WSUS on a Domain Controller

Is it against "Best Practices" to install WSUS on a Domain Controller? What
are the potential risks if it is installed?

"CK" <CK@discussions.microsoft.com> wrote in message
news:B157896A-0BBB-4D95-9445-25D29359598A@microsoft.com...
> Is it against "Best Practices" to install WSUS on a Domain Controller?
> What
> are the potential risks if it is installed?

Not particularly. Usually the practice is to avoid installing unnecessary
services on a DC.

Installing SUS requires both IIS and the SUS itself so that is two
services and IIS has been the source of more successful attacks
on Windows than probably any other major component.

IF you don't have additional servers then doing so isn't particular
awful but not my first choice.

--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)

Best Practice is to have a DC be a DC and nothing else. As Herb says,
WSUS requires installing services like IIS that can be a security
exposure. Also, disaster recovery becomes very problematic.

Having said that, it's clear that it's supported and will work. Just not
a good idea...

Regards,
Hank Arnold

CK wrote:
> Is it against "Best Practices" to install WSUS on a Domain Controller? What
> are the potential risks if it is installed?