Enterprise Software Update Management using Systems Management Server 2.0 Software Update Services Feature Pack
Click here to download a copy of this document.
On This Page
Introduction
This document provides you with an introduction to the software update management capabilities offered by the tools included in the Systems Management Server 2.0 Software Update Services Feature Pack (Feature Pack). It is not intended to be a comprehensive guide for software update management, but it does provide you with useful information about the following topics, in addition to references to other information resources.
This guide helps you understand:
| • | How security updates affect your enterprise and what resources you can use to learn how to assess risk and evaluate updates. |
| • | How the Feature Pack tools work together to create a flexible software-update auditing, distribution, tracking, and management solution. |
| • | Minimum configuration requirements you must have to set up a Microsoft Systems Management Server (SMS) test site you can use while you are becoming familiar with the Feature Pack tools. |
| • | How the Feature Pack and SMS core features work together. |
It also provides:
| • | Checklists to help you quickly configure and evaluate the Feature Pack tools. |
| • | Information about performance issues to be aware of when implementing these tools in your enterprise. |
Understanding Security Update Management
A software update, often referred to as a patch or hotfix, is an update that typically occurs between service packs. A service pack is a periodic update that corrects problems in a particular version of a product. Although a service pack is tested and its release is planned over a longer period of time, software updates are usually created and released expeditiously, in reaction to a specific issue.
Most software updates are created to correct security vulnerabilities and are called security updates. You install security updates to protect the computers and information in your enterprise from security risks associated with specific products running on your computers.
It is imperative that you update the service packs for the systems in your enterprise to defend against any potential vulnerability. However, in the interim between service packs, the most important thing you can do to maintain a secure system is to make sure that the computers in your enterprise are running the most current security updates.
Note: Although security issues are of paramount importance, you should also be aware that software updates can also address non-security issues, such as stability or performance. For example, the Microsoft Office updates often address non-security related issues concerning Office applications.
Challenges in Managing Security Updates
The main challenge in managing security updates is determining which of the many available updates are appropriate to the needs and vulnerabilities of your enterprise.
| • | Some updates are critical and require immediate action to protect your environment. For example, the updates that address risks from newly discovered exploitations, viruses, and worms are considered critical updates. |
| • | Some updates can be useful, can increase performance or stability, or can make the end-user experience better, but they might not be considered critical to the safety of your enterprise. |
| • | Other updates might not be necessary to your enterprise and can be ignored. |
| • | Some updates could create problems (for example, break other line-of-business applications) for your enterprise if you used them. |
To keep your enterprise secure, you must establish processes for:
| • | Receiving information about the latest software updates and vulnerabilities. |
| • | Auditing your enterprise for applicable software updates. |
| • | Assessing and authorizing available software updates. |
| • | Deploying authorized software updates within your enterprise in a timely, accurate, and efficient manner. |
| • | Tracking update deployment across your enterprise. |
Processes and Guidelines
To learn how to determine which updates are critical, useful, irrelevant, or harmful to your enterprise and to create a software update management process for your enterprise, you can do several things:
1. | Be familiar with the current state of the resources in your enterprise. This includes knowing:
This information should be updated regularly and should be readily available to those involved in your update management process. | ||||||||||||||||||||
2. | Read the following white papers for information and guidelines for establishing a software update management process for your enterprise by using SMS and the Feature Pack tools. Table 1 Software Update Management White Papers
| ||||||||||||||||||||
3. | Be informed about the latest security developments and technology. You can be informed by reading, using Web sites, and joining newsgroups to get the latest information. In the Information Resources section later in this document, several Web sites and white papers are listed that can assist you with gathering information. When you know your assets, are aware of vulnerabilities, threats, and how your environment is configured, and when you have access to the latest security information, you can determine which security issues are relevant to your enterprise, and then you can assess which software updates are relevant to your needs. | ||||||||||||||||||||
4. | Use SMS software distribution features and the Feature Pack tools to streamline and automate some of the functions associated with security update inventory, deployment and management tasks, such as:
|
Caution The Feature Pack tools help simplify the process of determining which updates are appropriate to your situation, because they only indicate the security and Office updates that are specifically applicable to your computers. However, you should always make sure to thoroughly evaluate and test any updates that you deploy, regardless of the source, to make sure that no damage can be caused as a result of their installation.
Architecture of the Feature Pack Tools
This section describes the Feature Pack tools, how they work with existing SMS software distribution features, and the processes they use to provide you with better software update management solutions.
