Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Automatic Updates is a
feature of
WS2003 that lets you automatically download and install updates to
the operating system from the Windows Update web site. The types of
updates available include critical updates like security fixes and
roll-ups, updated device drivers, and operating system enhancements.
In order for this feature to work, it must automatically collect
certain information from your computer so it can identify your
machine the next time it contacts the Windows Update site to see if
new updates are available. The types of information collected
include:

• Product ID number (to verify you are running a valid, licensed copy
  of Windows)

• Version numbers for the operating system, Internet Explorer, and
  other software running on the machine

• Plug and Play ID numbers of hardware devices

Once this information is collected from your machine, Windows Update
generates a GUID that identifies your machine for future visits and
stores this GUID on your machine. Note that Automatic Updates
protects your anonymity as no personal information (name or email
address) is collected.

Update Options

You can configure automatic updates to work using three different
options:

Manual

You are notified when updates are available and you decide
whether to download them and which of them to download. If you choose
to download them, you are notified again once they are downloaded and
you can decide whether to install them and which of them to install.
You have total control over the processexcept that the icon in
the notification area (bottom-right corner of desktop) keeps
reminding you.

Semiautomatic

Updates are automatically downloaded when they become available
on the Windows Update web site, but you have to manually install them
afterward. This is more convenient than the first option but still
gives you control over which updates to install and which to ignore.

Automatic

Updates are automatically downloaded when available and
automatically installed according to a schedule you specify. This is
probably the best approach for keeping your system up to
dateas long as you trust every fix or patch Microsoft makes
available on its site. On some occasions, a patch from Microsoft
fixed one thing but broke another.

If you disable Automatic Updates entirely, you should either visit
the Windows Update web site periodically to scan for new updates to
download or use some other method like Microsoft Software Update
Services (SUS) keep your servers up to date with critical security
fixes.

Software Update Services (SUS)

The Automatic Updates feature included with WS2003 is
really only for small networking environments with one or two servers
connected to the Internet. In a large enterprise environment,
administrators generally want more control over updating their
machines, and for this purpose Microsoft has developed SUS.

SUS is a downloadable component that you install on a member server
that resides within your firewall and has dedicated Internet
connectivity. This SUS server automatically downloads updates from
the Windows Update web site and allows administrators to test them
before deciding which updates to approve for machines on their
network. Servers running WS2003 or W2K Server with Service Pack 2 or
later and desktops running Windows XP Professional or W2K
Professional with Service Pack 2 or later can then use a
downloadable, enhanced Automatic Updates client to connect to your
SUS server and download any updates administrators have approved.

To download SUS server and client components, see www.microsoft.com/windows2000/windowsupdate/sus/.
Note that SUS can't be used to deploy service packs
or custom updatesuse Systems Management Server if you need
that kind of functionality.

In a large enterprise environment, Microsoft Systems Management Server (SMS) can be used instead of SUS to distribute critical updates to servers. SMS is a more powerful tool that can also be used to inventory software, install service packs, manage clients, and perform other systems management tasks across the enterprise; see www.microsoft.com/smserver/ for more information.