Microsoft patch management

In the past few weeks, we’ve written about a number of third party products that help managers keep track of patches for Microsoft software. But what does Microsoft offer on its own? Well, Microsoft provides several patch management tools, some of which are available for free.

For small businesses, Microsoft recommends using its basic Windows Update Service, the same service most consumers use to keep their Windows systems up to date. The auto-update client for Windows Update is included in Windows XP and Windows 2000 Service Pack 3.

For larger organizations, or those that want to centralize patch management internally, Microsoft offers Software Update Services (SUS). SUS is basically a Windows Update Server housed on your corporate network.

Using a Win 2000 Server and installing SUS software, which is a free download from Microsoft, you can point the auto-update clients on all your systems to your internal server. The internal server synchs with Microsoft’s Update Servers to provide up-to-date patch installations. One note: SUS only synchs critical updates for Windows. To configure the client systems to monitor the internal SUS server, the changes can be made through Group Policy or by manual registry changes on each system.

For larger companies, Microsoft released the SUS Feature Pack to its existing System Management Server (SMS) product. While organizations must purchase an SMS server and clients, the SUS Feature Pack is a free add-on. So for organizations already using SMS, the Feature Pack provides a cost-effective means of providing enterprise patch management.

The feature pack uses HfNetChk, Microsoft’s freely available patch tool licensed from Shavlik Technologies, as its engine to show patches that are installed on a machine and those that are missing. A wizard then lets administrators create SMS deployment packages to enable the missing patches to be installed on the necessary systems.

Microsoft offers some powerful patch management tools for free, but they are not designed to scale to very large corporations. SMS has the ability to support a large organization, but it is a bit of overkill if you are just looking for patch management. Additionally, the free Software Update Service only supports “Critical” updates, so you will miss out on any other deployments Microsoft releases. For the full report, go to https://www.nwfusion.com/reviews/2003/0303patchrev.html