Is your patch programme up to scratch?

• Tags:
• Hole,
• Security,
• Vulnerability,
• Patch

Deb Shinder

Published: 27 May 2005 11:10 BST

• 
• 
• 
• 
• 

Group Policy Software Installation gives you a way to deploy software to multiple machines from a centralised location, but it doesn't provide a way to get the updates in the first place. What you need is a way to combine the automatic download aspect of Windows Update's Automatic Update and the administrative control of GP Software Installation. That's what you get with Microsoft's Software Update Service or SUS (soon to be replaced by a new version called Windows Server Update Service or WSUS).

NOTE: The release candidate of WSUS had been made available. In its beta form, WSUS was called Windows Update Services or WUS. The final release is expected sometime in the second quarter of 2005.

With SUS and WSUS, you set up your own internal update server on the network (running on a Windows 2000 or 2003 server). That server downloads updates from Microsoft, then your network clients download the updates from the SUS/WSUS server. As the administrator, you have control over which updates are approved for installation on the client machines. You can choose whether to download all the updates and store them locally on the SUS/WSUS machine or they can be pulled directly from the Microsoft public server when they're approved for installation.

WSUS is designed with added scalability in mind. In addition to updating Windows operating systems (as SUS does), it can update other Microsoft products such as Office, SQL Server, and Exchange. Update support for other products will be added, without any requirement for you to upgrade WSUS.

Another important scalability feature is that you can install WSUS on Windows Small Business Server (SBS) 2003, so if you are using SBS instead of the regular Windows server products, you can still use it.

WSUS also scales up well, as you add testing requirements for patches. You can mark patches as Not Approved until you've tested them, or you can mark them as Declined to remove them from your updates list (although you can still get them back if necessary). WSUS can detect what updates are needed, but it will also work in conjunction with more comprehensive third party vulnerability scanners that detect patch status.

Finally, WSUS's scalability is enhanced by the fact that it's free. As long as you have licences for the Windows server(s) on which your WSUS server(s) run, and CALs for the clients that connect to it, there's no extra charge for the WSUS software or the update service.

• 
• 
• 
• 

• Share this article:
• Digg
• Slashdot
• Del.ici.ous
• Stumble
• Reddit

• Most Recent
• Most Popular
• Most Discussed