Systems Management Server
Systems Management Server provides the following critical functions that facilitate deploying, distributing, and managing software updates in your enterprise:
| • | Inventory capabilities that allow you to determine how many computers have been deployed, their location and role in your enterprise, and the software applications and associated updates that have been installed. |
| • | Scheduling capabilities that provide you with the ability to schedule the deployment of updates during times that have the least effect on your business operations, such as outside regular working hours. |
| • | Status reporting capabilities that allow you to monitor the progress of update installation throughout your enterprise. |
| • | Targeting capabilities based on system inventory, that allow you to use an individual computers position in Microsoft Active Directory directory service, or manually created computer collections to target specific computers or sets of computers with specific updates. |
| • | Enterprise replication capabilities that allow you to move files around the network easily and effectively. |
| • | Support for popular operating systems such as Microsoft Windows NT 4.0, Microsoft Windows 2000, and Microsoft Windows XP. |
For additional information about SMS, see http://www.microsoft.com/smserver/
The Feature Pack Tools
The Feature Pack provides a set of five software update management tools, described in the following table. These tools integrate their functionality with the SMS software distribution features described earlier to offer a simplified, largely automated solution for the deployment of security and Office software updates.
Table 2 Feature Pack Inventory, Software Update Distribution, and Reporting Tools
| Feature Pack tool | Description | ||||||||||||||||||
Security Update Inventory Installer (SecurityPatch_ENU.exe) |
| ||||||||||||||||||
Office Update Inventory Tool (OfficePatch_i386.exe) |
| ||||||||||||||||||
Distribute Software Updates Wizard Installer (PatchWiz_i386.exe) | This tool is used to perform software update distribution tasks and consists of three main components:
| ||||||||||||||||||
Web Reports Add-In for Software Updates (SMSWebReporting_i386.exe and SMSAddReports_i386.exe) | The Web Reports Add-In for Software Updates provides added functionality to the SMS Web Reporting Tool features, and it allows you to view a set of reports that was created from information gathered by software update inventory tools. These reports allow you to track the status of software updates for:
In addition to the preconfigured reports available from the Web Reports Add-In, you can also create custom inventory reports by using SQL Server views and the inventory schema. |
The Process
The Feature Pack tools:
| • | Conduct recurring audits of the computers in your enterprise for installed and applicable security and Office updates by using the latest software update inventory tools and the latest software update database available from Microsoft. |
| • | Allow you to review and authorize updates for distribution. |
| • | Locate and download the updates and associated installation information from the Web. |
| • | Advertise, distribute and install authorized updates. |
| • | Track the status of the update distribution and installation progress for all the computers in your enterprise. |
The Feature Pack tools use the following process to complete these tasks:
1. | The Software Update Inventory Installer (the Installer), which you install on the SMS site server, uses SMS software distribution features to deploy the Software Update Inventory tool (the Scan tool) and the Software Update Sync tool (the Sync tool) to the appropriate client computers in your enterprise.
| ||||||||
2. | SMS and the Feature Pack tools use the converted inventory data to determine which of the available software updates are installed and which are missing from your client computers. | ||||||||
3. | The Distribute Software Updates Wizard, which you install on the SMS site server, uses the inventory information to compile groups of related software updates. It provides you with the opportunity to:
The Wizard also deploys the Software Update Installation Agent to the clients through a program included with the update advertisement package. | ||||||||
4. | The client computers use the program created by the Distribute Software Updates Wizard to install the Software Updates Installation Agent. The Installation Agent evaluates the advertisements sent by the Distribution Wizard and facilitates the installation of the authorized software updates. | ||||||||
5. | Inventory and software update status information is forwarded to the SMS site database on a regular cycle, following any changes. | ||||||||
6. | The Web Reports Add-In for Software Updates uses the inventory and status information to create Web reports that you can use to track the progress of update inventory, distribution, and installation in your enterprise. You can view these reports through the SMS Web Reports Viewer in your browser. |
The Underlying Technology
The Feature Pack tools use the following existing technology to provide you with a better software update management solution:
| • | Security Patch Bulletin Catalog (MSSecure.XML) This is the security updates database that the Microsoft Baseline Security Analyzer( MBSA) and the Security Update Inventory Tool use to determine which security updates are installed on your computers and which are applicable. The Security Update Sync tool automatically downloads the latest version of this database on a regular basis and distributes it to the computers in your enterprise by using SMS distribution points.
