Understanding the future security of Windows SP2

I am a bit worried about the updates to Windows Update, I went and read the article you posted from winsupersite, and then went and read the applicable section of the microsoft paper.

In the article, someone is quoted as saying that the new Windows Update will be more in users faces. If something is in my users face, that means they are in my face, that is what as known as "a bad thing".

Presently we do not use the freely available Software update server(or whatever it is called, I forget) because we found that it did not work terribly well. In addition, configuring some clients to acces it was cumbersome at best and SMS is a hella lot a monaaay, we tend to use auto-update, or in certain cases, not, but someone checks the machine every time they have to go there to sort a users issue out(mostly for highly bitchy users). The article hints at a better Software Update server, but in my read of the relevant section of the whitepaper I see no mention of it, only the Windows Installer stuff, and no mention of the server component at all.

I suppose the new Windows Update will be configured to work well with SMS 2003, but, that is not an option for many organizations, mine included. A working, free or low cost local Windows Update Server really needs to happen if they are going to be more in the users face about patching. As I said, SMS is really not an option, the Current Software Update Server is nowhere near configurable enough as far as what patches are allowed and not. We have certain client machines and even servers that serve a specific purpose which cannot be automatically updated because a certain patch or Service Pack breaks them. Sure you can disallow certain patches with SUS, but that disallows it for everyone, not really a good thing.

So, I really hope they come out with a better version of SUS, cause having users in my face more often is definitely going to sour me even more than I already am.

A few recent changes I want to bring to light:

- Updated Control Panel Icon : change - Icon change only

- Update Firewall General settings : change - minor layout adjustments

- Updated Firewall Ruleset Settings : change - layout and placement of menus along along with the new feature of choosing per ruleset of local use, or subnet only.

- Updated IE popup blocking - change - Show Information Bar when Popup is Blocked option avaliable now


And some more indepth changes, no images however (lost them in a recent format and forgot to backup)

Security Center

This is the control panel that helps handle the larger view of Windows security. Autochecking for an existing firewall, an existing virus scanner, and checking to see if automatic updates is turn on or not.

And not to worry, when you ask to turn on one of the security features, it gives you the choice to use their built in software or to let it know you shall be using your own. This is great news for admins, as it means they can keep their existing 3rd party software installed at the click of a button. While an AV solution is still not released yet, it gives the option to select that you have your own AV software already installed and would rather use that.

A nice check on the first startup after the SP2 install is the automatic update check. Running before Windows fully loads, it is a "in the face" reminder to all home users how important updating the OS is.

That's it for now. As I run across more I will post it. Sadly, I can not edit the origonal post without contacting an administrator due to it being over 1400+ minutes old. Hope this newest information helps solve some questions we had earlier!

Them links ain't working... :(

Just barely lost my connection for a moment. Retest for me?

edit: links down for a moment, resetting compy one last time

They seem to be working now. hmm that is strange They all work for me with no problems
:D

Them links still ain't working...

Oh... nevermind.. I see them, albeit it a bit slow... :D

Okay. Final reset. Server is back up. All permissions set. :) Should work perfectly now. Sorry about the wait, ISP was acting up.


On a side note, I don't know if I'm liking SP2 build 2082 as much as I did the previous beta release of SP2. Primarily because (and granted it is still beta), but it seems like a few features got fscked in the Security Center.

For instance, I have the new firewall up and running but the security center swears up and down that it isn't on. After some testing, I've learned that the outbound detection of the firewall has suddenly stopped working while the inbound works perfectly. Rulesets are all in place, all configurations are up to par... but for some reason it just won't detect. This isn't permenate of course, as the build before it worked perfectly. All in all, this newest beta looks better, but has a few glaring errors.

Almost tempted to go back to the previous release :( Let's hope they get these bugs fixed soon.

Quote:

---

Windows is always going to be bashed about, partly due to users experience with it and partly because they are in the spotlight so much.

---

Isn't this the sole reason why Microsoft gets so much stick? I'm sure if the linux source code wasn't available and they where just as big as Microsoft they would be in the exact same position.

It's just a case of preferring the underdog in most cases as far as i can see, and i don't think i need to know much about security to say this.

Throwing in my 50 cents...

Yes Windows is bashed because of being in the spotlight, but a lot of power users bash it because it really isn`t very good. Speaking from my own experience, and I believe that is rather extenisve, Windows has show time and time again that its a good OS for the home user but just doesn`t perform well in a professional environment as the server backend. Yes its great in that it supports all the hardware in the world, and yes its got a nice GUI, but deep down it still has some big issues, and I`m not advocating Linux as the answer either. In a professional environment AIX, AS400 etc... all kick Wndows ass in reliability and performance, this is why Windows gets bashed, its touted as the ideal server environment but isn`t and when it performs poorly it deeply annoys us folks. It keeps trying to be all things to all users, and isn`t, it can`t be, not unless we really have differentiated products, Windows for servers, and Windows for home users.


