SBS 2011

http://www.microsoft.com/oem/en/products/servers/Pages/sbs_overview.aspx

http://www.techrepublic.com/blog/10things/10-things-you-should-know-about-microsoft-small-business-server-2011/2339

http://download.microsoft.com/download/4/5/C/45CD1DC6-9204-44DD-999B-24B50A9144B6/SBS%202011_Licensing_FAQ.pdf

Setup Guide: http://blog.mpecsinc.ca/2010/12/sbs-2011-setup-guide-v100.html

Administrative Tools → Task Scheduler → Task Scheduler Library → Microsoft → Windows → Windows Small Business Server

Right click Console task in the right windows and choose Disable.

SBS Console → Getting Started Tasks → Add a Trusted Certificate → I want to buy a certificate

If you want to buy a Wildcard Certificate, change remote.yourdomain.com to *.yourdomain.com.

You can modify the SMTP banner, perhaps to match a new SSL certificate, here:

Exchange Management Console → Microsof Exchange On-Premises → Server Configuration → Hub Transport → ServerName → Windows SBS Internet Receive Connector → General → Specify FQDN

http://technet.microsoft.com/en-us/library/cc527590.aspx

http://support.microsoft.com/kb/2532185

http://blogs.technet.com/b/sbs/archive/2011/03/18/how-to-configure-email-routing-to-sharepoint-in-sbs-2011.aspx

http://msmvps.com/blogs/bradley/archive/2011/01/31/so-you-use-another-patching-tool-and-don-t-want-wsus-on-your-sbs-2011.aspx

http://digitalbamboo.wordpress.com/2013/01/26/remove-wsus-from-sbs-2011/

• There is no auto-approve rule enabled by default on SBS 2011
• There is a setting in WSUS that only approved updates are downloaded by default
• The default for WSUS on SBS is that 'all products' are available for detection
  • But, by default, downloads for such products are only performed if the product:
    • Is detected as having been installed
    • Has a required patch
    • The patch is approved

1) Use the standard WSUS console to check that the above items are at default values. If you have a spare system or virtualization host it may be worthwhile doing a 'default install' of SBS to check such settings against.

2) Expose all updates in WSUS and set them to 'not approved'.

3) Expose the 'supersedence' column in the list of updates and sort on this. Select all 'superseded' (including those that both supersede and are superseded) and 'Decline' them.

4) Delete all subfolders under x:\WSUS\WsusContent (do not delete the WSUSContent folder itself, 'x:' is whatever drive).

As updates are detected as being required only those updates that are both detected as being necessary and get approved will be downloaded. Depending on settings, SBS will automatically approve some updates, this is controlled from the 'updates' area of the SBSConsole, 'Change software update settings'. (I set 'servers' to medium, 'clients' to high)

If you find that your WSUS settings are still at default the most likely cause of additional updates being downloaded is that someone has been using the native WSUS console and saw 'informational items' at the top of the WSUS console (ToDo) concerning 'x' updates have not been approved. They have manually exposed such list of updates and approved them. They have manually told WSUS to approve items that have not been detected as necessary on the network.

http://blogs.technet.com/b/sbs/archive/2009/09/23/how-to-move-wsus-content-and-database-files-to-a-different-partition.aspx

http://technet.microsoft.com/en-us/library/gg680316.aspx

http://kwsupport.com/2011/07/cleanup-wsus-database/

The wizard may run for a VERY LONG TIME, particularly if it's the first time.

You might run each cleanup option separately, starting with the last choice first.