The excepted text below was taken from Chapter 8 of Creating the Secured Managed Desktop: Using Group Policy, SoftGrid, Microsoft Deployment Toolkit, and Other Management Tools, written by Jeremy Moskowitz and contributed to by Greg Shields. Get your copy on Amazon here, or from Jeremy's web site here.

...today's excerpt concludes our series from the book on WSUS and finishes our discussion on the two (actually, three) types of targeting that are possible with WSUS...

Server Side Targeting

Server Side Targeting is really a fancy way to say, "Let me just drop my machines into the groups myself within the WSUS management console." When doing this, ensure that the Enable Client Side Targeting setting is disabled and the radio button is set to "Use the Update Services console." New computers will be automatically positioned in the Unassigned Computers group within the WSUS console and must manually be moved to the correct group by an administrator.

Client Side Targeting
In the "Computer Configuration Settings" section, we discussed the Enable Client Side Targeting setting. Enabling that setting also allows you to enter the name of a group for the machines that are assigned the Group Policy Object. When this setting is enabled, the setting in WSUS should be set to "Use Group Policy or registry settings on computers."

When the OU structure for the domain mimics the group structure you wish your WUA clients to follow, Client Side Targeting is an effective tool to automatically drop clients into the proper groups based on their OU membership. However, when the OU structure is much different than the desired WSUS structure, Server Side Targeting should be used.

Multiple Targeting
When using Client Side Targeting in WSUS 3.0, it is possible to assign machines into multiple groups by separating group names with a semicolon when configuring the Group Policy Object. Once the GPOs have been embraced by the client and clients have contacted the WSUS server, they will appear in multiple locations within the WSUS console as targeted within Group Policy. This is handy for clients that may play multiple roles or that operate as both production as well as patch-testing machines.

If you've enjoyed this series and want to learn more about how you can control your desktops through tools like Group Policy, SoftGrid, and the Microsoft Deployment Toolkit, as well as WSUS and MBSA, grab your own copy from Amazon at this URL: http://www.amazon.com/Creating-Secure-Managed-Desktop-Deployment/dp/0470277645.