MCSE/MCSA Implementing and Administering Security in a Windows 2000 Network: Study Guide and DVD Training System (Exam 70-214)

Identifying Required Updates

• The Microsoft Network Security Hotfix Checker, HFNetChk, is a command-line tool that can be used to quickly and efficiently scan all the computers on your network (or any smaller group) for missing updates.

• The Microsoft Baseline Security Analyzer, MBSA, can also be used to help you determine your computers' current needs. The MBSA can be run from either the GUI or from the command line and includes fairly detailed information about each update that needs to be applied.

• Single computers or small groups of computers can use Windows Update to identify (and download) required updates.

Deploying and Managing Updates

• Use the Windows Update Web site to update small groups of computers or computers that are not connected to the main organizational network.

• Using the Windows Update Catalog, you can select and download the updates of your choosing. You can later deploy them by any means you like, including scripting or manual installation.

• The Software Update Service and the Automatic Updates client work together to allow you to automatically download updates from the Windows Update servers. No downloaded updates can be installed on a client computer until they have been approved for release by an administrator. Automatic Updates, configured from Group Policy, can then either silently install any approved updates or prompt the computer user for action.

• Dedicated software management packages, such as Systems Management Server, can also be used to deploy updates to client computers.

• Take great care in applying updates to servers. Ensure that you have thoroughly tested the update and have a solid backout plan in place before starting to update any server. Update servers in waves to allow you time to observe their performance (in small groups) after they are updated.

Troubleshooting Update Installations

• Always ensure that updates are applied by users with the correct credentials or, if updating by automated means, by a system account with the correct credentials.

• Use of the Qchain.exe tool can help prevent versioning issues.

• Should an update have undesirable effects on a computer, you should remove the update from the computer as soon as possible and conduct further testing on it.

• A solid, proven disaster recovery plan is of critical importance when it's time to upgrade computers. Finding out after the fact that the plan doesn't work is never the right time.