.. Reminder for header structure:
  Parts (H1)          : #################### with overline
  Chapters (H2)       : ******************** with overline
  Sections (H3)       : ====================
  Subsections (H4)    : --------------------
  Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^
  Paragraphs (H6)     : """"""""""""""""""""
 
.. meta::
  :description: WAPT documentation version 2.7 Quickstart - Installing the WAPT Agent
  :keywords: Quickstart, WAPT, waptwua, wua

.. role:: red
   :class: red-text

.. _quickstart_waptwua:
 
###############################################
Quickstart - WAPTWUA Setup |enterprise_feature|
###############################################
 
.. hint::
 
  This page is a quickstart tutorial to get started with WAPTWUA. For complete and detailed documentation (governance models, WSUS proxy mode, driver management, offline mode, etc.), refer to the :ref:`wapt_wua` page.

.. note::

  WAPTWUA is a feature of **WAPT Enterprise**. Please ensure you have the correct licence before starting this tutorial.

*******************
Overview of WAPTWUA
*******************
 
:abbr:`WAPTWUA (WAPT Windows Update Agent)` allows WAPT to manage Windows Updates across your fleet.
 
WAPTWUA lets you:
 
* Centralize and drive the deployment of Windows Updates from the WAPT Console.
 
* Only allow the KBs you validate (or, conversely, allow everything except specific exceptions), depending on the governance model chosen.
 
* Limit bandwidth and disk space usage, since only the updates actually needed by the hosts in your fleet are downloaded.
 
* Schedule the scan, download, and installation of updates, on a per-host or per-group basis.
 
Standard operation
==================
 
WAPTWUA relies on three actors:
 
1. **Microsoft** publishes an index file, :file:`wsusscn2.cab`, on each *Patch Tuesday*, listing all available updates.
 
2. **The WAPT Server** automatically downloads this file (by default, once a day) and makes it available to its agents.
 
3. **The WAPT Agent** (on each host) retrieves this file and uses it via the Windows Update Agent API to determine which updates it needs, then sends this list to the WAPT Server.
 
4. If an update required by a host is not yet present on the WAPT Server, the server will download it from official Microsoft servers and make it available to the agent.
 
.. note::
 
  Unlike WSUS, which by default downloads all updates for the selected categories, WAPTWUA **only** downloads updates that have actually been requested by at least one host in the fleet. This keeps the update database lightweight (a few tens of GB) and easy to clean up.
 
******************
How to enable it ?
******************
 
Server prerequisites
====================
 
* The waptwua option must have been enabled when generating :file:`waptserver.exe`. In the screenshot below, you can see that the "enable WUA" option is enabled.
 
.. figure:: wapt-resources/wapt_deploy_additional-configuration-server_dialog-box.png
  :align: center
  :alt: Choosing the installer options for deploying the WAPT Server
 
* The WAPT Server must have outbound Internet access (ports 443 and 80) to the following Microsoft domains in order to download the :file:`wsusscn2.cab` file as well as the updates themselves:
 
.. white_toggle::
  :titleen: Firewall outbound
  :titlefr: accès sortant du firewall
 
  In order to make WAPTWUA work, The WAPT Server must have access to;
 
    * windowsupdate.microsoft.com
    * ..windowsupdate.microsoft.com
    * ..update.microsoft.com
    * windowsupdate.com
    * download.windowsupdate.com
    * download.microsoft.com
    * wustat.windows.com
    * ntservicepack.microsoft.com
    * go.microsoft.com
    * dl.delivery.mp.microsoft.com
 
  .. hint::
 
    If the WAPT Server does not have direct Internet access, a proxy can be configured in :file:`waptserver.ini`, or the procedure described in the :ref:`WUA offline section of the documentation <waptwua_offline>` can be used instead.
 
Enabling it on the agent
========================
 
Activation is done in the WAPT Agent's :file:`wapt-get.ini` file, in the ``[waptwua]`` section, by setting at least the ``enabled`` parameter:
 
.. code-block:: ini
 
  [waptwua]
  enabled = True
 
This is enough for the agent to start scanning for upcoming Windows Updates. There are, however, many other parameters (download and install scheduling, deployment delay, allowed severities, etc.) which are detailed in the complete documentation.

*************************************************
How to set it up on your fleet (concrete example)
*************************************************
 
Example: a fleet with workstations and servers
==============================================
 
Let's take a fleet made up of two types of machines: workstations and servers. We want to apply a different policy to each:
 
* **Workstations** can automatically receive all updates offered by Microsoft, with a relatively frequent scan and install cadence.
 
* **Servers**, being more sensitive, should only automatically receive critical updates, with a safety delay before installation.
 
In practice, we will create two configuration packages, for example:
 
.. list-table::
  :header-rows: 1
  :widths: auto
 
  * - Parameter
    - Workstations
    - Servers
    - Description
  * - ``enabled``
    - True
    - True
    - Enables or disables WAPTWUA on this host.
  * - ``default_allow``
    - True (everything allowed)
    - False (nothing allowed except exceptions)
    - Defines whether missing updates are authorized by default.
  * - ``allowed_severities``
    - (not applicable, everything is allowed)
    - Critical (only Critical is allowed)
    - Defines a severity list that will be automatically accepted.
  * - ``download_scheduling``
    - 2d
    - 3d
    - Defines the Windows Update scan and download recurrence.
  * - ``install_scheduling``
    - 5d
    - 10d
    - Defines the Windows Update install recurrence.
  * - ``install_delay``
    - (none) (the KB is installable as soon as it is published)
    - 5d (minimum lifetime of the KB)
    - Defines a deferred installation delay after publication in the Microsoft repository.
 