| ||||
| • | Microsoft Baseline Security Analyzer (MBSA) MBSA runs on Windows 2000 and Windows XP systems and scans for applicable hotfixes and vulnerabilities in the following products: Windows NT 4.0, Windows 2000, Windows XP, Internet Information Server (IIS) 4.0 and IIS 5.0, SQL Server 7.0 and SQL Server 2000, Internet Explorer (IE) 5.01 and later, and Office 2000 and Office 2002. It uses a version of the Microsoft Network Security Hotfix Checker (HFNetChk) to scan for applicable hotfixes and service packs for Windows operating systems, IIS, and SQL Server. It then creates and stores individual XML security reports for each computer scanned and can display the reports in the graphical user interface in HTML format. The Security Update Sync tool automatically downloads the latest version of this tool on a regular basis and distributes it to the computers in your enterprise by using SMS distribution points. For more information about the Microsoft Baseline Security Analyzer, see http://www.microsoft.com. | ||||
| • | Microsoft Office Update Tool (Invcm.exe) The Office Update Inventory Tool uses the Office Update Tool in conjunction with the Office Update Database (Invcif.exe) to analyze your client computers for applicable Office updates. The data gathered by the Office Update Tool is then converted into a format compatible with the SMS site database. The Office Update Sync tool automatically downloads the latest version of this tool on a regular basis and distributes it to the computers in your enterprise by using SMS distribution points.
| ||||
| • | Microsoft Office Update Database (Invcif.exe) This is the database of software updates that the Microsoft Office Update Tool and the Office Update Inventory Tool use to determine which office updates are installed on your computers and which are applicable. The Office Update Sync tool automatically downloads the latest version of this database on a regular basis and distributes it to the computers in your enterprise by using SMS distribution points.
| ||||
| • | MSXML An XML parser is required (MSXML version 3.0 Service Pack 2) for many of the tools to function correctly. For the tools that require it, MSXML 3.0 SP2 can be installed during tool setup, or you can download and install a standalone version of the Microsoft XML parser from the following location: |
Minimum Feature Pack Configurations
This section describes the minimum system and setting configurations necessary to use the Feature Pack tools
The Feature Pack tools require SMS 2.0 (SP3 supported, SP4 recommended) or later.
Table 3 Minimum Systems and Settings Required for Feature Pack Tools
| Feature Pack tool | Component | MicrosoftSQL Server | Internet Explorer | Operating system | Configurations | Dependencies |
Security Update Inventory tool | Setup | SQL Server 7.0 or later | N/A | Windows NT 4.0 SP6a or later | SMS primary site server | MS XML 3.0 |
Security Update Inventory tool | Sync tool | N/A | N/A | Windows NT 4.0 SP6a or later | SMS client | N/A |
Security Update Inventory tool | Scan tool | N/A | IE 5.0 or later | Windows NT 4.0 SP5 or later | SMS client | MS XML 3.0 |
Security Update Inventory tool | Secure cache | N/A | IE 5.0 or later | Windows NT 4.0 SP5 or later | Program dependency scenario | NTFS (Partition) |
Office Update Inventory tool | Setup | SQL Server 7.0 or later | N/A | Windows NT 4.0 SP6a or later | SMS primary site server | MS XML 3.0 |
Office Update Inventory tool | Sync tool | N/A | N/A | Windows NT 4.0 SP6a or later | SMS client | N/A |
Office Update Inventory tool | Scan tool | N/A | IE 5.0 or later | Windows NT 4.0 SP5 or later | SMS client | MS XML 3.0 |
Office Update Inventory tool | Secure cache | N/A | IE 5.0 or later | Windows NT 4.0 SP5 or later | Program dependency scenario | NTFS (partition) |
Distribute Software Updates Wizard | Setup | N/A | N/A | Windows NT 4.0 SP6a, or later | SMS Administrator Console | MS XML 3.0 |
Software Updates Installation Agent | Notifications (balloons) | N/A | IE 5.0 or later | Windows 2000 or later | SMS client | N/A |
Software Updates Installation Agent | Dialog boxes | N/A | IE 5.0 or later | Windows NT 4.0 SP6a or later | SMS client | MS XML 3.0 |
Software Updates Installation Agent | Secure cache | N/A | IE 5.0 or later | Windows NT 4.0 SP6a or later | Program dependency scenario | NTFS (partition) |
Web Reporting tool | Setup | SQL Server 7.0 or later | IE 5.0 or later | Windows NT 4.0 SP6a or later | IIS 4.0 | SQL Server mixed-mode security |
Web Reporting Add-in Pack | Setup | SQL Server 7.0 or later | IE 5.0 or later | Windows NT 4.0 SP6a or later | IIS 4.0 | SQL Server mixed-mode security |
Web Reports | Browser client | N/A | IE 5.0 or later | Windows NT 4.0 SP6a or later | N/A | MS XML 1.0 |
Avoiding problems caused by FAT formatted systems
You should be aware, when configuring your file system format, that the FAT (file allocation table) file system is inherently not secure. Software update solutions involving FAT systems cannot and will not match the level of security available from an NTFS file system format. For example:
| • | Clients that are running NTFS can safely run the inventory scan from a secure local cache (controlled by the Scan tool /cache parameter). |
| • | If an SMS client is running on a computer that has a FAT file system on a system partition, the Feature Pack software update management tools still utilize a local cache to run the inventory scan (under the /cache parameter), in the same way that an NTFS system would, for performance reasons. |
However, that cache is inherently not secure under a FAT system and will not become secure until the system partition has been converted to NTFS, after which it will automatically be secured to system administrators only.
