Overview

GFI LanGuard is able to use the repository of a WSUS (Windows Server Update Services) server in the network.

• When this feature is enabled, GFI LanGuard uses the WSUS server as an additional repository for updates. The updates are copied directly from the WSUS Server to the target machines being remediated. GFI LanGuard doesn't copy the updates to its repository.
• If an update is not available in WSUS repository and it is downloaded by GFI LanGuard, then the patch is saved to the GFI LanGuard repository and not the WSUS repository. In this situation, if the update is downloaded by WSUS at a later stage, the same update is found in both repositories.

NOTE: For secure environments see the article: Updating GFI LanGuard If in a Secure Network

This article guides you on how to configure GFI LanGuard to use a WSUS server for the patch repository.

Process

Configuring WSUS to Use the Patch Repository

1. Go to GFI LanGuard > Configuration.
2. Expand the Software Updates node.
3. Right-click the Patch Auto-Download node and select the Edit Patch Auto-Download Options.
4. Select the Patch Repository tab and enable Use Files Downloaded by WSUS When Available.
5. Specify the path of the WSUS content folder.

NOTES:

• The path of the WSUS repository can either be a local folder or a UNC path.
  Example: \\Server01\WsusContent
• Do not use a mapped drive. Mapped drives are not available to other accounts like the LanGuard Attendant Service Account.
• The GFI LanGuard Attendant Service Account must have permissions to access the WSUS directory.

Allowing Access to WSUS Server

1. Enable patch Auto-Approval.
2. If the WSUS server resides on a different domain than the GFI LanGuard Attendant Service Account, follow the procedure below to allow access:
   1. Enable the guest account.
   2. Add the Everyone group to both the share and the security permissions.
   3. In the local security policy editor secpol.msc configure the following policies:
      • Network Access: Named Pipes that can be accessed anonymously = (add) sharename
      • Network Access: Shares that can be accessed anonymously = (add) sharename

Resources

Windows 2008 R2 domain - How to allow anonymous access to 1 folder share?