Patch management, MBSA/SUS, WUS, WSUS, SMS & Others

[sonuteklists]

Dear all,
I am looking for patch management solutions, went briefly through a lot of whitepapers in the MS site. I came across a lot of terms most of which I was familiar and had played with to some extent. MBSA, SUS, WUS, WSUS, SMS.
I really would appreciate some help here. Firstly to understand what is relevant to what kind of organizations and operations. The white papers do talk about them in detail and some links does describe the differences between them, but they dont answer some questions comprehensively.

- Will I able to use MBSA/SUS on workgroup computers. It mentions somewhere that it is possible, but doesnt say how. When I tried to scan using graphical MBSA on a workgroup computer, I get a "User is not an administrator on the scanned machine". There isnt a option either to enter local credentials. Should I be using the command line option ?? Examples ??

- Whats the difference between WUS and WSUS. Is the evolution SUS -> WUS -> WSUS -> maybe SMS.

- Apart from the additional capabilities like reporting and the fact that I require SQL Server, IIS for WSUS, is there any added benefit in using/prefring WSUS over MBSA/SUS ??

- Which of the following does require domain functionality and wont operate outside it, MBSA/SUS, WUS, WSUS, SMS.

- I know SMS is huge and not just for patch management, but if all I want to do is patch management including updates to SQL and Office applications, would MBSA/SUS be sufficient ?? I was also looking into the future where I might extend SMS for other things.

- Any takes on Patchlink,

http://www.patchlink.com.

How does it compare interms of functionality, advantages, pricing over the MS options. I guess Patchlink works irrespective of Domain/Workgroup environment as clients have to be installed and that controls the updates.

Kindly answer these question while I think of more
Thanks a bunch.

 

[Loki1973]

First off, I have experience with Shavlik and SUS, WUS and WSUS.

SUS/WUS/WSUS all require IIS as they're all web based apps.

You can use it on workgroup machines (or domain members on NT4 for that matter), but it requires registry hacking (you should be able to find info on it on MS website).

The best option is to configure a group policy object to get the updates from WSUS (all other products are obsolete) and have the updates installed from there.

It also has some nice reporting features.

Shavlik uses a pushing mechanism but it will cost you some money.

 

[sonuteklists]

Thanks again for the info.
I did a test setup, added a test computer in a test group and approved some updates to 'install' on the test group.

Some observations,
- Under reports, status of updates, all updates are shown as 'unknown' status.
- Under reports, status of computers for the test computer in the test group, even here it shows all updates as unknown.
- When I click on the computer itself, it says that the last detection result was unknown and that the computer hadnt reportes status yet.
I am not sure what to make of this.

On the home page, To Do list, there was a following report,
Check your server configuration
One or more Update Service components could not be contacted. Check your server status and ensure that the Windows Server Update Service is running. Non-running services: SelfUpdate

Computers
Total: 1
Computers with update errors: 0
Computers needing updates: 0

The client in a workgroup and on the GP for the client, I have set download and install at 7AM in the Local GP. Would that be the reason the updates arent installed yet ??

This is the info under Computers -> Details

This computer has not reported status yet.
Computer group: Test
Requested group: Unassigned Computers
IP address: 10.1.2.10
Operating system: Windows XP
Service pack: 2
Operating system language: en-US
Last status report: Not yet reported
Last contacted: 6/15/2005 8:53 AM

Status
Last Detection Result Result Date
Unknown Unknown

What I dont understand mainly is that why does it say not detected, no reports, etc even after I run the command and even though it shows in the WSUS console.

I waited 24 hours, read the docs and followed the steps to a T, checked that all services are running, but still the laptop refuses to update.
I set deadlines, approved the updatesm checked they were for the right OS, checked they didnt require user input, checked for automatic approve, on the client side I saw that automatic updates are working, ... but still...

I am not sure where to look now. Please advice.
Thanks.

 

[sonuteklists]

I am sorry, but anyone provide any hints at all, I am out of ideas. I dont know why it says that the selfupdate service is not running when it is.
Please advice.
Thanks.