Admins... Microsoft Auto-update.....

At the top of the page leading to here is a very interesting piece of information which should mean that there is very little excuse for admins to not automatically patch public servers in the near future. I for one see this as a huge benefit......

Quote:

---

And, we will provide rollback capability for all patches, so you can roll them out and roll them back if there is an application incompatibility or something unanticipated

---

How many of you will reconsider auto-update when this rollback ability proves functional?

What would you say if M$ began shipping products with auto-update turned on?

<quote>
What would you say if M$ began shipping products with auto-update turned on?
</quote>

I would be very happy.

For the time I would spend fixing little issues it causes at work It would more than half the number of updates I need to do for friends/family/co-workers at night.

Hi Tiger Shark,

For home users, SOHO, and small businesses it sounds like a good idea, given the amount of grief caused my malware spreading via unpatched machines lately.

Larger organisations will not want to know, because they have the resource to tackle the issue in a more traditional manner, and are much more cautious (generally because they are more dependent on their systems).

For example, I cannot see it being acceptable in the Defence and Financial sectors?

I think we have to wait and see how reliable the patches are?

Cheers

Quote:

---

Originally posted here by nihil
Hi Tiger Shark,

Larger organisations will not want to know, because they have the resource to tackle the issue in a more traditional manner, and are much more cautious (generally because they are more dependent on their systems).

Cheers

---

Now this did make me laugh. As I work for a "larger organisation". I am the resource to tackle the patching problem, simply because I was silly enought to alert management to the possible problem. And caution can be made into an art form.

Yes, you are right about finance and defence organisations probably being less overjoyed at the prospect - but one would hope they also have a much more rigorous approach to software updates anyway.

From my position, I would love updates to be automatic, particularly if rollback is relatively simple. It would have saved me a lot of work over the last couple of months. If we can only work out how to update everyone to achieve this ....

One of my concerns would be the potential to spread an infection via auto-update technology. It would spread a virus very quickly if it could be done.

i am in agreement with most people here, it would be a good thing for the general user, who most of them have never even been to windows update.

BUT

Quote:

---

One of my concerns would be the potential to spread an infection via auto-update technology. It would spread a virus very quickly if it could be done.

---

as schrodinger mentioned, if it could be done, that would be a concern definitely.

as for large corps...they could mitigate this concern by setting up their own SUS server(s).

You can already roll back MS patches without issue. Control panel- add/remove software. Every patch is listed there and the files that were replaced are stored in hidden directories under the winnt directory.

I wouldn't mind auto-update being enabled by default. For my mission critical systems I would just make sure to turn that off as I would not want the system to update without being able to test the patches in a lab environment first.

Also, as it is usually the case that a configuration change can prevent exploitation of a bug, I prefer to make configuration changes before I would install a patch.

Although I am a fan of any kind of AutoUpdate for home users (friends of mine dont download the patches at all and wonder why their systems are riddled with viruses) I cant wait to see the guy who is wondering why his 56k modem is so slow because of a huge service pack downloading in the background. If MS could make the patches smaller then I could see this really being a good thing. My friends mostly do not download Antivirus and MS updates because they are big and "take too long to download."

mohaughn: there are a number of updates that cannot be removed in that way. MDAC comes to mind as one.

from the point of view of a larg operation with a lot of ustom com objects this is a very bad idea I haven't installed a MS patch that didn't break one of our objects. but we allready block ms auto update at the firewall so I am not to concerend if they turn it on by default

Well, I work in the security business (Alarm Monitoring Station) and the use of the suto update would never fly with us. We have way to much riding for the remark "if there is an application incompatibility or something unanticipated". Downtime is not an option here. If we have down time, houses, churches, businesses get robbed, pilaged, burned to the ground.

Our systems rely on about 3 clustered auto back-up SQL systems, 50 windows workstations, and several other systems and recievers for the alarms. If these systems start failing, because of an auto-update gone bad, were in some deep ****. Especially with all the specialized software we run.


On more of a personal level, I don't always just slap the updates on my personal machines either. I wait for a while, back up all my databases and web designs, files, etc and then reluctantly cringe when hitting the update button.

Just me I guess.

IMHO it all comes down to what type of system you are patching.

As bballad & xmaddness noted, an automatic update could screw a corporate or small business system, so there is no way you would apply any updates without testing them first. Well, I certainly wouldn't recommend it to anyone.

However, when it comes to your bog standard home system, I have yet to see an MS update that does any damage. Not all the MS patches work of course :p , but at least they don't damage the end users system.

There is a problem with big MS updates, so why doesn't MS pop up a warning box saying this update will take xx mins to install (on a 56k modem which they should know you are using) - go & have a cup of coffee ??

At the moment, working in my unofficial sysadmin role for friends & family, I recommend they check manually once a week, make a note of the estimated download time for critical updates, add 50% (!!), and come back when it is finished. AV updates are not so bad, as these tend to be optimised for dial up anyway.

I always leave them with a check list of what to do & how often to do it, with the option of emailing me if they are unsure.

Are there any organisations that have a lab setup, before deployment? mean, a day or 2 (maybe even a week) of testing application behaviour after patches have been deployed from SUS Server, with a staged progressive roll-out across the enterprise? Makes sense if organisational policies and proceedures are in place.....always good idea to back up and archive before patches are deployed. if one fails to plan one plans to fail?

I have to say that this auto update is already in there. you just have to switch it on. thats what i seem to notice in windows 2000. its off by default, if you swtich it on it will inform you once updates are available. for home users and non critical systems i guess its a good thing but for critical systems where down time is not an option then this is not a good idea as you will need to patch them in the labs first and test it out to see if anything is broken by the patch.

