Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Microsoft

Pushing Patches Across a Wide Area Windows Network? 70

Posted by Cliff from the dealing-with-the-vendor-imposed-patching-cycle dept.
meridian-gh asks: "Microsoft is releasing new patches and updates for their products continually. For those of us who have to deal with large, geographically diverse windows-based networks, managing patches can be a nightmare. You cannot trust the users to do it. Tools such as SMS and HFNetCHK Pro are neat, but incredibly expensive. Most free programs I have seen don't support Windows 98, which many of us are forced to deal with. My question is, how do you deal with the remote deployment of patches in a efficient (and cheap) manner?"
This discussion has been archived. No new comments can be posted.

Pushing Patches Across a Wide Area Windows Network? More

Pushing Patches Across a Wide Area Windows Network?

Comments Filter:
  • If you are going to pop the money for all those Windows licenses, licenses for SMS, or Zenworks or something isn't going to kill you. Or shouldn't if you budget properly. It's all part of the TCO. If the TCO of Windows is too high, perhaps it's time to look at something with a lower TCO.

    -Brent

    • Re:Sorry, but Windows is an expensive investment (Score:4, Insightful)

      by ConceptJunkie ( 24823 ) on Monday January 06, 2003 @09:00PM (#5029656) Homepage Journal
      I have a hard time sympathizing with management who would willingly use Windows 98, especially in the year 2003. Windows 98 was nothing but pain for me (I ran it on the kids' computer for a couple years). I switched it to XP Home and all my problems went away.

      Expense notwithstanding, the first thing I would do is upgrade to a _business_ operating system, i.e., Windows 2000. Windows 98 is oging to be dead soon anyway from what I understand. Microsoft is dead-ending their old software really agressively these days (of course, the same will be true for Windows 2000, which is a shame).

      After that, there are tons of solutions available.

      I know it's not realistic to expect PHB's to upgrade the OS, but in the next year or two it's going to be mandatory if you want continued support.

      • I have a hard time sympathizing with management who would willingly use Windows 98, especially in the year 2003. Windows 98 was nothing but pain for me (I ran it on the kids' computer for a couple years). I switched it to XP Home and all my problems went away.

        Speaking as someone who's dealt with a very wide variety of hardware and software combinations (it being the nature of my job), I can tell you that this is not a unified solution. Newer does not equal better by any means. We have several customers who've insisted on taking the plunge and upgrading to (formatting and re-installing; not upgrading the installed components) Windows ME, Windows 2000, or Windows XP (home or pro) and hav actually CAUSED themselves problems, rather than solve them. Many of them have reverted to Windows 98 to solve their problems because it 'worked' moreso than the "professional" operating systems (ME notwithstanding).

        To make this post doubly effective, I'll also respond to your parent poster; the article submitter stated specifically that he was interested in a solution that would avail him automated updates for Windows 98 systems - something I, myself, have also been looking for. SMS does NOT support anything but Windows 2000 or Windows XP - period. SMS is NOT an option. Were this not explicitly stated in the article I'd agree with the Insightful mods, but sadly I'm afraid it's more aptly classified as redundant.

        For the record, I'm also interested in an automated solution to upgrading client computers ranging from Windows'98 through to Windows XP Professional (we don't support anything older than Windows'98) without having to significantly alter the users' computer. The notion of using our own in-house Windows Update server is potentially viable, except I understand that Windows would then look to that server for future updates. Moreover, I haven't found a decent method by which to automate this process even a little bit; including the ability to download, in raw form, all updates to all Windows versions.

        The setup I'm interested in is analagous to the article submitter, except I'm not dealing with a single geographically diverse network, I'm dealing with a geographically diverse cross-section of business and residential customers. Many of whom do not have access to broadband Internet access, so a solution that is portable by means of CD-R would be preferable.