Once the configuration packages have been created, all that's left to do is assign them to the relevant hosts (either directly or via their Organizational Unit) for the policy to take effect.
 
Creating agent configuration packages
=====================================
 
.. note::
 
  The simplest and most flexible way to deploy WAPTWUA across your fleet is to use a **dynamic agent configuration package** (*Host agent dynamic configuration*).
 
  Why use this method rather than configuring the :file:`wapt-get.ini` file on each host:
 
  * It allows **granular** configuration, which can differ by host or by Organizational Unit (OU);
 
  * It is **easy to maintain**: the package can be edited at any time to add, remove, or change a behavior.
 
  .. hint::
 
    To test a configuration before rolling it out to the whole fleet, you can set the default maturity of the WAPTWUA package to ``PREPROD`` and assign it only to a small sample of machines. More information about :ref:`maturities here<maturities_video>`.
 
To create these packages, go to the *Package Inventory* tab :red:`(1)` in the WAPT Console, then :guilabel:`Make package template from setup file` :red:`(2)` → :guilabel:`Host agent dynamic configuration` :red:`(3)`.
 
.. figure:: wapt-resources/quickstart-create_config_package.png
  :align: center
  :scale: 75%
  :alt: Create configuration package
 
  Create configuration package
 
**Steps to Edit a Configuration Package:**
 
.. tab-set::
 
  .. tab-item:: Package for workstation
 
    .. figure:: wapt-resources/quickstart-create_config_package_workstation.png
      :align: right
      :scale: 75%
      :alt: Create configuration package for workstation
 
      Create configuration package for workstation
 
    1. **Set the package details:**
 
    - Enter a **name**. :red:`(1)`
    - Select the **maturity level**. :red:`(2)`

    2. **Configure the parameters:**
 
    - Choose the desired **configuration panel**, here it is WAPTWUA. :red:`(3)`
    - Check ``Manage Windows Updates with WAPT``. :red:`(4)`
    - Check ``Allow all Updates by default unless explicitly forbidden by rules``. :red:`(5)`
    - Enter ``2d`` in ``Scan / download scheduling``. :red:`(6)`
    - Enter ``5d`` in ``Installations scheduling``. :red:`(7)`
 
    3. **Save your changes:**
 
    - Click :kbd:`Save` to apply the configuration. :red:`(8)`
 
  .. tab-item:: Package for server
 
    .. figure:: wapt-resources/quickstart-create_config_package_server.png
      :align: right
      :scale: 75%
      :alt: Create configuration package for server
 
      Create configuration package for server
 
    1. **Set the package details:**
 
    - Enter a **name**. :red:`(1)`
    - Select the **maturity level**. :red:`(2)`
 
    2. **Configure the parameters:**
 
    - Choose the desired **configuration panel**, here it is WAPTWUA. :red:`(3)`
    - Check ``Manage Windows Updates with WAPT``. :red:`(4)`
    - Uncheck ``Allow all Updates by default unless explicitly forbidden by rules``. :red:`(5)`
    - Enter ``Critical`` in ``Allowed Severities``. :red:`(6)`
    - Enter ``2d`` in ``Scan / download scheduling``. :red:`(7)`
    - Enter ``10d`` in ``Installations scheduling``. :red:`(8)`
    - Enter ``5d`` in ``Minimum delay before installation``. :red:`(9)`
 
    3. **Save your changes:**
 
    - Click :kbd:`Save` to apply the configuration. :red:`(10)`
 
Installing the packages on hosts
================================

Once your configuration packages are ready, assign them to the relevant hosts or Organizational Units:

1. In the WAPT Console, select the target host(s) or OU.
2. Add the configuration package as a dependency, as described in :ref:`adding a package dependency on the workstation(s) <adding_package_dependency>`.
3. Trigger an inventory update on the host(s) (or wait for the next scheduled one) so the package gets installed.

**Verifying the configuration was applied**

Once the package is installed on a host:

* Check the host's **Windows Update** tab in the console: when the scan is done it should now list the pending updates according to the policy you defined (all updates for workstations, only Critical ones for servers).
* You can also right-click the host and use :guilabel:`Trigger the scan of pending Windows Updates` to force an immediate scan and confirm the configuration is taken into account.

**Congratulations. You now have a fleet of hosts that will automatically scan, download, and install updates according to a configuration tailored to your company.**

*************
Going further
*************
 
This page only covers getting started with WAPTWUA. The complete documentation (:ref:`wapt_wua`) covers, among other things:
 
* The :ref:`three governance models <wapt_wua_agent>` (allowlist, blocklist, hybrid).
* Managing the :ref:`Windows Update scan mode <wsus-x-wapt>` (WAPT mode, WU mode, or WSUS mode).
* Managing major version upgrades, drivers, and :ref:`out-of-band (OOB) updates <simple_msu_packaging>`.
* Operation in :ref:`offline mode (WUA offline) for servers without Internet access <waptwua_offline>`.