S1lv3rW3bSurf3r: we do a dev to stage to production setup with a test lab for all patches first, in my office this is vital, as Isaid before we have a lot of custom in house com objets and MS patches tend to break at least one of them.

I would never use the auto update feature. You never know exactly what it is updating and with my experience with MS's rollback feature. Lets just say "format c:\".

I am working towards getting the auto update approach agreed, but from a SUS server, so we have an opportunity to test and validate patches with out software before rolling them out. With the desktops, this should work reasonably successfully, given our normal configuration.

What I will need to work harder on is the server updates. I think we could get these to work too, particularly as we don't have any 24/7 critical systems ( xmaddness - you are absolutely right, auto update on your systems would be a seriously bad idea ). I have to question what is worse - an hours downtime of one system, or another network infection. Given that the last time we were hit, one of our offices was completely out for an afternoon, I think we can handle the occasional problem.

I know this wouldn't work for everyone. It is an assessment of the most likely dangers to our systems that has led me to this approach. I have also not had any problems with any MS patches on my desktop machine ( except a certain Office SP, which had to go ).

I'm surprised that I have not seen this alternative. It is possible to setup your own windows update server. When you do this you have the flexibility to select which patches you want to install, and you can also have SMS push the updates to the computers during non peak hours when the users will not be interrupted by it.

From what I've heard the server setup is relatively easy to install and this will fix ALOT of vulnerabilities to a massive amount of computers and quickly. I don't really know of many other ways you can say you've patched 1800 computers in a day!

Just a suggestion!

Have a great day!

I assume you are talking about SUS? It is a decent solution, and free but not fool proof, it dosn't allways detect what patches need to be installed correctly (the first RPC patch comes to mind). We use a product from alteris that seems to work better.

This is what I do now:

Disclaimer: I don't consider my web sites, email etc. that are available from the public network to be mission critical...... We do no e-commerce and the hit rate for the sites will hardly have the phones ringing off the hook because people can't donate their $10...... ;)

So - if the machine faces the internet it get's auto-updated at 3:00 am daily regardless of the potential downing of the system. 3:00am is the time that the system state and daily backups have completed. In almost 2 years of doing this none of the machines have dropped - but then again I'm running pretty "plain jane" machines.

My reasoning: It's a whole lot easier to regenerate a server from scratch or from a backup because a patch blocking a hole messed it up than it is to carry out a forensic investigation to determine which of my other 650 machines got "jumped off" onto..... and if I miss something in that investigation.... I'm screwed and I don't even know it...... :(

I would suggest that if your internet facing machines are not mission critical - ie: cost the company mucho dinero and you your job if they are down for more than a blink of an eye then you should probably use the auto-update right after a backup sequence daily too.

But that's just the way I do things.......

I noticed a few of you mentioning how long the updates can take, reading the article I got the impresssion that "critical" updates will not include such things as service packs etc. and that they will be being packaged with some new system that reduces them in size by 30-80%..... Now that can't be bad at all........

I'm not sure if its a SUS server or not to be honest with you. I haven't seen the server or worked on it, just heard it discussed and the theory behind it sounds solid. I'm assuming that you could set the server to auto download the patches, and then an admin can select the patches that they deem as necessary.

Lets be honest, not all of the machines need .NET framework patch, and the average user will never use journal viewer and things like that!

But with the bandwidth / speed issue, instead of alot of computers downloading at 2:00am (while bandwidth at this time really doesn't matter anyways), You have one server downloading the patches and sending out the links locally. This can be 100Mbps or if your lucky enough to have OC3 / OC12, or any of those tools it would be much faster.

Anyhoo its all just different ways to get to the same result. We are all looking to get to the end result, which is a secure computer for the customers. Personally I prefer having some control over watch patches are installed, rather than having it automatically installing as the auto updater does.

And if I remember correctly one of the features of the auto update is to download the patches automatically and then ask to install them, and I like the ability to say when I want it to download. Just have to be careful to select the time to download rather than letting the computer do it whenever it wants! :)

This is a great discussion, good topic Tiger!

*edit* also I didn't see in the article but when will the 30 - 80 % smaller patches be coming out??

I think there is a huge difference between "my computer" and corporate desktops ( keeping corporate servers out of this for the moment ). On my personal computer ( both at home and at work ) I like to have a say in what is installed. At the very least I want to be aware of what patch state my computer is in, so then when something goes wrong, I don't waste lots of time just because it is a known issue with a certain patch. So for "my computer", I would agree with thadbme, and have control over them.

However on our corporate computers, the last thing I want is for the users to be able to reject patches. Maybe we have the most stupid or technophobe users on the planet, but they would still reject a "Critical Windows Security Patch", because it doesn't apply to them, or they are too busy. I think there is a danger in confusing what I want to do ( as a techie ) and what we need to do corporately. In the same way that I mustn't mistake what we do on our 10/5 servers with what needs to be done on 24/7 servers.

Agreed. I did a little more asking around yesterday and infact what we have setup is a SUS server. But the average user will not have the ability to reject the patches from this server. Autoupdate is setup on the machines, only it looks to your central server. And the admin behind the server (say for your network it would be you) has the flexibility to select which patches you want to be installed.

You can also select what time to update these patches so you can do it on regular off peak hours and the users will never know the difference. For our network some of the patches won't agree with our software so we would naturally uncheck these, and they wont be able to update with the faulty patches. Initially it may be alot of work getting the server setup, but once its working only the SUS admin will be taxed with getting the patches, and only on one computer, not thousands!

I'm all about the work smarter not harder :)