        Presently our solution is to (transparently) proxy the machines while on our work benches in order to decrease the time required to download all updates. Some updates (IE6, some criticals) are proxy-friendly, but many simply will not cache, and therefore must be repeatedly re-downloaded from Microsoft. As I pointed out earlier, Microsoft's "Automatic Update" feature, while an apt solution to the apathetic mass customer base, causes problems for a setup like ours. For approximately three full business days after Microsoft's release of their recent VM security update, we simply could not access the Windows Update site with any degree of reliability. It took upwards of an hour to two hours just to download the ActiveX controls and scan for updates; applying them was another story entirely (timeouts, re-tries galore). When I was on location at customer premeses, this made updating their computers all but completely impossible. (If I'd attemped to bill them for an additional four hours to sit and stare blankly at their monitors in turn, I'd never see payment of that invoice!)

        I look forward to reading the remainder of the responses and see if anybody else has come up with anything viable. Microsoft, of course, reccomends either direct use of windowsupdate.microsoft.com or SMS. No help there.

        • I can tell you that this is not a unified solution. Newer does not equal better by any means. We have several customers who've insisted on taking the plunge and upgrading to (formatting and re-installing; not upgrading the installed components) Windows ME, Windows 2000, or Windows XP (home or pro) and hav actually CAUSED themselves problems, rather than solve them. Many of them have reverted to Windows 98 to solve their problems because it 'worked' moreso than the "professional" operating systems (ME notwithstanding).

          I've also worked with quite a few machines, some with '98 (for game playing), mostly with 2k and XP (for development use both at work and at home) and unless those machines that were upgraded had some really old or funky hardware, your experience is vastly different from mine.

          Still, I realize I wasn't really helping the poor guy, but the fact remains that the crystal in Windows 98's palm is going to start flashing pretty soon. Microsoft is going to make sure that it does everything it can to force users to upgrade, whether they like it, or need it, or not.

          If an administrator is willing to do the work that Microsoft cannot or will not do, it should be possible to locate and download hotfixes and security patches so that you don't have to rely on Microsoft's servers. I used to always do that and keep a local copy of everything for the next time I wanted to set up a machine or reinstall the OS. However, as you stated, this is getting harder and harder to do. I'm not sure you can download a full installation of IE (although you probably can order it on CD for a nominal fee), however, all fixes come with a KB article number and I believe if you look the article up in the KB there is usually, if not always, a download link.

          Like another poster said, "Spend the money!" Anything else means you will spend it anyway in man-hours, with less assurance of a good result.
          • To download a full installation copy of IE, follow the instructions on this page:

            http://www.broomeman.com/support/wsiedown.html

            credit goes to my work colleague John who pointed this out (Hi John if you're reading !)
            • Just write a batch file to run all updates on a public readable share on your network. Put it in the Windows\Run regsitry folder. Simple. You can even export the registry key and save it in the same public readable folder and all you have to do to install the autoupdate batch is double click the .reg file.
        • SMS does NOT support anything but Windows 2000 or Windows XP - period. SMS is NOT an option.

          What the FUCK? You must be thinking of Windows 2000's built in software distribution; SMS 2.0 doesn't support 2K or XP properly until you get SPs 2 and 3 installed. But it sure as hell does support the 9x series.

        • While I sympathize with your viewpoint, the problem is that Win98 and NT 4.0 are going end of life on June 30, 2003. [microsoft.com] Microsoft might decide to release some security-related patches after that date, but they are by no means obligated to do so. So it is a bit unclear what the poster will be patching in the future.

          sPh

          • Win98 and NT 4.0 are going end of life on June 30, 2003. [microsoft.com]

            Actually, if you look more carefully at that table, these products aren't going to "End of Life" until June 30, 2004. They're going into a one-year "non-supported phase" after June 2003. The difference (I guess) is that during the non-supported phase online self-help support is all that is available. It's unclear whether they will still publish patches for 98 and NT during the non-supported phase.

            Belloc
        • ....so a solution that is portable by means of CD-R would be preferable.

          I thought they had a solution called M$ Technet, usually carries the service packs as they come out. while it doesn't normally carry hotfixes, I don't see why you can't download those to your server as a 'corporate' install option, and then burn those to cd-rom. while that doesn't really take care of the patch-push issue, you might be able to work the burned cd's into the scenario either by pushing those out to the systems' hard drive at login time and then having them run a batch script to patch the system.

