Tag Info

Hot answers tagged

30

Short answer - yes. Most of the Windows Updates are security related. Not having the patches means you're vulnerable. Longer answer - you need a procedure that covers this sort of thing. It's more rare these days, but sometimes a patch can break things, or change behavior in such a way that it's broken as far as your company is concerned. You should be ...


18

The generic answer is it is a good practice to keep your servers updated. But pay attention to a few things: Updates may cause the server to be sluggish during installation, or even cause some downtime if they require reboot(s). You should plan to do them out of office work hours. Updates have some risk associated. They might break your server, or cause ...


18

If you are starting from a bare metal install, you can slipstream updates into your installer disc so it already has updates in it (this depends on how many installs you're doing to make it worth it). WSUS will not reboot your computer for you. It only keeps track of your updates and will act as a repo for updates so that rather than updating 300+ meg of ...


17

Does the server have to run Windows 2003 Server, or will Windows XP Professional work? Yes, Windows Server is required. Where do I download the WSUS packages from? Microsoft's website: WSUS 3.0 How can I configure my computers to look for updates from my server instead of the internet? There's a deployment guide & a step-by-step guide that explains ...


12

Sounds like you don't test your group policy changes in a lab first, eh? Create a GPO with settings the "Configure Automatic Updates" setting in the "Windows Update" node of the "Windows Components" node of "Administrative Templates" set to "Disabled". As long as you haven't done something to disable periodic policy refresh, which happens every 90 to 120 ...


11

WSUS can automatically install updates, including the Microsoft Update stuff.


11

Yes. You can install all of the updates available - via either Windows Update in your Control Panel, or the yellow WU shield in the system tray near the clock. Then, when that's done, you can do a reboot from the Start Menu (or calling shutdown /r from the command line.) The only other ways to automate it all in one step is via writing your own code (not ...


10

I believe, ultimately, the correct answer is "Fix your application". However, you may not be able to for any number of reasons. That being said... Which version of Windows? In Vista/2008 and up, you can tie Scheduled Tasks to specific Event IDs. In the System event log, Event ID 19 from WindowsUpdateClient, indicates successful WUA Update ...


9

Run SCONFIG. Just type sconfig at the command prompt. Then choose option 6 or 7 (the exact option escapes me at the moment) for Windows Updates. You can change your Windows Update settings to install updates automatically, or you can download and install them manually, just like with the GUI. sconfig comes with Server Core out of the box. In fact I ...


9

I won't speak to WHEN it will happen, since the date has fluctuated...but to answer your questions and help make this question a canonical for this topic that is sure to pop up a lot... So I assume that means there will be windows update patches available until that date? MS will continue to release new patches/updates for XP until that date. ...


9

In group policy for the server, navigate to: Computer Configuration->Administrative Templates->Windows Components->Windows Update->No auto-restart for scheduled Automatic Update installation You can get to this by running "gpedit.msc" Reboot to apply changes.


9

I would just like to get on my auto-reboot soapbox for a second: it's been my experience that automatically/forcing a reboot is generally a bad idea. We system admins often have somewhat of a complex about making sure the latest patch has been applied the second it's installed because OMG until then the system is unpatched. However, you must realize that ...


8

According to this page, they release them at approximately 10 AM Pacific time.


8

Not sure about Windows 7, but with XP/Vista, you could run the following command to detect and download updates: wuauclt /detectnow /reportnow If you have issues getting it to work, check out the WSUS Wiki. Otherwise if you have a specific update that you want, just download from the Microsoft website. If there's some problem preventing you from ...


8

We auto install then delay the restart for the install for 30 mins - prompts the user to reboot now and if there is no response in 30 mins then it reboots the machine. There was some initial grumbling but that have gotten used to it. If they are in the middle of something they can click "reboot later" to delay the reboot until a good time. But they will be ...