It is recommended you convert clients running FAT systems to NTFS as soon as possible if the computer can support it (common reasons for having a FAT system include dual-booting to Windows 98, or to another operating system that requires a FAT formatted system).
To learn how to convert a system from FAT to NTFS, refer to the help available by typing convert /? from the command prompt.
Minimum SMS Configuration
This section describes the systems and settings necessary to create a minimum configuration of an SMS system to use while testing or evaluating the Feature Pack tools.
Table 4 SMS Minimum Configuration Sites and Settings
| SMS sites and settings | Configuration | ||||||||
An SMS primary site | The primary site should be running SMS version 2.0 (SP3 supported, SP4 recommended) or later. For more information about configuring an SMS primary site, see the SMS product documentation. | ||||||||
At least one SMS client | The client site can be configured on the site server, or on a separate workstation. One client is sufficient for minimum test purposes. However, if you want to have a representative sample of how the tools will work with all of the systems used in your enterprise, it is recommended that you have at least one client for each representative configuration in your environment. For example, if you have computers running Windows 2000 SP2 and Windows NT 4.0 SP6a, you should have a client computer for each of those operating system in your test configuration. If you do not currently use a certain operating system (for example, Windows XP) in your enterprise, but plan to use it in the future, it is recommended that you add a computer running that system to your test configuration. This allows you to become familiar with how the Feature Pack tools and software updates work with the system before you deploy it in your enterprise. Setting up this type of extended client test configuration allows you to become familiar with software update management in many different ways. By using more than one system, you will be able to:
For more information about configuring SMS client computers, see the SMS product documentation. | ||||||||
Hardware Inventory Settings | The SMS hardware inventory feature is used with the Feature Pack software update inventory tools to create an SMS-compatible inventory of installed and applicable software updates on your client computers. By default, the hardware inventory function is disabled on the SMS primary site to reduce system overhead. To set up your test system, you must enable the hardware inventory function and configure the inventory frequency. The default frequency for SMS hardware inventory is an interval of seven days. However, for test purposes, to speed the process of becoming familiar with the Feature Pack tools, you can increase the frequency of the inventory, perhaps running it daily, or even every few hours. Note: The above hardware inventory setting suggestions are for test purposes only. The actual frequency with which you run the hardware inventory in a full-scale deployment of the tools will depend on the needs of your enterprise and performance considerations associated with the generation of additional hardware inventory data. For more information about configuring the Hardware Inventory settings, see the SMS product documentation. For more information about specific performance issues associates with these tools, see the Performance Considerations section of this document. | ||||||||
Software Distribution Settings | The SMS software distribution features are used with the Feature Pack tools to distribute software updates to your client computers. Some of the software distribution settings for the SMS product might conflict with those of the Feature Pack tools and could cause confusion. To prevent this possibility, configure the following settings on the SMS primary site:
Note: In a test environment, a short polling interval causes few system resource usage problems. However, when deploying the tools to a larger system, the polling interval should be increased, for example, to a four-hour interval to prevent performance problems. For more information about configuring the SMS software distribution settings, see the SMS product documentation. For more information about specific performance issues associates with these tools, see the Performance Considerations section of this document. |
Post-evaluation settings
The settings and configurations suggested in Table 4 help you become familiar with the Feature Pack tools and how they work with your SMS system on a small-scale, in a test environment.
However, when you deploy these tools on a larger scale, you should be aware that these settings and configurations must change, or performance issues could result. The reason for this is that as the scale of Feature Pack tool deployment increases, so do the demands on your system.
Hardware inventory size, network usage, CPU usage, and disk capacity requirements all increase with increasing deployment scale, and the settings you configure for SMS and the tools influence the impact of the processes on your system. For example, if you were to increase the advertisement schedule for software updates from a weekly to a daily interval, the system overhead caused by that activity would increase from approximately 5% to 15% overall.