  • Err (Score:5, Informative)

    by itwerx ( 165526 ) on Monday January 06, 2003 @08:37PM (#5029517) Homepage
    Put 'em in the login-script?
    Or you could build a SUS server [microsoft.com]
    As I recall it will handle 9x, although they only admit to 2K on this page. It is limited though. Won't do full SP's or actual apps.
    Anybody have more experience with it?
    • You can do all sorts of things with vbscript [winnetmag.com] and windows scripting host. Although, on Win98, WSH is a bug-ridden-security-exploit-waiting-to-happen. I looked into using it on a small network of Win98 computers, but ended up applying patches by hand because of all the possibilities for security problems. For "automatic" anything, Windows NT/2000 is a requirement from a security standpoint.

  • Batch Scripts (Score:2, Interesting)

    by LWolenczak ( 10527 )
    Most people I know, and I personally have used batch scripts. Honestly, I've looked at using bash scripts to provide a more powerful scripting language for pushing patches from servers to workstations.

  • easy (Score:4, Informative)

    by 216pi ( 461752 ) on Monday January 06, 2003 @08:42PM (#5029553) Homepage
    this is an easy task:

    first, go to this page [microsoft.com] at Microsoft TechNet, read everything about the Microsoft Baseline Security Analyzer.

    This tool allows you to scan computers remotly if they installed all hotfixes.

    This article [microsoft.com] says (somewehre in the middle):

    Host Guest_Jerry_MS
    Q: Guest_ AlanF : Can it install hotfixes on those machines remotely ?

    Host Guest_rick_MS
    A: Windows Update Corporate Edition. This white paper describes the features of Microsoft® Windows® Update Corporate Edition, a new tool for managing and distributing critical Windows patches that resolve known security vulnerabilities and other stability issues in Microsoft Windows 2000, Windows XP, and Windows .NET Server operating systems. This paper also presents solutions for some customer scenarios which Windows Update Corporate Edition addresses. This product will be available in Q2 / 2. http://www.microsoft.com/windows2000/windowsupdate /sus/default.asp Also, www.shavlik.com has an enterprise tool that will allow the remote installation of hotfixes.

    I am no SysAdmin. Finding this information took me 11 min. using http://www.microsoft.com.

    • Re:easy (Score:3, Informative)

      by VisorGuy ( 548245 )
      "I am no SysAdmin."

      You obviously didn't read his question closely either because he said they are mostly concerned with performing these updates on Windows 98.

      From the article:

      Host Guest_Jerry_MS
      Q: Guest_ Viper : Am I correct to assume that the MBSA is designed for 2000/XP OS? It did not come up with much information or problems with Win 98/ME systems that we have on our network. I know for a fact that 98 isn't that secure What is up with this?

      Host Guest_rick_MS
      A: Supported platforms: Windows NT 4.0 SP4 and above, Windows 2000, or Windows XP. MBSA does not scan win98/ME systems.
      • The real irony is that the misleading post is modded higher then you are!

        +5 informative my ass.

  • Wrong problem... (Score:1, Offtopic)

    by zulux ( 112259 )
    You're fighting the wrong problem.

    You're trying to push a mostly single-user desktop operating system into being somthing it's not: a robust, managable, network desgigned operating system.

    Of course ther're going to be problems.

    It's kind of like asking: My Hyundai Excell keeps breaking down and it won't haul 6 tons of gravel - what can I do to make it work?

    The real sloution, ditch the Hyundai and get a Terex [terex.com]. Ditch MS-Windows and get Solaris, SGI, UNIX, AIX. Hell, get Mac OS-X.

    • Too bad I already spent all my mod points today... If I had any left I'd mod this up if only for the fact that you included a link to a helluva dump truck.
      Also, you have a very good and appropriate point.
    • ..to be fair to the guy he described what he was up against "as is". I ain't he, but would wager he and his company are up against the current shaky and mostly stagnant economy, and the decision from higher-higher is probably something along the lines of "make what we got work as long as possible". Hmm, for that matter bet he ain't alone, similar is probably being ordered by the PHBs all over corporate-land.

      kinda like picard uttering "make it so" to some *almost* unsolvable problem, heh

    • Re:Wrong problem... (Score:3, Insightful)

      by styrotech ( 136124 )
      It's kind of like asking: My Hyundai Excell keeps breaking down and it won't haul 6 tons of gravel - what can I do to make it work?

