RE: Automatic Updates and Users/Power Users
From: Murad Talukdar (talukdar_m_at_subway.com)
Date: 01/14/05
- Previous message: Security: "Re: IIS6 on W2k3 DCs"
- In reply to: Wrights, Joshua C: "RE: Automatic Updates and Users/Power Users"
- Next in thread: Eric McCarty: "RE: Automatic Updates and Users/Power Users"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 14 Jan 2005 09:30:16 +1000 To: "'Wrights, Joshua C'" <c-jwrights@state.pa.us>, focus-ms@securityfocus.com
>>As far as reporting and ensuring update are installed, it is weak in SUS.
There are some various reporting tools out there that parse log IIS log
files for you and give you a basic overview of which workstations received
patches, or you can always go the old fashioned route and read the Windows
Update.log file on x number of workstations :)
Not sure if someone has suggested using MBSA too to check whether the
patches have been done after a push--or shavlik?
http://www.shavlik.com/
-----Original Message-----
From: Wrights, Joshua C [mailto:c-jwrights@state.pa.us]
Sent: Friday, January 14, 2005 1:53 AM
To: focus-ms@securityfocus.com
Subject: RE: Automatic Updates and Users/Power Users
I would definitely suggest reading the SUS deployment guides -
http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx - if you
haven't already. While the Windows Update functionality doesn't change per
say when using SUS, if you are using GPO's to push the policy there is
definitely some differences depending on whether the user is local admin or
not. Local admins will have the right to click "No" to reboot at a later
time while regular users will not... and so on.
As far as reporting and ensuring update are installed, it is weak in SUS.
There are some various reporting tools out there that parse log IIS log
files for you and give you a basic overview of which workstations received
patches, or you can always go the old fashioned route and read the Windows
Update.log file on x number of workstations :). If good reporting is what
you seek, check out the WUS beta and see if that might better fit your
needs. Hope this helps.
-Josh
-----Original Message-----
From: Rasmus Rønlev [mailto:rr.its@cbs.dk]
Sent: Wednesday, January 12, 2005 5:14 PM
To: focus-ms@securityfocus.com
Subject: RE: Automatic Updates and Users/Power Users
Okey,
If my first post gets through, that needs to be semi-disregarded, was a bit
quick on the reply button there. Sorry.
The Windows Update program/service runs as the System Account. And if it's
set to automaticly download and notify it will ask anyone logged on
interactively, for permission to install the downloaded patches. Since it
has rights from the system account it will install updates no problem in
this setting, from a normal user account and upwards. No problems at all.
If you use SUS nothing much changes except your Windows Update service will
now only download updates, that you have accepted to roll out on/from your
SUS server. In this way you can potentially delay or block rolling out
certain update packages, which you might not want to deploy in your
enterprise. The same download/install behaviour described above will still
be in effect though. I.e. you can use it for everyone with User privileges
and up.
I hope that answers the questions somewhat more to the point :)
Regards,
r@smus
.
Rasmus Rønlev
Copenhagen Business School, ITSu
Cell: (+45) 29612544
Phone: (+45) 38153521
Fax: (+45) 38153536
-----Original Message-----
From: Evan Mann [mailto:emann@pinnaclefinancial.com]
Sent: 12. januar 2005 17:56
To: focus-ms@securityfocus.com
Subject: Automatic Updates and Users/Power Users
If Automatic Updates is not set via GPO to contact an SUS Server but has
been set to download updates and notify to install, will a user or power
user be able to initiate the install?
If Automatic Updates is set via GPO with the same download/install, but
from an SUS server, does anything change?
Essentially, how do I ensure, using Automatic Updates, with and without
SUS, that a computer that the daily user only has User or Power User
Access, that the updates can be installed.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
- Previous message: Security: "Re: IIS6 on W2k3 DCs"
- In reply to: Wrights, Joshua C: "RE: Automatic Updates and Users/Power Users"
- Next in thread: Eric McCarty: "RE: Automatic Updates and Users/Power Users"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
