How does WSUS work?

Question

System administration

1. According to the manual, vsus should reduce external traffic. Type update is downloaded once on a server, and then computers will download updates from the vus. Suppose before connecting to VUS, I manually update Windows to 64 bit ten 10 10.0.16299.15 Version 1709 Updated Sept 2017 RU. It turns out that I don’t need those that have come out up to this point, but I just want to download them. How to optimize this process?
2. Products. The server is planned to be used for 2 types of operating systems: win10 corporate and LTSB. Office 2016 x64 is also installed on client computers. What products should I choose in the settings vsus? It's clear that you need to choose an office and Windows 10. But there are 15 different products that contain the words "windows 10". It is also explicitly required to select windows defender, IE. What else? maybe you need to update pc health, do I need health?
3. Classes. With classes it is even more mysterious and incomprehensible. How are upgrades different from updates? (sorry, but I have a Russian Windows). As far as I know, Microsoft releases various utilities that help solve certain problems, but they never came to me in the form of updates.
4. Drivers. Here is the worst. Microsoft offers to download all the drivers that are available. And, as I understand it, all versions are downloaded. What for?
5. If I don't check a class, product, or language checkbox, updates won't be downloaded/installed at all?
6. How is vsus used in practice? Maybe there are some extended manuals, where its use is chewed in more detail, and not a banal setting? In theory, I just need a caching server so as not to download the same thing to everyone, with the ability to block and delete certain updates (for example, the recent update KB4011039 broke tables in word), but it turns out some kind of Frankinstein monster.

Answer 1

A. Updates have statuses: approved, not approved, rejected.
A0. Updates are required, recommended, optional.
A1. Approvals are put down manually and automatically according to the configured rules. This happens quite flexibly, there is a default rule that approves mandatory updates and security updates for all selected products.
B. Updates are downloaded only those that are approved.
Now the answers
are 1. It's up to you, but if a PC appears from the old version, it somehow needs to be rolled up, i.e. in the end, still download. You can not set the approved status of the update, then it will not download.
2. On the second question, I won’t tell you because we don’t use 10.
I spied on my wsus, based on the fact that you need 10 corp and ltsb, choose the following products in my opinion:
Windows 10 ltsb, windows 10, windows 10 and later drivers, windows 10 and later upgrade & servicing drivers.
3. Upgrade is an update that allows you to download a package that includes tools to upgrade to a more recent version of the product. Utilities .. you need to look at wsuse tomorrow. I'll post a comment tomorrow.
Utilities in the context of wsus is the "Tools" class. I have a check mark, but I can not say for sure whether it is used as such or not.
4. The driver, like any update, is approved or not. The wsus client sends information to the server in the form of reports periodically, which are used by wsus to determine the need for a particular driver and/or update packages. Approve for installation, download, install, do not approve, it will not download and, accordingly, the client will not know that there is some kind of driver.
5. New packages will not download, and the old ones will remain in the database. There are cleaning mechanisms, with the help of these mechanisms, unused / obsolete packages are removed
6. Everything is in your hands - as I already wrote, everything depends on how updates are approved, if some update breaks something, you can always find it in the database and change it status (do not install, do not install and remove from those who have already downloaded it)
Unfortunately, I will not give specific sources that would help you, because. I dealt with many things myself, if you have questions, ask, it’s easier to help pointwise when you already have some experience and something doesn’t work out.

Answer 2

https://gallery.technet.microsoft.com/Windows-Serv...
Sorry I inserted the wrong link:
download.microsoft.com/download/3/4/F/34F1F24F-4A0...
1. "When your WSUS server synchronizes for the first time, it will download all of the updates you specified
when you configured synchronization options" - page 13
and so on. - there is also a description of the classes, all information in a dry reference format.