Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Should I get automatic updates on a production windows 2003 server to automatically download and install the updates? I ask as I have known an update to break something in the past?

If not what would be best approach for keeping the server up-to-date?

share|improve this question
    
Please use a more descriptive title for your question. –  Aron Rotteveel Sep 10 '09 at 8:51
    
No problem. Hope its better now. –  Antony Delaney Sep 10 '09 at 11:27
add comment

3 Answers

up vote 5 down vote accepted

If you've got the kit available I always download and test on another machine first. For our live hosted servers we test on local VMs of them - not a perfect test but we can at least rule out most issues that an update would cause with our software before we upgrade live.

If you can't test - at least make the install a manual process so you're in control of what is installed & when - you can look up the KBs to check what will be affected and be prepared rather than reacting to an issue.

share|improve this answer
1  
What he said. And don't forget also that some updates will cause your server to reboot (unless you disable that), so something to keep in mind if you're in a different timezone to Microsoft and your box goes down during business hours. –  user3914 Sep 10 '09 at 8:53
add comment

Absolutely a BAD idea to turn automatic updates on. Patch management on servers is a SysAdmin's primary responsibility - and that means to test every patch on another box, read the release notes with every patch and be fully aware of what it does - and most importantly, have a plan if after all this something breaks after you apply the patch.

Personally, I use Windows Software Update Services to manage and apply patches in my organization. It's free from Microsoft, I run it on an old Dell 2650 server, and use it to update our desktops as well as servers. It is highly configurable and makes it simple to deal with the stuff that you want to automate (such as Desktop updates).

share|improve this answer
add comment

Automatic updates on a server is a Bad Thing™.

Keeping your servers patched is a Good Thing™.

Invest in a test server (could be a VM) where you can verify the patch won't break anything. And make sure that you install patches on the production server manually.

If you have your servers in some form of cluster, perhaps two Win2k8 webservers for example, patch one and reboot if necessary. Make sure it's healthy, then patch the other and reboot.

Make sure to never apply Service Packs unless you plan to not remove them, too - they alter a lot of files in a one-way-only fashion.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.