8

I can highly recommend WSUS Offline Update. You can use it to create an USB stick or DVD which you can use afterwards to automatically install all critical updates for every currently supported Windows or Office version. It will automatically restart and continue the update process, so you just need time but can let it work unattended.


8

or not patch at all? This is simply not an option these days. Your system will almost certainly get compromised at some point if you do not apply the required security patches. The only real question is how long you can wait after a patch release until you must install it. patch blindly Ideally you would test, but if you can't test, then at ...


8

I know mfinni beat me to the punch, but I'm just going to +1 for WSUS. Specifically: Let's assume that you have multiple servers, including test and production. Let's also assume that test has similar hardware to production (which isn't a safe assumption, I know, but let's go with it--it's nice but not necessary). You could set up the following scenario ...


8

There isn't a Microsoft-provided "update bundle", WSUS (or SCCM) is the official update tool. In the absence of WSUS, you may consider using a tool like WSUS Offline to download and stage all the desired product updates on your network. Then, as part of your image building process, slipstream/install the updates before capture.


7

At this point, with 75 updates, if something goes wrong it'll be hard to pick out which one broke things. That calls for extra caution, in my opinion. If this is a VM: Clone the VM. Patch the clone. If this is a success: Take a snapshot of prod. Patch prod. In case of disaster, roll back. If this is physical hardware: Patch any "test" ...


7

And I found the source... a Barracuda Web Filter set to block Windows Updates... Soooo wrong (another admin configured this)... Administrators should understand this this is a poor way of managing bandwidth.


7

It is a Server 2012 core install. Just use the command line tools. http://www.moundalexis.com/tm/2010/01/07/windows-update-wuauclt-command-line-switches/ wuauclt basically allows you to do updates.


7

I know this question is a bit old, but there's some untruths being posted here. There is nothing wrong with how SCCM 2012 functions, the problem is a misunderstanding of how it deploys software and updates. It is not fair to quote Microsoft when they say it was behaving "by design" and that you cannot do anything but set a deadline far into the future. This ...


7

I assume you're deploying settings using Group Policy? If so, I believe this page contains the information you're after: http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx Specifically, the setting: Remove Links and Access to Windows Update If this setting is enabled, Automatic Updates receives updates from the WSUS server. Users who ...


7

You may want to consider, rather than blocking all updates, managing updates with WSUS. Assuming you have a copy of Windows Server and your clients are in a domain, it's a free option that you can use to only deploy updates when and where you want them.


7

If it is set using a Group Policy, you probably cannot override the setting (that's the whole point of Group Policies), but you should be able to visit the Windows Update website and still download updates yourself, you just won't get the prompts and reminders of new updates. You really should open a ticket with your Corporate IT department and work with ...


7

Yes. The easy way, assuming you're not in a domain, is to edit the local policy through gpedit.msc It's in Computer Configuration | Administrative Templates | Windows Components | Windows Update and you can change "Re-prompt for restart with scheduled installations". There are some other settings you can tweak here, including setting AU to download and ...


7

From http://technet.microsoft.com/en-us/library/cc708605(WS.10).aspx This is what's needed to get WSUS working through your firewall (which IMHO you should definitely think about if you have more than 10 clients). This should be the same for a regular client box to access the MS servers. Configure the Firewall Between the WSUS Server and the Internet ...


6

Have users on a VLAN that doesn't route directly to the internet and use ISA or your open source caching server of choice. Faster less intrusive options: Update AD so that computers don't auto update Temporary update to the dns server so that their download doesn't resolve Temporary update to kill requests to the windows update server at the firewall ...


6

I happened to be researching this same error code this morning, and came across this MSDN blog post that might help: How to overcome error 0x80070490 when installing updates in Windows Vista/Server 2008 I was not able to get it working again by following his step-by-step, but the following did: Open %windir%\logs\cbs\cbs.log. You'll likely need to run ...



Only top voted, non community-wiki answers of a minimum length are eligible