8. Quickstart - WAPTWUA Setup

Hint

This page is a quickstart tutorial to get started with WAPTWUA. For complete and detailed documentation (governance models, WSUS proxy mode, driver management, offline mode, etc.), refer to the Using WAPT Windows Update Agent (WAPTWUA) page.

Note

WAPTWUA is a feature of WAPT Enterprise. Please ensure you have the correct licence before starting this tutorial.

8.1. Overview of WAPTWUA

WAPTWUA allows WAPT to manage Windows Updates across your fleet.

WAPTWUA lets you:

• Centralize and drive the deployment of Windows Updates from the WAPT Console.

• Only allow the KBs you validate (or, conversely, allow everything except specific exceptions), depending on the governance model chosen.

• Limit bandwidth and disk space usage, since only the updates actually needed by the hosts in your fleet are downloaded.

• Schedule the scan, download, and installation of updates, on a per-host or per-group basis.

8.1.1. Standard operation

WAPTWUA relies on three actors:

1. Microsoft publishes an index file, wsusscn2.cab, on each Patch Tuesday, listing all available updates.

2. The WAPT Server automatically downloads this file (by default, once a day) and makes it available to its agents.

3. The WAPT Agent (on each host) retrieves this file and uses it via the Windows Update Agent API to determine which updates it needs, then sends this list to the WAPT Server.

4. If an update required by a host is not yet present on the WAPT Server, the server will download it from official Microsoft servers and make it available to the agent.

Note

Unlike WSUS, which by default downloads all updates for the selected categories, WAPTWUA only downloads updates that have actually been requested by at least one host in the fleet. This keeps the update database lightweight (a few tens of GB) and easy to clean up.

8.2. How to enable it ?

8.2.1. Server prerequisites

• The waptwua option must have been enabled when generating waptserver.exe. In the screenshot below, you can see that the “enable WUA” option is enabled.

• The WAPT Server must have outbound Internet access (ports 443 and 80) to the following Microsoft domains in order to download the wsusscn2.cab file as well as the updates themselves:

Firewall outbound

In order to make WAPTWUA work, The WAPT Server must have access to;

• windowsupdate.microsoft.com

• ..windowsupdate.microsoft.com

• ..update.microsoft.com

• windowsupdate.com

• download.windowsupdate.com

• download.microsoft.com

• wustat.windows.com

• ntservicepack.microsoft.com

• go.microsoft.com

• dl.delivery.mp.microsoft.com

Hint

If the WAPT Server does not have direct Internet access, a proxy can be configured in waptserver.ini, or the procedure described in the WUA offline section of the documentation can be used instead.

8.2.2. Enabling it on the agent

Activation is done in the WAPT Agent’s wapt-get.ini file, in the [waptwua] section, by setting at least the enabled parameter:

[waptwua]
enabled = True

This is enough for the agent to start scanning for upcoming Windows Updates. There are, however, many other parameters (download and install scheduling, deployment delay, allowed severities, etc.) which are detailed in the complete documentation.

8.3. How to set it up on your fleet (concrete example)

8.3.1. Example: a fleet with workstations and servers

Let’s take a fleet made up of two types of machines: workstations and servers. We want to apply a different policy to each:

• Workstations can automatically receive all updates offered by Microsoft, with a relatively frequent scan and install cadence.

• Servers, being more sensitive, should only automatically receive critical updates, with a safety delay before installation.

In practice, we will create two configuration packages, for example:

Parameter	Workstations	Servers	Description
enabled	True	True	Enables or disables WAPTWUA on this host.
default_allow	True (everything allowed)	False (nothing allowed except exceptions)	Defines whether missing updates are authorized by default.
allowed_severities	(not applicable, everything is allowed)	Critical (only Critical is allowed)	Defines a severity list that will be automatically accepted.
download_scheduling	2d	3d	Defines the Windows Update scan and download recurrence.
install_scheduling	5d	10d	Defines the Windows Update install recurrence.
install_delay	(none) (the KB is installable as soon as it is published)	5d (minimum lifetime of the KB)	Defines a deferred installation delay after publication in the Microsoft repository.

Once the configuration packages have been created, all that’s left to do is assign them to the relevant hosts (either directly or via their Organizational Unit) for the policy to take effect.

8.3.2. Creating agent configuration packages

Note

The simplest and most flexible way to deploy WAPTWUA across your fleet is to use a dynamic agent configuration package (Host agent dynamic configuration).

Why use this method rather than configuring the wapt-get.ini file on each host:

• It allows granular configuration, which can differ by host or by Organizational Unit (OU);

• It is easy to maintain: the package can be edited at any time to add, remove, or change a behavior.

Hint

To test a configuration before rolling it out to the whole fleet, you can set the default maturity of the WAPTWUA package to PREPROD and assign it only to a small sample of machines. More information about maturities here.

To create these packages, go to the Package Inventory tab (1) in the WAPT Console, then Make package template from setup file (2) → Host agent dynamic configuration (3).

Create configuration package

Steps to Edit a Configuration Package:

Package for workstation

Create configuration package for workstation

1. Set the package details:

• Enter a name. (1)

• Select the maturity level. (2)

2. Configure the parameters:

• Choose the desired configuration panel, here it is WAPTWUA. (3)

• Check Manage Windows Updates with WAPT. (4)

• Check Allow all Updates by default unless explicitly forbidden by rules. (5)

• Enter 2d in Scan / download scheduling. (6)

• Enter 5d in Installations scheduling. (7)

3. Save your changes:

• Click Save to apply the configuration. (8)

Package for server

Create configuration package for server

1. Set the package details:

• Enter a name. (1)

• Select the maturity level. (2)

2. Configure the parameters:

• Choose the desired configuration panel, here it is WAPTWUA. (3)

• Check Manage Windows Updates with WAPT. (4)

• Uncheck Allow all Updates by default unless explicitly forbidden by rules. (5)

• Enter Critical in Allowed Severities. (6)

• Enter 2d in Scan / download scheduling. (7)

• Enter 10d in Installations scheduling. (8)

• Enter 5d in Minimum delay before installation. (9)

3. Save your changes:

• Click Save to apply the configuration. (10)

8.3.3. Installing the packages on hosts

Once your configuration packages are ready, assign them to the relevant hosts or Organizational Units:

1. In the WAPT Console, select the target host(s) or OU.

2. Add the configuration package as a dependency, as described in adding a package dependency on the workstation(s).

3. Trigger an inventory update on the host(s) (or wait for the next scheduled one) so the package gets installed.

Verifying the configuration was applied

Once the package is installed on a host:

• Check the host’s Windows Update tab in the console: when the scan is done it should now list the pending updates according to the policy you defined (all updates for workstations, only Critical ones for servers).

• You can also right-click the host and use Trigger the scan of pending Windows Updates to force an immediate scan and confirm the configuration is taken into account.

Congratulations. You now have a fleet of hosts that will automatically scan, download, and install updates according to a configuration tailored to your company.

8.4. Going further

This page only covers getting started with WAPTWUA. The complete documentation (Using WAPT Windows Update Agent (WAPTWUA) ) covers, among other things:

• The three governance models (allowlist, blocklist, hybrid).

• Managing the Windows Update scan mode (WAPT mode, WU mode, or WSUS mode).

• Managing major version upgrades, drivers, and out-of-band (OOB) updates.

• Operation in offline mode (WUA offline) for servers without Internet access.