Windows updates on multiple PCs

The Black Oil

Is there some way of rolling out Windows updates on multiple PCs? We have Win 2003 server as our server and it's on 24/7, but around 30 PCs (XP) are on from 8am-4pm with a good deal of usage from around 8:30am-3pm. The other day I updated a few manually and it was over 400MB worth of updates. I'd prefer to do this automatically, if possible. I know you can set updates and the default's often 3am. The PCs are typically not on at this stage, but perhaps we could leave everything on one night and see if the updates kick in.

I've Googled this, but am a little wary of the answers I've seen so far.

Capt'n Midnight

WSUS

CptSternn

WSUS + a group policy to force the roll-out of updates.

Fysh

For more info on WSUS, see this Microsoft KB article. You can download WSUS 3.0 SP2 from Microsoft here, and there's a deployment guide here.

Capt'n Midnight

Faq http://www.wsuswiki.com/susfaq

wuauclt.exe is what you use for a manual update

The Black Oil

Thanks, I'll try to get something going after Christmas.

OT: is there a good way to learn about Server? I'm a novice and don't want to go down any blind alleys. Our group policy could probably do with tweaking. Limited users shouldn't be able to save stuff to their desktops, but they can.

Fysh

The Black Oil wrote: »

OT: is there a good way to learn about Server? I'm a novice and don't want to go down any blind alleys. Our group policy could probably do with tweaking. Limited users shouldn't be able to save stuff to their desktops, but they can.

I've found the O'Reilly books on Server 2k3 good, although I hasten to add I've not worked my way through the entire books - I dip into them when I'm trying to understand something in particular. The Jonathan Hassell book is probably a good enough place to start.

In terms of GP in particular, though, you can learn quite a lot by just opening up gpedit.msc and looking through at the various options available. If you've already got your domain in place, you can deploy GPs that way - otherwise you can set a lot of them via registry keys, though obviously this is a less effective way. You'd be surprised at how tightly you can lock down a user's experience on a windows box by setting certain options in the User Configuration section of the local Group Policies.

The Black Oil

Thanks Some things are locked down - Control Panel, certain options in IE, privacy, connections tabs, etc, but more could be done. This is for a school - we need to restrict things so the children and most staff can't mess stuff up. I thought I had selected (or maybe de-selected) certain options such as saving to the desktop, but they don't always kick in, for want of a better term whereas things such as IE's options have done. There's a guy we can call to implement these things, but his hourly rate means we prefer not to call him unless we're really stuck. All pupils should have the same desktop and ideally the same set of icons otherwise people are saving stuff to their desktop and it won't open elsewhere. The staff profile should be limited with some flexibility that they can install things (for their interactive whiteboards), but should be fairly well locked down, also.

I'll look at WSUS on the new year, just don't want to make a bags of it and mess up the whole server.

Dan Dare

Black Oil,

I also work in a school but have a background in IT (very much out of date).

The saving documents to the desktop is a habit that drives me crazy, but is basically a training issue rather than an Admin one. The staff and students must be shown how to save a document to a designated folder or my docs etc, by using the "save as" option, instead of simply clicking away and not reading what appears on screen. Hope this helps.

The Black Oil

Thanks Dan. I agree training can be an issue, but showing them will only get you so far. Teachers do have their own sections on the server, which to be fair, most of them use, but even if told not to use desktops, some will always because it's easier and faster. No doubt you know yourself you'll have staff who are very interested in computers, ones who are afraid, ones who have no interest, ones who don't know where the sound button is on their interactive whiteboard...and a few more categories. Sometimes it's an uphill battle.

Fysh

The Black Oil wrote: »

Thanks Dan. I agree training can be an issue, but showing them will only get you so far. Teachers do have their own sections on the server, which to be fair, most of them use, but even if told not to use desktops, some will always because it's easier and faster. No doubt you know yourself you'll have staff who are very interested in computers, ones who are afraid, ones who have no interest, ones who don't know where the sound button is on their interactive whiteboard...and a few more categories. Sometimes it's an uphill battle.

Your best bet with this would be to create roaming profiles, and use a group policy to redirect their desktop to a server-based location. That way you can set read-only permissions on that server location, meaning that the users can't change their desktop contents. If you also redirect the My Documents directory to a server-based location, and stick a shortcut to this on their desktop, they should learn soon enough.

There's a brief although instructive discussion of this on the technet forum here.

The Black Oil

Thanks. At the moment, most people use the pupil profile and we're hoping to move towards teachers a staff profile/individual username with the advice that they must not tell kids their password. We have a teacher template/profile so it's a case of rolling it out and then getting people to make the switch...though some will be hesitant to. We also had someone set up areas on the server only teachers can use, but that's not set right as the pupil profile, i.e., kids can see everything. That needs to be sorted. The structuring/technical work was done a few months back by it's an outside consultant, but we've not had the time to follow up and make the change in a fairly smooth way. If we call him out again that will be another fee. Whatever we do I'm sure we'll have complaints about not being able to access files. Ah well, always something going on.