SBS2011 Detailed Network Report shows missing updates

Question

My SBS 2011 Detailed Network Report shows 70 missing updates for the SBS server and 95 missing updates for the Terminal Server. The server has not been restarted for 140 days.

I have asked my IT support company to review this but they have advised that no action is necessary and to ignore the report.

1. Can anyone confirm what action should be taken if any?
2. Should these server updates be regularly applied?
3. What information should I take note of in the Detailed Network Report?
4. Are there server updates that need to be applied that will usually require the SBS 2011 to be restarted once a month?

Answer 1

Your servers are missing important updates

Here's proof:

According to the "Understanding Reports" link (available online here) found at the top of the Detailed Network Report in Windows SBS 2011, the "Updates" section:

Displays the status of computers that are missing updates, computers with updates that were not installed successfully, updates that are pending approval, the status of updates synchronization, the time when the last synchronization took place, and the time of the next scheduled update synchronization.

That page refers you to the TechNet page Monitoring in Windows SBS 2008 (which is still accurate for SBS 2011) which makes the following recommendation in the Monitoring Updates section:

To help keep your Windows SBS 2008 network more secure, it is recommended that you install the software updates as soon as they become available.

That page in turn links to the TechNet article Managing Software Updates in Windows Small Business Server 2008 (again, accurate for SBS 2011) which tells us that these Updates are sourced from the bundled installation of Windows Server Update Services:

Windows Small Business Server 2008 (Windows SBS) Update Services provides centralized update management for computers that are on the Windows SBS 2008 network and that are running one of the Windows operating systems that support Microsoft Update. By using Update Services, you can help protect the Windows SBS 2008 network by keeping Windows-based computers that are on the network up-to-date with the most recent Microsoft software updates. Update Services uses Windows Server Update Services (WSUS) 3.0 with Service Pack 1 (SP1) as the underlying technology for managing updates.

(emphasis mine)

So are these updates important?

TechNet's instructions to Change software update settings in SBS 2011 indicates the following options are available for servers:

• High All updates, service packs, and Windows Small Business Server update rollups are automatically approved for installation.

• Medium All security, critical, and definition updates, and all Windows Small Business Server update rollups are automatically approved for installation.

• Low All security and definition updates are automatically approved for installation.

• None No updates are automatically approved for installation.

Notice that Security updates are included for all but the "None" option. You indicate you have pending 70 updates for one server and 95 for the other. In my mind it's impossible that there are this many service packs, update rollups, and definition updates yet uninstalled on these servers. Therefore I conclude your servers are missing important security updates.

Direct answers to your questions:

Can anyone confirm what action should be taken if any?

Install the security updates (at minimum), but as recommended by Microsoft in the linked articles above, it would be best-practice to install all available software updates.

Should these server updates be regularly applied?

Yes. As soon as they're released.

What information should I take note of in the Detailed Network Report?

That depends on your server's configuration. An exact answer cannot be provided here. However, use the report to ensure updates are applied properly, and if a backup is configured on the server, that it's running as scheduled.

Are there server updates that need to be applied that will usually require the SBS2011 to be restarted once a month?

SBS 2011 is actually an installation of Windows Server 2008 R2 Standard edition that is bundled with:

• Exchange Server 2010 Standard
• SharePoint Foundation 2010
• SQL Server 2008 R2 Express
• Windows Server Update Services 3.0

In my experience the 2008 R2 operating system alone is affected by updates released by Microsoft every month (on Patch Tuesday), at least one of which requires a restart. Add in the many additional updates required by these major bundled products and you have a near-impossibility that your SBS 2011 server will go more than a month without requiring an update-related restart.

Answer 2

The detailed network report is largely based on a Windows Server utility called Best Practice Analyzer (BPA). This automatically checks system status and configuration and looks at the event logs.

A server restart is sometimes required to install updates, including critical updates. The length of time required between restarts is not fixed; it depends on what updates are installed. However in 140 days there will have been a number of updates that require a restart.

We can conclude then that this server is not maintained according to Microsoft best practices, though that is true of many servers out there. This is not the place for opinions about this nor about your IT support company. Depending on your agreement with them, I'd suggest a discussion on the subject so you can be clear about what is expected of them and the rationale for how the server is maintained.