Microsoft Windows Security Resource Kit

SMS Software Update Services Feature Pack

The SMS Software Update Services Feature Pack provides the ability to determine the security update status for SMS clients and distribute and install the necessary updates to them. In addition, the feature pack provides reporting tools that allow the creation of detailed reports outlining your company s security update distribution.

The SMS Software Update Services Feature Pack provides stronger management capabilities than any of the other patch management solutions because it allows you to target specific computers within the company for security updates. Likewise, by leveraging the capabilities of SMS 2.0, you can perform the following:

• Identify all computers on the network.

  SMS inventory capabilities allow you to identify all computers connected to the corporate network, identify installed applications, and determine current security updates.

• Schedule the deployment of security updates.

  SMS software can distribute identified security updates to SMS clients during nonpeak hours.

• Enable status reporting.

  SMS queries can determine the progress of security update distribution to identify computers that have not yet received and installed critical updates.

• Enable local distribution of updates.

  SMS allows security updates to be replicated to multiple software distribution servers. This allows clients to connect to local or nearby software distribution servers for security update installations.

• Enable support for more operating systems.

  All SMS clients not just Windows 2000 based and Windows XP based computers can receive security updates by using the SMS Software Update Services Feature Pack.

The SMS Software Update Services Feature Pack is comprised of four tools for the distribution of security and Microsoft Office software updates:

• Security Update Inventory tool

  Creates an inventory of security updates for each SMS client computer. The inventory identifies current and missing security updates for each computer and stores the results in the SMS inventory. The Security Update Inventory tool is comprised of three components:

  • Security Update Inventory Installer

    Runs on the SMS site server and builds the packages, collections, and advertisements to deploy other SMS tool components to SMS clients.

  • Security Update Inventory tool

    Uses MSSecure.xml and MBSA to carry out security scans of SMS client computers for installed or required security updates. The resulting data is converted into SMS inventory data.

  • Security Update Sync tool

    Runs on a single computer with Internet access. This computer checks with the Windows Update Web site to download the latest MSSecure.xml file.

• Microsoft Office Inventory tool

  Creates an inventory of installed and required Microsoft Office updates for SMS client computers. The Microsoft Office Inventory tool consists of three components:

  • Office Update Inventory Installer

    Runs on the SMS site server and builds the necessary packages, collections, and advertisements to deploy the other components required for Microsoft Office updates.

  • Office Update Inventory tool

    Performs scans of SMS client computers for installed or required office updates. The collected information is stored as SMS inventory data.

  • Office Update Sync tool

    Runs on a single, Internet-accessible computer. This tool downloads the latest Office Update Inventory tool and Office Update inventory database and uses SMS distribution points to deploy the latest versions to SMS client computers.

• Distribute Software Updates Wizard

  Performs the software and security update distribution tasks in the SMS environment. The wizard consists of three components:

  • Distribute Software Updates Wizard Installer

    Runs on the SMS site server and installs the Distribute Software Updates Wizard component.

  • Distribute Software Updates Wizard

    Analyzes the Microsoft Office update status for all SMS client computers based on the SMS inventory information. Once the status is determined, the wizard allows you to review and authorize updates for distribution, download updates, create packages and advertisements for each update, distribute advertisements to SMS clients, and deploy the Software Updates Installation Wizard (discussed next).

  • Software Updates Installation Wizard

    Evaluates advertised software updates against current updates on the client computer to ensure that only required updates are installed at the SMS client computer.

• SMS Web Reporting tool

  Provides the ability to create and view reports based on the inventory information collected by the software inventory tools. You can track the deployment of individual updates as well as the update status of a specific computer or group of computers. When this tool is used with the Web Report add-in for Software Updates, the software update inventory information can be viewed with a Web browser.