      The real sloution, ditch the Hyundai and get a Terex

      That truck looks waaay overkill for 6 tons of gravel - and it wouldn't help at all if you needed to haul it on a public road.

      Seems a bit like recommending Solaris, Irix or AIX as a general purpose desktop OS.

      • First: You can't have too much overkill.

        Second: I would like to have a Terex even though I have absolutely no use for it.

        Third: I would want the best, the Unit Rig MT 5500 Terex Mining Truck [terex.com]. The other truck mentioned above has only 1050 horsepower! I just know I need the 2800 HP of the MT 5500. You know you have a real vehicle when it comes with a ladder that you climb two stories to get to the driver's seat.

        Fourth: This is only off topic if someone else is choosing the topic.
    • Yes, the wrong problem. But since win9x is still around, there is obviously other issues involved.

      In this situation, I would present the issues and say something like

      "Windows 98 is a huge problem and is really messing things up. I can use gpo's, SMS, Zenworks, the chain tool etc etc etc to update the winnt based machines. We can also fully secure the network with the nt technology.

      "Windows 9x is a security issue on our network and it is creating far more work for us. You know about the issues now and we have shown you possible solutions. Please make a decision."

      Now it is into your management's hands and not yours.

  • Startup Scripts (Score:4, Interesting)

    by karearea ( 234997 ) on Monday January 06, 2003 @08:48PM (#5029592)
    For our Windows 2000 workstations and Laptops we use the startup scripts to install applications and patches.
    We have an unattended install for the laptops, when they reboot they are part of the domain and the startup scripts apply. They then run through (without user intervention) do an unattended install of office 97 and outlook 2000, apply several registry patches, update templates and W2k service packs.
    Each time a laptop or a workstation starts up on the network the startup scripts run and check for updates. We use KiXtart to check version and apply patches etc.
    Of course there are some apps that cause problems, but anything can be hacked (copy, move files, registry patches etc) in some form to do what you want it to.

  • Easy solution for Windows (Score:3, Funny)

    by Axiom ( 95375 ) on Monday January 06, 2003 @09:08PM (#5029701) Homepage
    For patching IE/Outlook, simply use some widespread and well-known WAN patching tools: Melissa, I Love You, Klez to name a few.

  • the place i work for apparently does this: (Score:3, Interesting)

    by XO ( 250276 ) <blade.eric@NospAM.gmail.com> on Monday January 06, 2003 @09:24PM (#5029790) Homepage Journal
    Each location has a Xenix based server, with anywhere from 2 to 20 or so Windows '95-'98 clients (each of the Windows boxes are identically configured). The Xenix based server occasionally communicates with the home office, and downloads updates.

    Each Windows machine has it's own FTPd running on it, and when there's an update, the Xenix machine ftp's the update to the Windows box, gives it an autoexec.bat that will make the update happen, then forces the machine to reboot.

  • I know it's not quite what you need, but since you said that the patch checking apps don't support Win98, how about BigFix? (www.bigfix.com)
    As far as I'm aware, it supports Win98, but it does require users to actively follow through...
  • Group Policy

    Setting up a group policy to push the patch out to the clients works great. Don't know what the advantage of SMS is but with group policies you really don't need it(for this).

  • Can't help much but (Score:2, Insightful)

    by jsse ( 254124 )
    I can tell you my experience.

    1) Seeing that applying patches is inevitable when security vulnerablities surface a couple of time every couple of days, management finally accepted to evaluate the necessity of a security assessment for their vast network of Windows boxens.
    2) The report revealed that enomous amount of money has to be spent for software distribution system(aka SAM, software Assessment Management), management resorted to rely on human intervention - have a very handful of us to go around the organization to apply patches
    3) The problem is, by the time we finished patching less than one-half of the boxens, new patches/vulnerabilities fixes released. There is 1000+ users we are talking about...
    4) Having seen too much human resources has to be spent on apply patches, they get down to the basic and distribute patches files by email and CD and requires individual user to apply the patches.
    5) as normal users do not understand the need of apply patches, or do not understand the whole thing about the patching things, end up only less than 20% of the boxens have applied the patches in time and new system vulnerabilities break-out every two week
    6) Management sees the necessity to perform a new security assessment
    7) Goto step 2)

    Now management blames us for spending too much money to maintain organization network. They don't seem to remember it was them who believe Windows has low maintenance cost.

