0

After virtualising our server infraestructure, in the last two years the number of windows servers has grown from aprox. 20 to 75, mainly by migrating every service of our corporation to his own vm, but we also are deploying new applications that require one or more servers.

In the old times, keeping windows updated take me only 1 hour to do this (boring) task, but now it's coming really time-consuming and also error-prone (too many servers ,some of them are clusters or nbl, and others have services that depends in other servers, that expect the other server is online when it's restarted, so you can't reboot all at one time).

Our workflow is the following:

1- Someone aproves in WSUS the updates of the month after little testing. 2- One time every month, on Friday evening, when almost isn't anyone working, I start the boring task of log in every server, wuauclt /detectnow, click to download updates, click to install, reboot (keeping in mind what other servers are rebooting at the moment), log in again, check if is any pending update after reboot, etc etc.

I searched in internet and I didn't find anything that can help me in this task, I tried to make a c# app that manage all of this without manually login every server, but wuapi.dll is unable to download/install in remote.

So, I think this has to be a common problem, what other people do? As you can expect, we can't leave updates to install automatically or reboot when automatic updates want.

3
  • Wait. Why are your logging onto the machines? Approved updates should get pushed to machines automatically.
    – tombull89
    Sep 27, 2013 at 8:09
  • actually, we need to know that in working hours the servers are in a "stable" state. I mean, no "pending to reboot", or reboot at ramdom time. Because of that, we have disabled by gpo autoinstallation of updates, we should do it manually.
    – ekms
    Sep 27, 2013 at 10:03
  • Well as a start you could do psexec + this script. community.spiceworks.com/scripts/show/… That way you just issue a single command against a list of servers, and poof, all of them update.
    – Zoredache
    Sep 27, 2013 at 16:44

1 Answer 1

2

You're in the process of moving from "SMB-management" to "Enterprise management", which can be exiting enough in itself.

Most companies implement some kind of a maintenance window notion, where a maint window is a period of time that the given server is allowed to restart or/and perform maintenance tasks. By doing some careful planning, such as placing domain controllers/DNS Servers in separate maintenance window groups (same with cluster nodes), you should hopefully be able to design server groups where different maintenance window policies are assigned. Some companies use system managagement tools such as Microsoft System Center Config Manager to control both the maintenance windows and patch management, but I know a lot of large companies just relying on WSUS and controlling policies using GPO or registry. For one customer we built GPOs with AD Group filtering, so that sysadmins simply had a "day of week group" they could add their servers to. Servers in the "Monday" group would get patched every monday at 2330, and so on.

So, there's a lot of tooling out there but the first thing to do is to realize your now in the enterprise management business and plan accordingly.

2
  • So, what is the best aproach? Divide the servers in groups , make by GPO to download automatically approved updates, and... ¿there's some GPO to make mandatory to check for updates a certain time (let's say, friday at 18h, and install it, after that reboot without intervention, and check again if any pending update and all again?)? Alternativally, there's some option to say to a group of servers: "NOW YOU CHECK FOR UPDATES AND INSTALL"? Last time I was looking in WSUS and updates (in workstations), it does it ramdomly and you can't do anything about it.
    – ekms
    Sep 27, 2013 at 10:12
  • You can control the install time and restart time, but not with too much detailed control. For that you need a tool like SCCM.
    – Trondh
    Sep 27, 2013 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .