click Add Computer Group.
3. In the Add Computer Group dialog box, specify the Name of the new test group and click Add.

In the next procedure, you will assign a client computer to the test group. A test computer is any computer that has software and hardware that is consistent with the majority of client computers on the network, yet not assigned to a critical role. After your tests are successful, you can approve the updates for computers in the groups of your choice.

To assign a computer to the test group

1. In the WSUS Administration Console, click Computers.
2. Click the group of the computer that you want to assign to the test group.
3. In the list of computers, select the computer or computers that you want to assign to the test group.
4. Right-click Change Membership.
5. In the Set Computer Group Membership dialog box, select the test group that you created previously, and then click OK.

Repeat these two procedures, that is, create a group and then assign computer(s) to the group, to create as many additional computer groups as needed to manage updates at your site.

Step 7: Approve and deploy WSUS updates

Applies To: Windows Server 2003 with SP2, Windows Server 2008 R2, Windows Server 2008 R2 with SP1, Windows Server Update Services, Windows Small Business Server 2011 Standard

In this step, you approve an update for any computers in the test group for WSUS 3.0 SP2. Computers in the group automatically contact the WSUS server over the next 24 hours to obtain the update. You can use the WSUS reporting feature to determine whether those updates were deployed to the test computers. When the tests are successfully completed, you can then approve the updates for the applicable computer groups in your organization.

Step 7 Procedures

• Approve and deploy an update.
• Check the status of an update.

To approve and deploy an update

1. On the WSUS Administration Console, click Updates. An update status summary is displayed for All Updates, Critical Updates, Security Updates, and WSUS Updates.
2. In the All Updates section, click Updates needed by computers.
3. On the list of updates, select the updates that you want to approve for installation on your test computer group. Information about a selected update is available in the bottom pane of the Updates panel. To select multiple contiguous updates, hold down the SHIFT key while clicking updates; to select multiple noncontiguous updates, press down the CTRL key while clicking updates.
4. Right-click the selection and click Approve.
5. In the Approve Updates dialog box, select your test group, and then click the down arrow.
6. Click Approved for Install and then click OK.
7. The Approval Progress window appears which shows progress of the tasks that affect update approval. When approval is completed, click Close.

After 24 hours, you can use the WSUS Reports feature to determine whether the updates were deployed to the test group computers.

To check the status of an update

1. In the navigation pane of the WSUS Administration Console, click Reports.
2. On the Reports page, click the Update Status Summary report. The Updates Report window appears.
3. If you want to filter the list of updates, select the criteria that you want to use, for example, Include updates in these classifications, and then click Run Report on the window's toolbar.
4. You will see the Updates Report pane. You can check the status of individual updates by selecting the update in the left section of the pane. The last section of the report pane shows the status summary of the update.
5. You can save or print this report by clicking the applicable icon on the toolbar.
6. After you test the updates, you can approve the updates for installation on the applicable computer groups in your organization.