Microsoft Windows Server 2003 Unleashed (R2 Edition)

Service packs (SPs) and updates for both the operating system and applications are vital parts to maintaining availability, reliability, performance, and security. Microsoft packages these updates into SPs or individually.

There are several ways an administrator can update a system with the latest SP or update: CD-ROM, manually entered commands (see Table 22.1 and Table 22.2), Windows Update, or Microsoft Software Update Server (SUS).

Note

Thoroughly test and evaluate SPs and updates in a lab environment before installing them on production servers and client machines. Also, install the appropriate SPs and updates on each production server and client machine to keep all systems consistent.

Windows Update

Windows Update, shown in Figure 22.10, is a Web site that scans a local system and determines whether there are updates to apply to that system. Windows Update is a great way to update individual systems, but this method is sufficient for only a small number of systems. If administrators choose this method to update an entire organization, there would be an unnecessary amount of administration.

Software Update Services

Realizing the increased administration and management efforts administrators must face when using Windows Update to keep up with SPs and updates for anything other than small environments, Microsoft has created the Software Update Services (SUS) client and server versions to minimize administration, management, and maintenance of mid- to large-sized organizations. Figure 22.11 illustrates the SUS interface. SUS communicates directly and securely with Microsoft to gather the latest SPs and updates.

The SPs and updates downloaded onto SUS can then be distributed to either a lab server for testing (recommended) or to a production server for distribution. After these updates are tested, SUS can automatically update systems inside the network.

Note

You can find more information on SUS and download the product from http://www.microsoft.com/windows2000/windowsupdate/sus/.

Maintaining Consistency

Maintaining a consistent level of patches and security fixes across an organization is a challenge. These challenges can be minimized if you're using SUS. If you're not using SUS, Microsoft provides other utilities to make maintenance and management of SPs and updates easier. They include but aren't limited to the following:

• QChain This utility safely chains updates together to allow multiple updates to be installed with only one reboot.

• Microsoft Security Notification Service Subscribing to this service ensures that administrators will be notified as security-related updates become available.

• Microsoft Baseline Security Advisor (MBSA) MBSA is both a graphical and command linedriven tool that improves upon the capabilities of the HFNetCHK tool. It scans for common system security misconfigurations (in products such as Windows, IIS, SQL Server, Internet Explorer [IE], and Office) and missing security updates for other products as well.