  • Support (Score:2, Insightful)

    by gnixdep ( 629913 )
    Before you invest too much time and money into a solution, I'd check to see if Microsoft is going to continue providing patches for you to apply. Last I heard, Win95, Win98, and NT4 were all on the chopping block for continued support. Another solution you could examine is Terminal Services. If you only have one system, keeping it patched is pretty straightforward. Or Citrix, if you need things like local disk access and printing. Using NT Workstation, or Windows 2000 Workstation, you can do that sort of thing with Group Policies, or Novell ZENWorks, which will do that and much more. Home-user OS's don't have support for this sort of thing natively, because they're not designed for this sort of application.

  • A good paper on this problem (Score:4, Informative)

    by iankerickson ( 116267 ) on Monday January 06, 2003 @10:43PM (#5030150) Homepage
    Dave Roth, a Windows consultant and author of several extensions for Win32 perl, wrote a paper on managing a WAN of NT machines, most of which can apply to W98, if you do some testing:

    http://www.roth.net/conference/lisant/1999/
    and
    http://www.roth.net/conference/lisant/1999/NMMS. pp t

    There's an old Mac program called RevRDist from Purdue that uses the same strategy. It might give you some good ideas, even if it's not for Windows. Another good site is on this problem in a more abstract way (centered on UNIX):
    http://www.infrastructures.org/

    The basic trick: use login scripts. Don't think that this won't help you if your LAN can't force people to actually log in to the PCs they use. Where Roth's idea is better is that he uses 1 special login account to install batch scripts scheduled to run everyday at specific times. The batch script runs scripts off a read-only share, so saving new scripts to the share you can do automatic updates on all machines every 24 hours, including updates to the scheduled batch scripts themselves. Your staff only has to "touch" each PC once by loging in as the special account, and there after everything is automatic, depending on your ability to write robust, correct scripts and do proper testing.

    As for remotely installing OS patches from a central PC? Are you totally MAD? Any feature you can easily use to remotely change a computer can be used by a hacker or worm to adversely "update" every PC on your LAN. It doesn't matter if the so-called white paper says it's secure. Internet worms are more serious problem these days than ever, so give security serious thought before you deploy, no matter what solution you decide.
  • For the winnt/2k/xp boxxen (which are the only ones left with new patches being made), <a href="http://www.languard.com">Languard Network Scanner</a> can tell you which machines have which patches missing, then allow you to deploy them all across the network. For the win98 machines (where no new patches are being made), push a one time autoexec.bat and large-directory-full-of-chained-hotfixes that brings them up to final Microsoft edition, and make sure any new Ghostings/imagings include these patches. corporate.windowsupdate.microsoft.com was the best source for all the patches, but sadly, it's been discontinued in favor of a program which I haven't evaluated.

    Bonus about that Languard tool: it doubles as an awesome network security / rogue client scanner. Give it a shot!
  • I've used VNC server/client combinations to update and check on remote *nix systems for a little while now. Copies for many different operating systems, including Windows 98, can be checked here [att.com]. It's simple, but it gets the job done. I like it because I can administer from wherever I need to.

    Timbuktu [netopia.com] has similar features, but its Windows compatibility is less extensive and its not free (in either way). It does have a more extensive feature set though, so I reccommend at least giving it a look if you look at VNC.