This posting may be due to me having a very bad windows related day.......

So I take it you have never tried Windows 2003 Server Edition?

Actually I was involved in some beta testing with it and its not bad, have a copy somewhere.

But how many organizations have switched to it??? so therefore its not much help to me at the moment, but thanks anyway.

The majority of people that were using windows 2000 Server edition switched to 2003 Server edition.

No, absolutely not, most clients I have been working with are still using Win2k for their Windows servers, and that includes serveral large banks, credit card processing firms, and big consulting companues, not seeing much use of Windows 2003 at all on a large scale corporate use. Most large corps wait at least a year or two before swicthing over.
Add to this the poor economic situation of the past coupole of years and the tightening of IT budgets by many companies and the result is that there is still a huge Windows 2000 base out there (and even a number of NT systems).

Then allow me to rephrase:

Almost all companies I have done webwork for, or security work, have upgraded to 2003 Server Edition. Even then, Windows 2000 Server Edition is another server oriented distro, unlike Windows 2000 Proffessional. There are quite a few server-based distro's in Windows, you just have to look :D Thus solving your problem

Ok, well all the companies I have done work with, with includes probably half the fortune 100 are still using Win2k as their main Windows platform with only a small Window 2003 installation.

And I still think there is an inherent problem with the professional, server, advance server, data center, web server etc... distros being built around the same core for the most part. AIX, AS400, HP-UX, Tru64 etc... do not come in a nice shrinked down home user version, instead they come in solid (for the most part) server orientated distributions that do their job well. I believe that only when MS stop trying to please everyone with one thing will they be able to achive what they want. Of course if we want to stay with the Linux v Windows for server argument then sure, Windows does a fine job, but then Linux is still not achieving widespread acceptance as the server platform of choice. This is, of course my opinion, and is based entirely on my experiences, buts that what I have seen, and do contiue to see every day.

I think its important not to believe all the MS hype about this stuff, for instance right now on the MS Windows 2003 website you can read all about how Network World voted Windows best server os, when compared to... Suse, Redhat, OSX, and Netware, I mean come on, how about Windows 2003 v AIX, Solaris, AS400, Tru64, etc... and lets not do comparisons based on how nice the GUI looks, or how many types of themes we can have, lets compare on uptime, security, and performance. If MS want to only compare Windows to Linux, OSX and Netware, then lets see them stop touting it as the OS to replace all your servers with.

And you know, at the end of the day I really want Windows to work because I do like it, but in the real world of high volume transactional processing where reliabity and performance are what counts, it just doesn`t hold up(in my experience).


Pooh. I fear we could keep going back and forth on this all day....

Quote:

---

I really want Windows to work because I do like it,

---

I don't never notice it *not working* though, through what I can most certainly call a looong history of use with it. Proper configurations almost always ends in proper usage

But that isn't the point :) And being as level headed and kind as you are, I don't want to see this go into an argument.

My point was that when you mentioned that the Win distros were too Home orientented and not Server oriented enough, I wanted to point out a few that were very server oriented. Windows 2k server, Windows 2003 Server. Hell, sometimes they are so against desktop oriented behavior that you have to disable some services and enable others, just to have audio. That was my origonal point. Just that they are out there :) And from my experience, they do have the security and stability (talking about the serve distros) that you wanted. Thus why I mentioned them, but not in a sense to argue.

Thanks for your thoughts! :D

ok, lets agree to disagree on this, but I am still going to wait for the Windows 2003 v Other server OS comparisons..... :D

Comparisons:

http://www.open-mag.com/features/Vol...NET/TuxNET.htm

http://www.microsoft.com/windowsserver2003/default.mspx

http://www.nwfusion.com/best/2004/0223os.html

http://www.eweek.com/article2/0,4149,1238672,00.asp


Of course you can find tons of *anti* Windows 2003 server papers out there. But it falls back to an old adagio: "An admin who does not understand his tools, will blame the OS before blaming himself"


Also note the same rule of thumb applies: If you learn and fully understand the OS, you can make it do whatever you want. Regardless of "distro" or "linux-based windows-based"


edit: Yes, agreeing to disagree is a happy thing :)

although those comparisons are all Windows v Linux, as I mentoned before...

I fear we may both be last answer freaks.... this could go on for days... lol.

:D

I thought you wanted Windows Server vs Linux Server comparisons? Or do you mean Windows Server versus Windows Desktop comparisons?

