Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our organization has less than 100 people all on laptops running Windows XP. We encourage Firefox, though a number of people still use IE7. But lately we've gotten some spyware/virus attacks that have come in through outdated plugins. Everyone is at different levels with plugin updates, and it tends to be the case that we don't find out about someone neglecting updates until they are affected by it in the form of some webpage with spyware in it crawling through an old Java or Flash version.

We have System Center Essentials set up to keep all the computers up to date as far as Windows Update. We also have Trend Micro which has protected us well so far, so the issue is only of preventative maintenance at this time.

What is the best way that we ensure that everyone's computers are kept up to date with the latest versions of Flash and Java? Can we use some sort of automated check to scan everyone's computers, akin to Mozilla's Plugin Check but on a widespread scale? Can System Center Essentials come in handy for this? Those of you who manage computers like this, how do you keep everyone's plugins up to date?

share|improve this question
up vote 1 down vote accepted

I have Flash Player, Java and Adobe Reader all deployed via Group Policy, since they are increasingly becoming the target for "drive by and get owned" type attacks.

For the Java page on Active Directory deployment, see here.

To deploy Adobe Reader and Flash Player, you have to sign up for a distribution agreement with Adobe here (this is free), which is usually sorted in about an hour.

The installation instructions for Adobe Reader are in this PDF.

For Flash Player, the distribution agreement confirmation email you get will contain a link to the msi installers. Note that there are 2 installers - one for Internet Explorer (the ActiveX control) and another for plugin based browsers (Firefox, Opera). I install both of these on the same Group Policy, as they both need to be kept up to date, even if only one browser is used.

A problem you might have is that the machines are all laptops. If your laptops are anything like my laptops, software deployment via Group Policy is incredibly hit and miss (more miss than hit unfortunately). You can enable the setting to wait for the network to become available before allowing logon, but this will probably increase logon times and just frustrate your users.

share|improve this answer

use a configuration manager tool like wpkg or the Microsoft server manager tool (do not remember its new name, it used to be called SMS). Wpkg is free software and works very nicely, its all xml so you can keep it in version control easily. Windows pc's pull the changes daily (or whenever you plan it) so it is the perfect partner for unattend(ed).

You write a package definition with the commands necessary to install/update the plugins, and the Windows clients will do it on their next run. It works very nicely. No windows domains necessary, by the way, it kan work off a samba share.

flash instructions Java instructions

share|improve this answer
System Center Configuration Manager is the new SMS according to - and judging from the name, System Center Essentials that we're using is probably a stripped-down version (the "essentials"). I'm looking to see if I can use Ben's info and our SCE server to push to everyone without getting involved with Active Directory. – Ricket Aug 27 '10 at 19:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.