For larger scale deployment, the following SMS settings are suggested for use with the Feature Pack tools:
| • | The SMS Hardware Inventory cycle should be scheduled to a weekly frequency. | ||||
| • | The SMS software distribution settings should be configured as follows, by using the SMS Administrator console:
As mentioned in Table 4, both SMS and the Feature Pack tools have countdown and notification features for assigned programs. To prevent duplicate countdowns and notifications, disable these features on the SMS primary site. The countdown and notification features provided by the Feature Pack can be changed or eliminated as needed. |
Note: There may be other, non-Feature Pack software distribution practices occurring in your enterprise that use the SMS countdown and notification features, which need to be reviewed before you make changes to these settings. That review should take into account the countdown and notification features provided by the Feature Pack set of tools.
Update Management Scenarios
The key scenarios for software update management with the Feature Pack tools are:
| • | Auditing your enterprise to determine which software updates are missing from your client computers. |
| • | Authorizing software updates to ensure that only the software updates appropriate to your enterprise are distributed to the client computers in your enterprise. |
| • | Tracking inventory and installation progress to determine whether your software update management practices are efficient and successful. |
Auditing Your Enterprise
To determine which security updates are installed on or applicable to your client computers, you need to use the Feature Pack Security Update Inventory Tool to conduct an enterprise-wide audit for all the known security updates for Windows NT 4.0 and above. The flow of this scenario is outlined in the following example:
1. | Download the Feature Pack tools from http://technet.microsoft.com/sms/bb676799.aspx. | ||||||||||||||||||||||||||||||||
2. | Install the Security Update Inventory Installer on the SMS site server. | ||||||||||||||||||||||||||||||||
3. | During setup, you can choose whether to automatically deploy the Security Updates Scan tool and the Security Updates Sync tool to client computers by using SMS distribution points. If you select this option, you use setup to create the SMS package and advertisement to distribute the Scan tool to the appropriate client computers. | ||||||||||||||||||||||||||||||||
4. | Use SMS to distribute and advertise the package containing the Scan tool. | ||||||||||||||||||||||||||||||||
5. | Use the command-line interface to configure the Sync tool, which is installed on a computer with Internet access during setup. The Sync tool downloads the latest Security or Office scan tools and software update database and uses distribution points within your system to send the latest files to client computers. | ||||||||||||||||||||||||||||||||
6. | Allow the Sync tool to download the latest scan tools and database and distribute it to your client computers. | ||||||||||||||||||||||||||||||||
7. | Use the command-line interface to configure the Scan tool. The Scan tool uses the scan tool MBSA and the security updates database to conduct an audit of your client computers for installed and applicable updates, caches that inventory information, and then forwards it to SMS during the scheduled hardware inventory cycle. | ||||||||||||||||||||||||||||||||
8. | Allow the Scan tool to gather inventory information and to transmit that information to the SMS site database. | ||||||||||||||||||||||||||||||||
9. | Review the inventory information gathered during the audit performed in the previous step, by using the SMS Web Reporting Tool with the Web Reports Add-In, or the SMS Resource Explorer. The Web Reports Add-In for Software Updates provides the following reports that can show you all the software updates that are applicable to the computers in your enterprise and can show you the number of computers for which each update is applicable. Table 5 Reports Provided by the Web Reports Add-In for Software Updates
| ||||||||||||||||||||||||||||||||
10. | Evaluate applicable updates to determine if they are necessary in your environment or configuration. |
Authorizing Software Updates
In order to determine which of the installed or applicable security updates are necessary for the client computers in your enterprise, you must evaluate each suggested update and then authorize it for distribution within your enterprise by using the Distribute Software Updates Wizard. The flow of this scenario is outlined in the following example:
1. | For updates determined to be applicable during the audit, evaluate and prioritize the usefulness and importance of each update. To do this, assess your risks and read about the latest security update information contained in the white papers and Web sites recommended in the Information Resources section later in this document. There are many software updates made available every day, and not all of them will be useful to you. For each software update identified, you must determine whether the update:
This should include reviewing all associated documentation, including that sent with the update and supporting information, which may be found, for example, on TechNet (http://www.microsoft.com). For detailed information about how to conduct this assessment of the software updates available to you, see the Software Distribution for Patch Management (SMS) white paper. For more information about where to find this document, see the Information Resources section later in this document. | ||||||
2. | Quarantine and test the update before authorizing it for distribution. To test an update, you must authorize the update and distribute it to a test collection containing computers with representative configurations for your enterprise. The testing objectives are as follows:
| ||||||
3. | Use the Distribute Software Updates Wizard to create the package, programs, and advertisements used to distribute the updates. | ||||||
4. | Using the Microsoft Knowledge Base articles available for each update, determine the ideal command-line syntax to use when configuring the update for installation. | ||||||
5. | Configure the time of authorization for each update, which, with installation grace period settings, will determine when your users will be required to install the update. For testing purposes, the time of authorization should be immediate. During an actual deployment, however, you might prefer to select a later time of authorization to allow yourself time to research and test the update before deploying it. | ||||||
6. | Configure locale dependencies for each update to accommodate clients in different countries or time zones. | ||||||
7. | Save the configuration changes you selected for the SMS package by completing the Distribute Software Updates Wizard. | ||||||
8. | Use the Software Updates Installation Agent to install the updates on the client computers. |
Tracking Software Update Deployment
In order to determine whether your software update deployment process is successful, you can track the inventory and deployment progress of software updates for all the computers in your enterprise.