No, I said

"how about Windows 2003 v AIX, Solaris, AS400, Tru64, etc"

Ah, I thought we were discussing Linux Severs. Windows is a ways away from Solaris, etc, but it is on par with Linux based Servers, which according to netfind is the largest server distro being used. When Linux/BSD get up to par with Solaris and Tru64, then and only then can we expect Windows to do the same.

Wouldn't you agree? It isn't fair to compare Linux or Windows to distro's that have been out longer than some of the people on this community have been alive. < obligatoryjoke > But I would assume the pricing is about the same for a RedHat enterprise licence, a Windows 2003 one, and a Solaris one. :) < /obligatoryjoke >

Shouldn`t Windows be compared to all the Server Operating systems out there? afterall isn`t that what its competing with? Or if not, isn`t that what it should be competing with? Then perhaps MS would add more improvements to it (in order to allow it compete) and thus we end up with a more robust OS.

And Windows is 20 years old now (Orginally announced in 1983 I believe) which is probably also older then a lot of the folks on here...and Sun produced their first OS years before that ... in 1982. So I think a comparison is due...

No I don't think it should be compared. Windows is not competing against Solaris or other similar OS releases, they are competeing with Linux.

Look, I can see where this is going, so I'm only going to say this once:

I know you are a linux zealot, and hate windows. I know you expect windows to live up to every OS around. I know you could go on and on about how Windows doesn't do what you need it to. Here is my responce to this, and here is where it ends:

Stop being a hater, and learn to respect both. Not just for what Windows has done to the PC world, but because there is not a single thing any OS can do that every other OS can not do. If you want to compare and rant about how Windows isn't living up to Solaris, point fingers at Mac, at Linux, and other distros as well. Don't be onsided, and recognize that certain Companies(communities) are focused on other parts of an OS more than others. This is a Good Thing©. And finally, if you took the time to learn Windows, you wouldn't complain about it. Why? Because never once have I heard a complaint from a windows admin when they knew what they were doing. Sure, tons of complaints are given by other admis, but when you look at them, they never actually understood the OS inside and out. Windows can do everything else Solaris can do, without a doubt. Preformance will vary, but capability is there.

This is why we have multiple linux versions. Some want more focus on security, others want more focus on desktop usage. Calling Windows not robust simply states that you have not taken the dive to learn it as well as your current and most used OS. You would say the same thing to me if I said Solaris and Linux were not a robust OS : "Why not try learning it before claiming such dumb accusations". You see something not-robust. I have learned it to the point of it being beyond robust.

That's the end of my rant. You won't budge and learn Windows long enough to know how it scales up to other OSes, and I won't budge from respecting each OS equally because I like to learn them. This conversation will go no where, and it needs to be stopped before it gets waaaayy out of hand.

Ok, now in response to your little windows rant.. I am not a Windows hater at all, in fact I have used Windows in one form or another since 3.1, and believe that I do know it very well, having been involved in conversations with MS during the development of the two last versions of Windows and conducting testing of it, so spare me the Linux v Windows hater piece, I really do not have the time to hate any of them, I need them to do what I want them to do, isn`t that how it is meant to be?

I am a user who wants to see Operating systems perform well, who wants to have them do what he wants and not have to worry about them (to this end I have used Windows, Linux, Solaris, BSD, AIX, AS400, HP-UX etc...) so you need to not make this into a Linux v Windows arguement (which is what you seem to be doing), that is not what this is about, this about Server operating systems and what they need to do. I do take some offence at your patronizing tone, and especially at the Linux Zealot piece, you yourself would appear to then be a Windows Zealot.

I mean seriously, I need to learn Windows long enought to know how it scales up?, well 10 years, 50 odd global installations and troubleshooting engagements, an exchange network of approx 2000 servers, one of the first Windows SAN implementations, developing Windows training courses, I think allows me to make a qualified opinion on Windows, and if not then I would like to know what would?

Oh, and sure, lets talk about Mac, Linux etc....whatever you would like to discuss, although I fear that your wealth of knowledge on the subjects will undoubtedly lead you to the correct conclusions regardless, which will no doubt be that yes they are all good and bad and yes we should respect them all, well, no s##t.

and now I`m done with this.

Quote:

---

I am not a Windows hater at all, in fact I have used Windows

---

Just like the forums, how long you have been here/using windows does not make you smarter, more reliable, nor justify you as a hater or lover of the OS. Time != love or hate.

Quote:

---

I need them to do what I want them to do, isn`t that how it is meant to be?

---

Like tools, that is correct. Like tools, you have to learn to use the tool so you can use it as *it is meant to be*.

