IT Employment

Ask something
Discussion Locked

Is it worth it?

0 helpful
3 replies

by daygo_171

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I administer a network of about 175 Win 2k and XP computers in an A/S 400 (I-Series) environment. We are not doing any windows updates since we do not have a windows server on the network (we are running Norton Corp on each desktop and updating from there).

Since all of my end-users are locked down as regular users in a local profile only, I do not know how to allow the updates to happen behind the scenes. I have considered installing an SUS server, but I wonder if it is really necessary to do the windows updates since that may create a network bandwidth issue.

I have not seen any major issues in three years. Is it only a matter of time?

3 replies

by chromacat

I think SUS would help you quite a bit.

It allows you to set the time of day (and which day) each machine will update, via a registry key, so this will help in managing the bandwidth issue.

This same registry key also allows you to select whether or not the machine should reboot automatically if a user is logged on at the time updates are applied.

Both of the above options are great if you are running a 24/7 shop (like I am - though thankfully, I am not here 24/7 - even if it feels like it sometimes ;-) )

If you are concerned about the effects certain updates might have on your installations, the SUS admin console gives you the option of manually approving updates before they are available to clients. This allows time to try out the updates on test machines before applying them globally.

I am no Microsoft fan, but SUS has cut the time I spend updating machines by at least 50%.

If you decide on SUS, I highly recommend reading the SUS Deployment White Paper:
http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx

Cheers,
DD

by daygo_171

I guess the quesition that I really want answered is one of "necessity". With end-users locked down so they can't install and no Microsoft servers just what am I leaving myself open to by not running the updates. We do have antivirus programs and fight spyware randomly (and seldomly) on a case by case basis.

Thanks for your input

by alece

You have 175 computers that are not in any kind of domain? When you want to administer anything centrally, you are going to need a domain established and then you will have to customize any of the default domain groups, policies and profiles as well. Otherwise, the connections to these machines from the SUS server would have to be administered at each machine. This would also be true for the setup and maintenance of these updates as well. In addition to virus scan engines, dat files and extra files, you also have Windows updates and security fixes. Also, let's not forget that spyware detection is now part of any good protection suite.

The first step is to install a Windows domain controller and get all of these machines centrally managed. The updates can then be easily managed with a number of enterprise management tools. The time and effort spent setting this up will be worth it.

This discussion is closed to new replies.