Originally posted here by Tiger Shark
Microsofts SUS.... It's brilliant....

I don't have public facing servers that have "abnormal" stuff on them so I apply the patches automatically and deal with any issues I might get by uninstalling the patch.... I have yet to have an issue that requires a patch to be uninstalled.
I also use SUS. Although... it is lacking in MANY places. The ability to create groups and choose which groups you want the patches to go to. Once you approve an update... every machine that checks in with it will grab anything that is approved for that platform. (short of upgrading IE versions)

If you want to have several groups, you need to run multiple SUS servers and point them to the correct servers. If I'm wrong, please tell me... cause I've read the docs... not much to it.

Reporting... what reporting?! I'm using some perl scripts to analyze the www log and extract the data I need. Then I use m$ baseline security analyzer to compare it with the sus server... which is nothing spectacular....

IMO- a half assed "solution"... but I can't complain I guess.

Other than that... it is pretty nice. Does the job and it doesn't cost extra.

I'm really hoping that they do WUS better... (they are changing from SUS to WUS)...