0

Should I get automatic updates on a production windows 2003 server to automatically download and install the updates? I ask as I have known an update to break something in the past?

If not what would be best approach for keeping the server up-to-date?

2
  • Please use a more descriptive title for your question. Sep 10, 2009 at 8:51
  • No problem. Hope its better now. Sep 10, 2009 at 11:27

3 Answers 3

4

If you've got the kit available I always download and test on another machine first. For our live hosted servers we test on local VMs of them - not a perfect test but we can at least rule out most issues that an update would cause with our software before we upgrade live.

If you can't test - at least make the install a manual process so you're in control of what is installed & when - you can look up the KBs to check what will be affected and be prepared rather than reacting to an issue.

1
  • 1
    What he said. And don't forget also that some updates will cause your server to reboot (unless you disable that), so something to keep in mind if you're in a different timezone to Microsoft and your box goes down during business hours.
    – user3914
    Sep 10, 2009 at 8:53
2

Absolutely a BAD idea to turn automatic updates on. Patch management on servers is a SysAdmin's primary responsibility - and that means to test every patch on another box, read the release notes with every patch and be fully aware of what it does - and most importantly, have a plan if after all this something breaks after you apply the patch.

Personally, I use Windows Software Update Services to manage and apply patches in my organization. It's free from Microsoft, I run it on an old Dell 2650 server, and use it to update our desktops as well as servers. It is highly configurable and makes it simple to deal with the stuff that you want to automate (such as Desktop updates).

1

Automatic updates on a server is a Bad Thing™.

Keeping your servers patched is a Good Thing™.

Invest in a test server (could be a VM) where you can verify the patch won't break anything. And make sure that you install patches on the production server manually.

If you have your servers in some form of cluster, perhaps two Win2k8 webservers for example, patch one and reboot if necessary. Make sure it's healthy, then patch the other and reboot.

Make sure to never apply Service Packs unless you plan to not remove them, too - they alter a lot of files in a one-way-only fashion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .