Hot answers tagged

30

Short answer - yes. Most of the Windows Updates are security related. Not having the patches means you're vulnerable. Longer answer - you need a procedure that covers this sort of thing. It's more rare these days, but sometimes a patch can break things, or change behavior in such a way that it's broken as far as your company is concerned. You should be ...


18

If you are starting from a bare metal install, you can slipstream updates into your installer disc so it already has updates in it (this depends on how many installs you're doing to make it worth it). WSUS will not reboot your computer for you. It only keeps track of your updates and will act as a repo for updates so that rather than updating 300+ meg of ...


18

The generic answer is it is a good practice to keep your servers updated. But pay attention to a few things: Updates may cause the server to be sluggish during installation, or even cause some downtime if they require reboot(s). You should plan to do them out of office work hours. Updates have some risk associated. They might break your server, or cause ...


17

Does the server have to run Windows 2003 Server, or will Windows XP Professional work? Yes, Windows Server is required. Where do I download the WSUS packages from? Microsoft's website: WSUS 3.0 How can I configure my computers to look for updates from my server instead of the internet? There's a deployment guide & a step-by-step guide that explains ...


14

To obtain a list of installed patches you can do: wmic qfe list To uninstall a listed patch, you do: wusa /uninstall /kb:<kbnumber> Here are some links with more information: http://www.systemcentercentral.com/BlogDetails/tabid/143/indexid/57960/Default.aspx http://support.microsoft.com/kb/934307 http://technet.microsoft.com/en-us/library/...


13

No, it is not safe. Having Windows Update disabled means you are not receiving latest security and other updates from Microsoft. Unless you keep downloading and installing the patches on monthly basis manually, this leaves your servers (as well as your whole environment) vulnerable to security attacks. In a long run, this might result in stability issues or ...


12

Sounds like you don't test your group policy changes in a lab first, eh? Create a GPO with settings the "Configure Automatic Updates" setting in the "Windows Update" node of the "Windows Components" node of "Administrative Templates" set to "Disabled". As long as you haven't done something to disable periodic policy refresh, which happens every 90 to 120 ...


12

Yes. You can install all of the updates available - via either Windows Update in your Control Panel, or the yellow WU shield in the system tray near the clock. Then, when that's done, you can do a reboot from the Start Menu (or calling shutdown /r from the command line.) The only other ways to automate it all in one step is via writing your own code (not ...


12

I know this question is a bit old, but there's some untruths being posted here. There is nothing wrong with how SCCM 2012 functions, the problem is a misunderstanding of how it deploys software and updates. It is not fair to quote Microsoft when they say it was behaving "by design" and that you cannot do anything but set a deadline far into the future. This ...


11

In group policy for the server, navigate to: Computer Configuration->Administrative Templates->Windows Components->Windows Update->No auto-restart for scheduled Automatic Update installation You can get to this by running gpedit.msc. Reboot to apply changes. Don't forget that your server won't be updated until you reboot and will be vulnerable to the ...


11

WSUS can automatically install updates, including the Microsoft Update stuff.


11

The solution depends on your configuration, and theres some things you should check first: Ensure BITS service is running: net start BITS Ensure Windows Update service is running: net start wuauserv Ensure that your machine has a unique SusClientID (especially if the system is a clone). You can delte the key, run the 3 commands below, and restart the ...


10

Not sure about Windows 7, but with XP/Vista, you could run the following command to detect and download updates: wuauclt /detectnow /reportnow If you have issues getting it to work, check out the WSUS Wiki. Otherwise if you have a specific update that you want, just download from the Microsoft website. If there's some problem preventing you from ...


10

In a larger network you will want to use WSUS as DanBig pointed out. However, if you owant to block an individual hot fix you can do so with the hot fix ID using this script: If Wscript.Arguments.Count = 0 Then WScript.Echo "Syntax: HideWindowsUpdate.vbs [Hotfix Article ID]" & vbCRLF & _ "Examples:" & vbCRLF & _ ...


10

Stop it and disable it. sc stop wuauserv sc config wuauserv start= disabled You will need to open command prompt as administrator or you will get "access denied." The space after the start= is mandatory, sc will complain if the space is omitted. It may be worth noting that any services, or programs, which depend upon a disabled service will themselves ...


10

I believe, ultimately, the correct answer is "Fix your application". However, you may not be able to for any number of reasons. That being said... Which version of Windows? In Vista/2008 and up, you can tie Scheduled Tasks to specific Event IDs. In the System event log, Event ID 19 from WindowsUpdateClient, indicates successful WUA Update Installation....


9

I would just like to get on my auto-reboot soapbox for a second: it's been my experience that automatically/forcing a reboot is generally a bad idea. We system admins often have somewhat of a complex about making sure the latest patch has been applied the second it's installed because OMG until then the system is unpatched. However, you must realize that ...


9

I won't speak to WHEN it will happen, since the date has fluctuated...but to answer your questions and help make this question a canonical for this topic that is sure to pop up a lot... So I assume that means there will be windows update patches available until that date? MS will continue to release new patches/updates for XP until that date. ...


9

Run SCONFIG. Just type sconfig at the command prompt. Then choose option 6 or 7 (the exact option escapes me at the moment) for Windows Updates. You can change your Windows Update settings to install updates automatically, or you can download and install them manually, just like with the GUI. sconfig comes with Server Core out of the box. In fact I ...


9

There isn't a Microsoft-provided "update bundle", WSUS (or SCCM) is the official update tool. In the absence of WSUS, you may consider using a tool like WSUS Offline to download and stage all the desired product updates on your network. Then, as part of your image building process, slipstream/install the updates before capture.


8

We auto install then delay the restart for the install for 30 mins - prompts the user to reboot now and if there is no response in 30 mins then it reboots the machine. There was some initial grumbling but that have gotten used to it. If they are in the middle of something they can click "reboot later" to delay the reboot until a good time. But they will be ...


8

From http://technet.microsoft.com/en-us/library/cc708605(WS.10).aspx This is what's needed to get WSUS working through your firewall (which IMHO you should definitely think about if you have more than 10 clients). This should be the same for a regular client box to access the MS servers. Configure the Firewall Between the WSUS Server and the Internet ...


8

According to this page, they release them at approximately 10 AM Pacific time.


8

I can highly recommend WSUS Offline Update. You can use it to create an USB stick or DVD which you can use afterwards to automatically install all critical updates for every currently supported Windows or Office version. It will automatically restart and continue the update process, so you just need time but can let it work unattended.


8

or not patch at all? This is simply not an option these days. Your system will almost certainly get compromised at some point if you do not apply the required security patches. The only real question is how long you can wait after a patch release until you must install it. patch blindly Ideally you would test, but if you can't test, then at least ...


8

I know mfinni beat me to the punch, but I'm just going to +1 for WSUS. Specifically: Let's assume that you have multiple servers, including test and production. Let's also assume that test has similar hardware to production (which isn't a safe assumption, I know, but let's go with it--it's nice but not necessary). You could set up the following scenario ...


7

If it is set using a Group Policy, you probably cannot override the setting (that's the whole point of Group Policies), but you should be able to visit the Windows Update website and still download updates yourself, you just won't get the prompts and reminders of new updates. You really should open a ticket with your Corporate IT department and work with ...


7

Yes. The easy way, assuming you're not in a domain, is to edit the local policy through gpedit.msc It's in Computer Configuration | Administrative Templates | Windows Components | Windows Update and you can change "Re-prompt for restart with scheduled installations". There are some other settings you can tweak here, including setting AU to download and ...


7

You may want to consider, rather than blocking all updates, managing updates with WSUS. Assuming you have a copy of Windows Server and your clients are in a domain, it's a free option that you can use to only deploy updates when and where you want them.


7

I assume you're deploying settings using Group Policy? If so, I believe this page contains the information you're after: http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx Specifically, the setting: Remove Links and Access to Windows Update If this setting is enabled, Automatic Updates receives updates from the WSUS server. Users who ...



Only top voted, non community-wiki answers of a minimum length are eligible