WSUS Computer group design and testing best practices

i've inherited responsibility of updates our organization pc's only, not servers. have 17 wsus servers support >33k desktop devices across ~85 physical locations. have not been proactive our updates @ all, unless there specific need patch didn't patch. looking more proactive.  our current computer group tree "ugly". there separate group each ad ou, corresponds geographical location.  i'm thinking want rid of these groups , create prod , test group using gpo apply workstations prod segment out our test devices gpo. thought approve updates our corporate offices (about 10% sample) test, approve rest of company 2 weeks later pending no issues. approving critical , security updates.  thoughts on design / setup?

hi,


if structure simple, , satisfy basic approving for all critical , security among client said, why not make group imimum possible?if involving with the server,i suggest @ least keep "client" group , "server" group apart due different patchment policy(for example,in company, admins customize gpo for  "server" group allowed patch manually lower-right installation noticfication due automatic reboot).
if pc's only, suggest testing update using lab/test pc,and not use 10% sample pc in production environment testing purpose.


best regards,

clarence

---

please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread.

Windows Server  >  WSUS