Patch Management In Networks With 100 Computers

Here are 2 comprehensive docs from Microsoft. http://www.microsoft.com/technet/itsolutions/cits/mo/swdist/pmsms/2003/pmsms031.mspx http://www.microsoft.com/technet/itsolutions/cits/mo/swdist/pmsus/pmsus251.mspx

But more importantly tell everyone what worked for you. Just add your raw information here. Someone else will organize it and will make it pretty.

Things to talk about?

How do you deploy Service Packs?
How do you organize computers in AD?
How often you deploy updates?
How do you train your staff?

Comments:

From DBurns - 3/11/09 11:36 AM

- I deploy to 10 PCs initially, and then the rest
- Test group, Main group
- Critical immediatly,Recommended as needed
- No other IT staff

How do you deploy Service Packs?

How do you organize computers in AD?

How often you deploy updates?

How do you train your staff?

From CraigF - 10/31/06 12:24 AM

I've relocated the WSUS Configuration document (mentioned above) to: http://www.intense.com.au/WSUSconfiguration.doc

Please note that the instructions were written more from a Win2K perspective so you may need to take that into consideration with some of the steps (one day I'll get them updated). The central idea behind the configuration is using WSUS computer groups to "stage" roll out the updates, and managing the allocation of computers to the various staging groups by using AD and Group Policies.

I must say that, since I wrote that document I've found Microsoft's updates to be a lot more reliable, so we now have the Desktops and Notebooks groups also configured for Automatic Approval for Installation (not just the Test Group as speciifed in the document) to minimise some of the manual approval process.

From Calis - 8/8/06 6:35 PM

Hi, just a few quick answers to the above questions. We have 400 windows clients and 40 windows servers.

How do you deploy Service Packs?

We user WSUS for all Windows related updates and patching but not for Service Packs. I ususally want a litlte bit more control particularly becuase we have a large WAN with 40 odd sites and some slow links and SP's can be failry large. I user Altiris Deployment server which allows me to schedule the SP and wake up/shutdown computers as needed. It also gives some good error contorl and allows me to distribute the SP's across the network.

How do you organize computers in AD?

Lots and lots of OU's. Example: Business Unit with seperate containers for BU User and BU computers

It means I can apply fairly granular GPO's, plus iuse block inheritance eaiser. Service and Admin accounts are in there own OU's, Member sevrers in another etc etc

How often you deploy updates?

If they are critical within the first week of release. If not at my own discresion.

How do you train your staff?

Make sure everything is documented and has a procedure to the best of my ability but the best way is one on one for a day or half a day just going through stuff people want to know or are not very familiar with. Basically connecting the dots for them. If its new technology they get briefed as soon as possible.

From ewall - 4/12/06 10:04 AM

Nice Group Policy notes, Craig... I think I'll share this with my colleagues.

From CraigF - 8/7/05 4:20 AM

We support SBS (Win2K and 2K3) for many of our clients and have just rolled out our first WSUS implementation. I must say I'm extremely impressed with what I've seen so far. I've documented the WSUS and AD/GPO configuration options that we'll (probably) be standardising on. It's available at http://www.intense.com.au/downloads/WSUSconfiguration.doc if anyone's interested in commenting on it.

Last Modified 4/15/05 3:04 AM

Hide Tools

Site
Changes
Index
Search

User
Log In
Register