The excepted text below was taken from Chapter 8 of Creating the Secured Managed Desktop: Using Group Policy, SoftGrid, Microsoft Deployment Toolkit, and Other Management Tools, written by Jeremy Moskowitz and contributed to by Greg Shields. Get your copy on Amazon here, or from Jeremy's web site here.

...In today's excerpt we'll shift the conversation to a talk about the two different ways that you can target your clients for update distribution...

As we talked about earlier in this chapter, WSUS has its own internal groups that can be used to separate clients. But you should be aware that WSUS groups are not Windows-style Active Directory groups.

They are used only within WSUS to separate clients. This is most often done to provide for multiple patch schedules or to separate out approvals. Since some groups will likely require some patches and others will not, dividing clients into multiple groups can be helpful in approving only the necessary updates for each type of client.

There are two different ways [Client Side Targeting and Server Side Targeting] in which clients can be added into groups in WSUS. Depending on the processes and procedures of the IT department, the structure of Organizational Units in the domain, and the desire of administrators, either type of targeting can be used.

Client targeting is configured in two places, in the WSUS console and also within Group Policy. The configuration must match between the two locations for targeting to work properly. First, from within the WSUS console, click Options | Computers.

There, you can select the option "Use the Update Services console" or "Use Group Policy or registry settings on computers." Using the console to assign clients into groups is called Server Side Targeting, while using Group Policy to assign clients is called Client Side Targeting.

On Friday we'll conclude this series and go into greater detail about these two types of client targeting on your WSUS server...