we are in the process of optimizing our network.
Maybe you heard that while deploying SP1 for W7, some computers using a WSUS powered network had problems, and the computers crashed/had to be redone.
Now, there are several ways to prevent these kinds of desasters. Usually, you have some kind of spare machine with a mirroring installation that you try the updates on first. If it comes back up without a problem, you patch the original machines and hope it works out just as well.
But what is the best way to do just that? IT infrastructure is complex, and even if I had a test machine with the same OS as the live machine, the update could go through while the live machine will crash. Because the complex software installation does not match.
So I could say that I create a test machine with the same OS, OS patch level and applications, but it could still crash. As noted earlier, the latest crash victims depended on the use of a WSUS server in the domain. A computer not using the WSUS wouldn't have gotten the same problem.
So, the solution for this would be to clone every live machine when updates wait for installations, boot the clone, then update the clone. But that gets us into more trouble, specifically with Microsoft and their Windows licenses, as I then have 2 machines running the same license, contacting Windows Update. Not to speak about the other doubles licenses running on the machine.
Is there a clever solution for the problems listed here? How do you prevent update desasters on your live servers without having a physically mirrored machine?