Quote:

---

I am a user who wants to see Operating systems perform well, who wants to have them do what he wants and not have to worry about them

---

Not worry about them? Then you have never RTFM on anything? It's all automagically always worked for you on every distro you have ever used? Or wait, better yet, you found a perfect distro that requires no fixes, no updates, no configurations, and is a perfect OS balance between security and desktop usage. Please, enlighten me.

Quote:

---

you yourself would appear to then be a Windows Zealot.

---

I am most certainly not. I defend Windows yes, because most people who bash it have no clue what they are talking about. I defend other OSes just as much if needed, because chances are the Windows people bashing it do not understand what they are talking about. I enjoy all OSes and respect them equally. When I get angry is when people bash without warrent or knowledge.

Quote:

---

I mean seriously, I need to learn Windows long enought to know how it scales up?, well 10 years, 50 odd global installations and troubleshooting engagements, an exchange network of approx 2000 servers, one of the first Windows SAN implementations, developing Windows training courses, I think allows me to make a qualified opinion on Windows, and if not then I would like to know what would?

---

You would need to learn Windows. Not windows 95. Not windows me. Windows. Time != experience, so toss out the ten years. Your above statement is similar to saying : "I've used Redhat 4 and 5, and maybe up to 6 for the past ten years." Upgrade, learn the differences, and understand how to fix all things *problems* you have with OSes.

Quote:

---

Oh, and sure, lets talk about Mac, Linux etc....whatever you would like to discuss, although I fear that your wealth of knowledge on the subjects will undoubtedly lead you to the correct conclusions regardless, which will no doubt be that yes they are all good and bad and yes we should respect them all, well, no s##t.

---

Then do not blame Windows for not being up to your own personal par level. Blame your lack of knowledge on configuration and the understanding of the tools that do the job. Damn right Windows 95 can't handle what you want. So drop it and learn XP, or 2000, or 2003. As my father said "A rusty hammer is never any good. Sometimes you just have to get something new". Your wisdom of Windows can't stop at 98 and prelrease 2000, otherwise you end up saying "Windows can't do ___insert excuse here_____"


"An admin who does not understand his tools, will blame the OS before blaming himself"



EDIT: Wow, you were right, we are both hardcore "last word in" kind of people lol. Hey, let's calm down, start over, and settle this in AIM? No need to keep filling up the thread with our banter :D

Ok, in response to your response (as you seem compelled to continue)

Yes how long you have used something does not make you smarter, better etc..if you are doing the wrong thing, but since I did these things for mission critical systems that probably you yourself have used unkowingly at some point, I believe that I do indeed know how to use Windows.

Second point on not worrying about them ,well there you seem to have missed the point, not worry about them means that once I have them doing something I would appreciate if they kept doing it, which once again, I thought was the idea? i.e. If SQL is today processing thousands of transactions then you know what, tomorrow I want it to do that as well.. See I know that it doesn`t work straight out of the bag (but thanks for pointing that out) but once its configured I want it to work, and this applies to all OS's, Windows, Solaris, AIX, etc..

Your next comment is once again a patronzing one, alas.

Next, I have used all of them, oh and to jump back a point I helped write some manuals on some of it, so rather then RTFM how about WTFM? Oh, and more accusations of a lack of knowledge,I wonder why this seems to be the common thread of your arguement? When its clear that your knowledge of areas such as non Windows/Linux OS, and the real world (as in "everyone who used Win2k has swicthed to Windows 2003") are rather lacking.

And my use of windows goes all the way up to 2003 and beyond, and you know what, if something doesn`t work as you are told, or expect, or planned, then it is absolutely your right to question it.

Your arguement seems to be based around "if it doesn`t work then its your fault as you don`t know what to do" so, when planes crash do you blame pilots? or when your car breaks down is that your fault as you didn`t tune the engine up? or how about when your TV goes wrong? or when your wordprocessor craps out and you loose that report you were up all night writing? sure sometimes you do, but sometimes you can blame the folks who made it in the first place, or at least question them.

Now I have to go and do some work on a Windows cluster that is acting quirky, luckily, as I now know this is clearly my fault I will be in a much better position to fix it...

If you want to continue this pissing contest then you`ll have to wait till I get back from troubleshooting some Windows (and then an AS400) boxes. Although I really don`t have the time to waste on this regardless of what I am doing.

So, go ahead, write another post speaking to lack of knowledge and so on, whatever makes you feel better, or perhaps you will come up with a whole new angle, who knows...I for one am done with this, have a nice day.

Have fun :) And consider putting your skills where your mouth are and apply for my security test on the forum.

there new popup blocker works great