Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just started working for a small-medium size company doing IT support. Maybe 150 or less users.

Right now every user has administrative rights to their own machine. This allows them to install updates or whatever else they would like to.

I'm tired of getting on user's machines that are bloated with crap they put on themselves. So my first thought would be to take away administrative rights to their computer. This would also have other advantages such as preventing a lot of drive-by malware on the web etc.

The problem arises that users are unable to install updates. (Even though I find most ignore these anyway)

How do large companies handle software updates on all client machines?

EDIT: Windows environment. Most servers are Windows Server 2003 Enterprise. Clients are all Windows. Win XP, Vista, and 7.

share|improve this question
The real issue I have with users having admin is when they surf the net. How many virus do you find in a given week? – tony roth May 26 '10 at 16:54
@Tony, you don't need admin rights to infect a machine or to propagate a virus. All you need is a well written virus. – John Gardeniers May 26 '10 at 19:13
@John Gardeniers: Assuming no privilege escalation bugs are being exploited by the malicious software (or, for that matter, any software) a non-privileged user shouldn't be able to subvert the trusted computing base and make changes that affect other users of the machine. Obviously, no commodity OS is free of privilege escalation bugs, but adding the layer of security of limited privilege helps when it comes to defense-in-depth. Make the malware writers exploit a vulnerability in addition to exploting human fallability and you make it harder for them. Marginally, I'd agree, but still harder. – Evan Anderson May 26 '10 at 20:24
@Evan, my point was that there are viruses and other malware that exploit such bugs, meaning we must not assume a system is "safe" (relatively speaking of course) simply because the user has limited rights. – John Gardeniers May 26 '10 at 21:47
@John: Sure, but in this context that's a bit like suggesting there's no point locking your car doors because they can just smash the window anyway. – Chris Thorpe May 26 '10 at 22:03

Windows Server Update Services (WSUS) provides the server-side component to handle update deployment. Its provided by Microsoft as a no-cost add-on to Windows Server 2003 and up.

Computers (client PCs, servers, etc) are typically directed to the WSUS server to receive updates by way of Group Policy settings (that can also be done through simple registry manipulation, too). The Windows Update client software is configurable to allow the client to automatically download and install updates on a schedule, or to download and prompt for installation, etc. The client software can force the PC to reboot, or may optionally defer reboot if a user remains logged-on. There are a variety of options.

For third-party software you can create updates to distribute via WSUS by using the Sysmtem Center Updates Publisher as part of the Microsoft System Center Configuration Manager product. (There are some other tools that will allow you to publish non-Microsoft updates to WSUS, too-- I have no experience with them and can't recommend / comment on them. There's some talk about them in a comment to this Server Fault answer.)

I typically install software to client computers via Group Policy, so deploying updates typically involves rolling new packages that way. You can see more about that strategy in this Server Fault answer.

BTW: You're doing the right thing re: getting rid of Administrator rights for users. You'll see a dramatic improvement in PC reliability, and indirectly you'll be improving security. Having a network with client computers having restricted Administrator rights is a very nice place to be. At the very least, malware will be restricted to damaging the profile of an individual user, which makes cleanup as easy as restoring a copy of a pre-infection roaming profile from backup.

share|improve this answer
Is this just Windows Updates? How about third party updates? ex) Adobe, Java, etc? – CT. May 26 '10 at 16:06
@CT: I got ya' covered with an edit... >smile< – Evan Anderson May 26 '10 at 16:07
@CT: In the same vein as Evan's BTW: Have a look at Microsoft's Software Restriction Policies. After we removed Admin rights everywhere, SRPs were used to further protect our users. We created whitelists for our application-compliment. Significantly reduced crap-ware infections, un-licensed software, non-approved downloads, etc. – jscott May 26 '10 at 16:19
@jscott: Oh, absolutely. Software Restriction Poliy (and the new AppLocker feature in Windows 7) is great if you can get the political backing to implement it. – Evan Anderson May 26 '10 at 16:28
Evan, thanks for all the good information. One last roadblock to throw in the mix. Would this work for remote users connected via VPN as well? – CT. May 26 '10 at 16:30

WSUS looks like it would be perfect for you.

Best of all, if you're running windows server in your environment, its free!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.