1. | Use the Distribute Software Updates Wizard to authorize, download, advertise, and deploy the Software Updates Installation Agent and the software updates you authorized. | ||||
2. | Use the Software Updates Installation Agent to install the authorized updates on your client computers. | ||||
3. | Use per-update and summary status messages, in addition to inventory to confirm the coverage being achieved. | ||||
4. | View reports generated by the Web Reports Add-In for Software Updates to keep track inventory, deployment, and installation information specific to the software updates and computers in your enterprise. | ||||
5. | Manage any noteworthy exceptions. Exceptions typically follow a pattern that can be resolved by refining your software update management process. For example:
There are several Knowledge Base articles (available from http://support.microsoft.com/default.aspx) that can assist you with the process of fine-tuning your software update management process by providing information about how to troubleshoot inventory, software distribution, and status message processing. |
Feature Pack Tools Features
The Feature Pack tools include the following inventory, distribution, and reporting features to help you configure and manage software update deployment in your enterprise.
| • | Auditing Features, which you can use to create an up-to-date inventory of installed and applicable, updates for all the computers in your enterprise. |
| • | Update Authorization and Distribution Features, which you can use to control which updates are deployed in your enterprise and to control the way in which the updates are distributed and installed on the client computers. |
| • | Update Deployment Tracking Features, which allow you to track and evaluate the progress of software update deployment within your enterprise and to spot areas of vulnerability quickly and easily. |
Auditing Features
The following features are available through the combination of SMS software distribution and inventory features, and from the SMS Feature Pack Security Update and Office Update Inventory Tools. These features simplify and streamline the process of auditing your client computers, identifying missing security and Office updates, and communicating useful inventory information to your SMS system.
Table 6 Auditing Features
| Feature | Description |
Integrated setup | The setup process for the Security and Office Update Inventory Tools saves you time and effort by integrating the installation process for the tool with the distribution of the tool components throughout your enterprise, by using SMS software distribution features. |
Database updates | The latest software update database associated with the software update inventory tool is downloaded to the server and then distributed within your enterprise in an automated, recurring cycle. This ensures that you receive the latest update information regularly and that your inventories reflect this information. |
Expedited results | A software update inventory scan tool command-line option (/kick) can be used to bypass the regularly scheduled SMS hardware inventory cycle to send software update inventory results from the client computers in your enterprise to the SMS site database in an expedited fashion. This option can be useful when tracking critical update installation progress. |
Automated inventory | The software update inventory tools run in an automated, recurring cycle, keeping your SMS inventory information in sync with the latest software update database information. |
Office and security updates | The software update inventory tools currently available from the Feature Pack support the security and Office-related updates available from Microsoft. Updates identified by the Feature Pack tools will always be applicable, because these tools only report updates that are needed in your environment. However, you should always perform a thorough review of any update you deploy in your enterprise, regardless of the source. This applies to updates identified by the Feature Pack tools, in addition to updates identified by using other means. |
Secure local cache | To reduce network overhead when auditing clients and installing updates, the Value Ppack tools maintain a copy of needed files from the distribution point in a secure location on each client. The Feature Pack tools update these files on a scheduled basis according to the advertisement schedule for the appropriate scan tool (a weekly schedule for updating these files is recommended). Note: This feature is available only to clients running NTFS. FAT-formatted clients cannot use this feature. |
Update Authorization and Distribution Features
The following features, available in combination from the Distribute Software Updates Wizard, the Software Updates Installation Agent, and SMS software distribution functions, make it easier for you to perform software update deployment tasks to meet the needs of your enterprise.
