Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a home user I understand letting windows run and install updates automatically. However, in the work place could business software and updates collide thus making running them automatically a bad idea or does it depend on setup? Would it just be best to control all updates from the main Active Directory Node and then push them to all the client machines that way?

share|improve this question
up vote 1 down vote accepted

We manage this pretty closely for our company (1000 people, all PC users) using Windows Server Update Services (WSUS) as @larrymachine mentioned. But in my experience and opinion opinion, if you don't have a lot of custom code integrated with Office, your odds of having an issue with automatic updates is pretty low.

Given the risk of not doing them, I'd rather have them automated and clean up the occasional issue than leave them un-patched.

share|improve this answer
While the chance of conflict is remote, you still don't want to walk in on Monday morning and find 700 of your PCs bluescreen on bootup or PowerPoint stopped importing SWF files. If you support more systems than can you address in a single day, it's always best to have a "canary" for your patches/updates. Even 5-10 canary systems should give you some idea of how your patch will deploy and behave. – Mxx May 17 '12 at 7:01

There is a role to control windows update on a active-directory forest, it's called Windows Server Update Services:

share|improve this answer

If you do not want du use a WSUS (which is probably your best choice anyway) and still are into automating your Windows Update Process (for Updates of Microsoft Software, not third-party software), and you are fit on windows scripting, you can script the update process using the command line tool WuInstall

You just disable automatic update on each machine and call WuInstall on each machie, for example remotely from a central point using psexec for example, you can specify criterias or configuration files in which you specify the updates to be installed - even caching of updates in the local network is possible.

If you are later deciding to use WSUS, you can keep the scripts because WuInstall does not care if it gets the update from Windows Update Site or WSUS, the process stays the same.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.