Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


I work at a university as an administrator over all of the public computer labs. Our labs are composed of hundreds of dual-boot iMacs(Mountain Lion + Windows 7) as well as hundreds Windows 7 PC's. To ensure that users don't muck up the machines, we run Deep Freeze on both operating systems. Currently, the only way we've been issuing patches/updates has been by creating an entire new image for the machines, and pushing them onto the machines. My goal is to change that.

My task has been to research patch management on the Mac side. So far, my plan is to use Munki to issue application updates and use Puppet to manage any configuration changes. I've successfully setup servers for both of these tools and am now looking to get all of our clients using these servers for updates so we can do weekly software/configuration updates.

My question: What is the best way for clients to get updates?

Money is tight, so free/open source solutions are ideal. We'd also like to be able to quickly change the update schedule in case we need to install a piece of software overnight. Here's some of the options I've thought of so far:

Option #1: Schedule two daemons on one of my servers that each will SSH into each of the machines I manage. One will be in charge of settings the thaw schedule for Deep Freeze. The other will be in charge of installing munki/Puppet/Apple updates. Advantages here are that I can instantly change my update/thaw schedule if I need to by scheduling the daemon to run at a different times. Disadvantages here are it puts extra load onto my servers.

Option #2: Schedule a daemon on each of my machines to check for munki/Puppet/Apple updates. This will take the load off my server, but isn't as flexible because I won't be able to instantly change the update/thaw schedule until the next set of updates run (Due to DeepFreeze).

Option #3: Have clients download and run a script of mine every half hour or so. The script will check if it's alright to run updates (For example, is it Friday night and am I thawed?). Advantages: I can change the schedule whenever I'd like and decrease server load. Disadvantage, I'd have to script a scheduling engine of sorts.

Any other thoughts on the best way to update clients?

share|improve this question

1 Answer 1

For the Macs:

Use the University of Michigan's Radmind

I haven't used Radmind in a while, but it's relatively simple. You will need 1 Mac as a clone source and another Mac as the Radmind server at a minimum. You update the clone source or install desired applications, build a new image via Radmin, then, you push the update to the target machine(s) from Radmind server.

For the PCs:

I haven't used DeepFreeze in a while, but you can use SysInternals pstools' psexec to remotely run the DeepFreeze app to thaw/freeze (documentation), then you can use the default Windows Update to connect to a local WSUS server. This, you should be able to automate/schedule via scripts. Even easier if you're using Group Policy in conjunction.


Oops. Forgot, this was dual boot. Individually, each solution should work. You may have to manually switch between what boots to help automate. If you can afford it, you can try using Deploy Studio (requires OS X Server).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.