Table 7 Approval and Distribution Features
| Feature | Description | ||||||||||||||
Update authorization | The Distribute Software Updates Wizard provides you with the ability to authorize software updates before you deploy them, enabling you to control the content that is distributed to your client computers. | ||||||||||||||
Update download | The Distribute Software Updates Wizard saves you time and effort by providing automated and facilitated download of software updates. | ||||||||||||||
Update information | The Feature Pack tools and SMS Web reports provide integrated access to Microsoft Knowledge Base articles and bulletins. These articles and bulletins provide you with update-specific information necessary for assessing and installing software updates. | ||||||||||||||
Branding | When you advertise updates to the users in your enterprise, you can customize the name that is used to identify the organization sponsoring the software updates package to users in your enterprise. For example, this can be the name of the organization, department, or division responsible for controlling the software update policy in your enterprise. In addition, you can include HTML content for users to read that provides organization-specific information and identification that gives your users confidence in the authenticity of the update authorization. | ||||||||||||||
Targeting | Update targeting gives you the ability to focus your deployment of software updates by department, domain, or by other rules that best suit your enterprise needs. This allows you to focus your efforts where they are most needed, and helps conserve system resources by avoiding redundant or unnecessary update installations. | ||||||||||||||
Collection-based targeting and applicability rules | The Feature Pack tools provide additional functionality to the existing collection-based targeting features of SMS by adding detailed applicability rules for software update distribution. These rules are evaluated at each client computer at the time the package is advertised. This helps resolve the limitations of collection-based targeting for software updates and enhances the performance and accuracy of the software update distribution process. | ||||||||||||||
Grace period |
| ||||||||||||||
Installation automation | Provides you with the ability to configure the default installation actions and to provide for unattended or semi-attended installation of software updates. This helps prevent delays in software distribution and update management in your enterprise. | ||||||||||||||
Language and locale | The Feature Pack tools provide you with the ability to deploy software updates regardless of locale and allows for the deployment of multilanguage updates as appropriate for your client computers. Some updates may require a manual determination of locale or language requirements prior to distribution. | ||||||||||||||
Update status reports | Status reports can be provided on an incremental, per-update basis, as well as on a per-package basis. The status reports allow you to track the progress of software update deployment in your enterprise, to troubleshoot your update deployment, and to evaluate your deployment strategy, as well. | ||||||||||||||
Runtime behavior control | Provides you with the ability to configure command-line options specific to each update, which control the way an update is installed and runs on the client. | ||||||||||||||
Failsafe timeout | If an update is permitted to remain unresponsive for a long period of time, it could leave the system in a vulnerable and inconsistent state. The failsafe timeout feature provides you with a means for disabling unresponsive updates, while continuing to install other updates in the same package without interruption. | ||||||||||||||
Update combination | The Feature Pack tools allow you to distribute software updates singly, or in combination, and allow for the accommodation of dependencies among related updates. | ||||||||||||||
System restart control | Includes restart request detection, restart suppression for specific computer roles (workstations or servers), and graceful or forced application closure. It also allows you tailor the post-installation system restart behavior to accommodate the needs of your enterprise, such as enterprise servers, where restarts are manual and scheduled. | ||||||||||||||
Recurring installation cycles | These cycles, configured to accommodate the needs of your system, ensure that all the computers in your enterprise have the necessary updates. | ||||||||||||||
Recurring just-in-time checks | These cycles, configured to accommodate the needs of your system, ensure that updates are not re-applied or overlooked. This increases performance in your system by preventing redundant update installation and increases your enterprise safety by ensuring that required software updates are applied. |
Update Deployment Tracking Features
The following features, available from the Web Reports Add-In for Software Updates, provide added functionality to the SMS Web Reports features and allow you to view a set of reports created from information gathered by software updates inventory tools.
Table 8 Update Deployment Tracking Feature
| Feature | Description |
Service-level data | Software update reports are available from the SMS Web reports viewer and include information about updates or client computers, such as update detection time and update installation time. This information allows you to track the progress of a specific update, or to check the update status for a specific computer. |
Rate-of-spread and coverage reporting | These reports let you know how effective your software update management practices are and help you assess the areas of risk in your enterprise. |
Custom reporting from a rich, documented schema | The Web Reports Add-In for Software Updates contains several pre-configured reports that you can use to view software update specific information. In addition to using the pre-configured reports, you can also use SQL Server views and the documented inventory schema to create custom software update inventory reports, tailored to the needs of your enterprise. |
Checklists for Using the Feature Pack Tools
The following checklists, grouped by task, are intended to provide you with a step-by-step overview to working with the key features of the Feature Pack tools.
