Stand-alone Microsoft Software Update Service

In my enthusiasm over Microsoft’s Software Update Service add-on to System Management Server recently, I overlooked mentioning the previously released, stand-alone version of SUS. As always, you, my eagle-eyed readers, noted this and gently reminded me.

Stand-alone SUS isn’t as feature-packed as the add-on version, but it doesn’t require you to purchase SMS either. There’s a feature comparison chart at https://www.microsoft.com/windows2000/windowsupdate/sus/suschoosing.asp that can help you decide which of the two products is best for you.

Generally speaking, though, the larger your network (both in terms of nodes as well as geography) the more you’ll want the SMS add-on product. The stand-alone works best for small, homogeneous networks.

Still, if budgetary concerns are keeping you from acquiring SMS (and you can tell the bean counters for me that this is definitely “penny wise, pound foolish” behavior), then head right over to https://www.microsoft.com/windows2000/windowsupdate/sus/redir-sp1.asp and download the stand-alone product right now.

When you’re caught in a sudden rainstorm (and the number and frequency of patches does seem like a downpour at times) then anything that keeps your head dry (such as a piece of cardboard) will work until that self-opening all-nylon umbrella comes along.

You might also want to download the SUS deployment guide (https://www.microsoft.com/windows2000/docs/SUS_Deployguide_sp1.doc) to help you plan how to best use the service. The document will take your hand and walk you through installation and configuration of the server-based utility as well as the client-based agents. There’s also a section on troubleshooting the service as well as useful disaster recovery tips.

Stand-alone SUS will support operating system products only (no patches for applications), and only Windows 2000, XP and Windows Server 2003. Earlier systems will require manual patching. It will automatically distribute and install service packs and patches. New security patches, for example, can be installed within a couple of hours of their release without any intervention on your part (provided, of course, the service is properly configured).

This isn’t the nirvana of patch management, but it is better than trying to do it all manually. So until you get the budget for a full-blown management package, this could help protect your network and your users for, essentially, no cost at all. It’s certainly worth investigating.