    The main issue I've found with these is their use of bandwidth. Even then, quality can be reduced and compression can be increased for responsiveness. Good luck.
  • All you need to do is put a few of the cygwin tools on the machines, use gpg, rsync, perl, and ar. sign packages with gpg, put them on a central server and have the clients rsync off the server, the packages you download should contain the changed files and a reg patch, so that on extracting into c:\ they go into the right directory. then have as well a .reg file that is merged into the registry after the new files, and finally a perl script writes that the patch is install and interfaces with the Win32 GUI to prompt the user to reboot. If you feel really good write the app in VB and sell it for thousands to clueless windows admins

  • CD image (Score:3, Insightful)

    by TheSHAD0W ( 258774 ) on Tuesday January 07, 2003 @02:48AM (#5030955) Homepage
    First off -- you should be running two tiers of systems; one where a default set of applications are installed, and users' installs aren't guaranteed to stick; and one where a user assumes responsibility of his own machine and has to figure out his own problems.

    Now your job is greatly simplified. Use a utility that overwrites the boot partition on a machine with the image stored on a CD. (Let users store their data files in a second partition.) Update the OS to the current level, and make an image CD using it. Then get a flunky to go to each machine and re-image it. (Do this after hours when the place is empty.)

    Presto. You're updated.
    • Now your job is greatly simplified. Use a utility that overwrites the boot partition on a machine with the image stored on a CD. (Let users store their data files in a second partition.) Update the OS to the current level, and make an image CD using it. Then get a flunky to go to each machine and re-image it. (Do this after hours when the place is empty.)

      Imaging a wide area network isn't as simple as all that. Having a 'flunky' image, say, 2000 machines within a (potentially) 500KM radius would be a week-long endeavour; during business hours as well as overtime. Distributed imaging solutions would chew up precious WAN bandwidth, not to mention time, not to mention the high potential for failure over a less-reliable-than-LAN link, so you'd require a person on-site at each location. This person would update their local copy of the workstation image (which, BTW, would probably fit on three or four CDs; not one) on an imaging server and push the image to the local clients.

      This chews up a lot of LAN bandwidth and time, even after hours, and requires a lot of manpower (someone physically at each location). This would push the changes across the entire WAN in a very long time period. In other words, by the time you were done 'updating' your WAN, you'd have to start the process all over again with the next batch of updates.

      This, of course, is assuming that each and every workstation configuration is identical. Hardware and/or software differences mean different workstation images. So now you have to have a copy of each hardware configuration in your lab to create/update each new image before you make it available. You then have to account for all software differences (ie; graphics artists will have one suite of applications while CAD designers another, marketting/sales people another, accounting people another, etc.) meaning the potential for several images per hardware setup, meaning an entire day of image, update, test, re-create image on server, image a second workstation, test, verify, push image to remote location(s), repeat for next image / hardware setup.

      Imaging workstations is only ideally suited for environments with similar hardware and software needs, converged into large, localized groupings on high bandwidth connections. Satellite offices on a corporate WAN aren't a likely candidate for such an update procedure.

      • If the machines are at more than one location, use one flunky at each. If there are a whole lot of machines at a single location, use more than one flunky. Use multiple CDs per flunky, so he can go service more than one machine while the others are writing.

        Yes, sending a CD image over the internet can burn a lot of bandwidth. Use sneakernet instead. Heck, if you're in a hurry, Fedex it. Otherwise the updates may be DAYS late -- horrors!

        As for workstations not being identical -- if they aren't, and you've got thousands of them, your IS department is going to be humongous. Most places will standardize the systems rather than try and support all the possible combinations of software. At worst, you shouldn't see more than three or four different installs, at least that IS is responsible for.
        • As for workstations not being identical -- if they aren't, and you've got thousands of them, your IS department is going to be humongous. Most places will standardize the systems rather than try and support all the possible combinations of software. At worst, you shouldn't see more than three or four different installs, at least that IS is responsible for.

          That sounds like theoretical versus actual management. Have you ever worked in a large IS department? (Greater than 250 workstations in each of more than one location)

  • Why not upgrade to mandrake linux?
  • I don't recall seeing a license fee for BackOrifice anywhere, and if memory serves, it has many of the same features that SMS does.
  • at my job, we either just wait till the summer to rebuild every machine (useing norton ghost) and just get the most current patches then, but that isan't a good decision for Microsoft's hughe security holes, so otherwise, we use novell's zen works to make program "X" run at user login. it isan't a perfect solution, but it works for us

Slashdot Top Deals

Work is the crab grass in the lawn of life. -- Schulz

Close