? Best ways to install Microsoft patches over the network??

We've recently had the Nachi virus (a variant of the Blaster worm) and as such we've obviously kicked our own arses with regards to staying up to date with Microsoft security patches etc.

thing is, we've got 50 workstations (and counting) and 3 servers. We've been putting updates/patches for Windows on individual machines but as you can imagine this is very time consuming.

Does anyone know of any way to automate the installation of patches for windows and other windows programs - over the network.

By the way, someone suggested that we just get users to do it themselves - however for most microsoft patches we've found that you need Admin privileges to do this.

any ideas would be greatly appreciated.

 

SMS (system management server) will allow you to push all sorts of installs over the network. And you can automate things so it will push a patch (or series of patches) to any or all of your users.

I know there are other automated packages that will do the same but SMS is the only one I have hands-on experience with.

Another approach if you want to apply all applicable patches to all the workstations would be to get BigFix. I've only used the individual (and free) single-PC version but they make network packages with lots more features. Just gotta pay for it. Based on how their single-PC version performs, it would probably be an excellent package.

If you decided to go with the individual PC version and let the users simply click on any updates that were presented (and it will offer only those appropriate to the OS version), you could start BigFix using runas and an admin account.

 

You need SUS - Software Update Services. This is like an internal version of Windows Update and if a free download from Microsoft.
What you do is install it on a machine and that machine downloads all the updates. You can then approve or deny the updates.

Then you configure all of your machine to look at this server instead of the external Windows Update and they get their updates internally.

If you are using a Windows 2000 AD domain then you can use Group Policy to configure all the machines centrally.
Furthermore, if your machines are on Windows XP or Windows 2000 SP3 or higher, then you can configure Automatic Updates to download and install the updates automatically, no user interaction required.

I would take a look at http://www.susserver.com for more information on setting it up and deploying SUS Server.

Simon.