'Specify intranet Microsoft update service location' (WUStatusServer) This policy setting allows you to specify an intranet server to host updates from the Microsoft Update Web site. You can then use this update service location to automatically update computers on your network. The Automatic Updates client will search this service for updates that apply to the computers on your network. To use the Specify intranet Microsoft update service location setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. If you enable the Specify intranet Microsoft update service location setting, the Automatic Updates client will connect to the specified intranet Microsoft update service server (instead of Windows Update) to search for and download updates. This configuration allows end users in your organization to avoid firewall issues, and provides you with an opportunity to test updates before you deploy them. If you disable or do not configure this policy setting, the Automatic Updates client will connect directly to the Windows Update site on the Internet (if Automatic Updates is not disabled by Group Policy or user preference). Counter Measure: Configure the Specify intranet Microsoft update service location setting to Enabled. Then specify the intranet update server's name and the statistics server's name in the Properties dialog box. Potential Impact: Critical updates and service packs will have to be proactively managed by the organization's IT staff.

(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\WUStatusServer,WUServer