1

As a home user I understand letting windows run and install updates automatically. However, in the work place could business software and updates collide thus making running them automatically a bad idea or does it depend on setup? Would it just be best to control all updates from the main Active Directory Node and then push them to all the client machines that way?

Improve this question

3 Answers 3

Reset to default
1

We manage this pretty closely for our company (1000 people, all PC users) using Windows Server Update Services (WSUS) as @larrymachine mentioned. But in my experience and opinion opinion, if you don't have a lot of custom code integrated with Office, your odds of having an issue with automatic updates is pretty low.

Given the risk of not doing them, I'd rather have them automated and clean up the occasional issue than leave them un-patched.

Improve this answer
1
  • 1
    While the chance of conflict is remote, you still don't want to walk in on Monday morning and find 700 of your PCs bluescreen on bootup or PowerPoint stopped importing SWF files. If you support more systems than can you address in a single day, it's always best to have a "canary" for your patches/updates. Even 5-10 canary systems should give you some idea of how your patch will deploy and behave.
    – Mxx
    May 17, 2012 at 7:01
0

There is a role to control windows update on a active-directory forest, it's called Windows Server Update Services: http://technet.microsoft.com/en-us/windowsserver/bb332157

Improve this answer
0

If you do not want du use a WSUS (which is probably your best choice anyway) and still are into automating your Windows Update Process (for Updates of Microsoft Software, not third-party software), and you are fit on windows scripting, you can script the update process using the command line tool WuInstall

You just disable automatic update on each machine and call WuInstall on each machie, for example remotely from a central point using psexec for example, you can specify criterias or configuration files in which you specify the updates to be installed - even caching of updates in the local network is possible.

If you are later deciding to use WSUS, you can keep the scripts because WuInstall does not care if it gets the update from Windows Update Site or WSUS, the process stays the same.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .