Automatic updates on a domain PC, limited user - when does it update? 3

[DanielUK]

I manage a small, 20 user SBS domain. I've replaced a load of my ageing Win2k clients with WinXP Pro PCs.

I've been thinking that enabling automatic updates on each workstation may make my life easier instead of trying to find the "out of hours" time to install Windows updates.

However, I am wondering if this is good policy and if all the client accounts are standard user i.e. non admin or power user, who use the PCs, when does it actually install the updates? Am I correct in thinking it will check and download any updates but then relies on logging in as an admin to install them?

Thanks

Dan

 

[stduc]

It is better IMHO to set the PC to 'download updates but let me choose....' Then, by default, on shutdown, they will be given the choice of shutdown or shutdown and install updates. If you set up the PC's so that they get buttons on shutdown, rather than a dropdown list, they won't even notice the option - LOL and updates will install on shutdown. No admin effort or user needed.

Having said that, although it seems easier to just let the PC's and microsoft 'decide' what is best. It can cause you less grief in the long run for you to test the updates and issue them yourself via the server! Because the day will surely come when some update stops all the PC's working and you won't have a clue.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[BadBigBen]

I would go about it differently and use WSUS instead...

Microsoft Windows Server Update Services 3.0 Overview

http://technet2.microsoft.com/windo...9d45-480b-b801-996b714cebd01033.mspx?mfr=true

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[Zen216]

WE use WSUS here as well... very easy to use and configure. I set the pc's to update once a week,,
I also have a small set of "test" pc's,, That I push the updates to first.. if they work then I'll push them to the rest....

 

[DanielUK]

Thanks for the answers so far. I don't really have a test suite to be able to test before releasing. Sods law says it would work on the test suite but not on the production PCs but I'm just being cynical! Interestingly I was reading an article on patch installing, and one of the suggestions with smaller operations was to update without testing, if it breaks then simply uninstall the update! Whilst I thought this might be a cavalier approach to Windows updates it was put forward as a genuine way of working.

Dan

 

[Zen216]

You don't need a test suite... just one or two test subjects...
I have a few production machines in one OU that puts them into the "push-1st" group on my WSUS server... the rest of the clients are in the "2nd" group...
I let all new updates go to them.... if they can continue working with no issues,, then I'll assign the update to the 2nd group....