For procedural information about performing the tasks in each checklist, refer to the help documentation included with each tool.
Software Update Inventory Checklist
| • | Perform Setup tasks
| ||||||||
| • | Perform Sync tasks
|
Note: Security bulletin catalog data on the Internet is typically updated on a weekly basis, so the time you select for the Sync tool tasks should immediately follow that schedule to ensure that the latest updates catalog is available to your enterprise. In the same manner, the distribution of the latest catalog update to each client computer should be scheduled to follow the catalog sync for the distribution points.
Software Update Distribution Checklist
| • | Perform setup tasks
| ||||||
| • | Obtain updates and configure restart behavior
| ||||||
| • | Perform object creation and maintenance tasks
| ||||||
| • | Perform distribution and advertisement tasks
| ||||||
| • | Verify download experience
| ||||||
| • | Investigate locale-specific scenarios
|
Software Update Installation Checklist
| • | Become familiar with command-line syntax
| ||||||
| • | Verify notification behavior
| ||||||
| • | Verify grace period.
| ||||||
| • | Verify default action
| ||||||
| • | Verify Branding
| ||||||
| • | Verify Failsafe timeout behavior
| ||||||
| • | Examine status data
| ||||||
| • | Verify system restart behavior
|
Reporting Checklist
| • | Perform Setup tasks
| ||||||||
| • | Verify reports
| ||||||||
| • | Check tool accuracy
| ||||||||
| • | Verify completeness
| ||||||||
| • | Become familiar with custom report creation
|
Performance Considerations
This section describes performance considerations that you should be aware of when you deploy the Feature Pack tools to perform software update management tasks in your enterprise.
Processing Load Generated by Feature Pack Tools
Using the information in the following table, you can develop a general idea of how using the Feature Pack tools to perform inventory tasks, install software updates, and track inventory and installation information can affect your system resource usage.
This information was gathered from a server running a Pentium 3 processor at 633 MHz, 256 MB RAM, and Ultra ATA 100 HD at 5400 RPM.
Table 9 Processing Load Generated on the Server by Feature Pack Tools
| Update management server-load factors | Number of records | Time to process (seconds) | Records per second | %CPU utilization | RAM utilization | Disk transfer per second |
HW Inventory inventory load (percent change in MIF processing load without Feature Pack) | 3,000 | 342 | 8.7719 | 82.379 | 249,583 | 227.984 |
HW Inventory inventory load (percent change in MIF processing load with Office Update Inventory Tool, Security Update Inventory Tool, and Software Updates Installation Agent active) | 3,000 | 369 | 8.13 | 82.946 | 249,742 | 241.662 |
Percent Change change for Feature Pack vs. no Feature Pack |
| (+) 7.89% | (-)7.32% | (+). 567% | (+). 0067% | (+) 6% |
HW Inventory inventory load (percent change in MIF processing load without Feature Pack) | 9,000 | 641 | 14.041 | 87.476 | 281,367 | 355.291 |
HW Inventory inventory load (percent change in MIF processing load with Office Update Inventory Tool, Security Update Inventory Tool, and Software Updates Installation Agent active) | 9,000 | 650 | 13.846 | 91.219 | 291,211 | 393.117 |
Percent Change change for Feature Pack vs. no Feature Pack |
| (+) 1.404% | (-) 1.389% | (+) 3.743% | (+) 3.499% | (+) 10.646% |
Status Message message load added by Feature Pack | 30,000 | 552 | 54.348 | 90.927 | 285,338 | 411.238 |
Processing Load Added added to client computers by the scan tools
CPU and disk utilization can increase when a software update is being installed on a client computer. The size and duration of the increase varies depending on the particular update. To obtain the exact size of the increase in processing load, it is recommended that you conduct pre-deployment testing for each update and determine the processing load increase by monitoring the test computers.
Database storage capacity
To help you calculate the effect that the inventory and updates will have on your system, use the following estimates for update inventory size according to operating system. To develop a rough estimate of resource usage, multiply the numbers in the following table by the number of clients you will be including in the inventory, and then plan the deployment of these tools accordingly.
The following table indicates the approximate file size both for a full MIF (100% of the inventory for a computer is forwarded to the server, usually a one-time event) and a delta MIF (changes in inventory forwarded to the server on a regular basis) for a single computer, on a per inventory basis, based on the default configuration of the SMS_def.mof file.
These values are based on the software updates available at the time this document is being written and will change over time. The file size will reduce with the continued installation of the most recent service packs.
Table 10 Size of Inventory
| Operating system | Full MIF | Delta MIF |
Windows NT 4.0 SP6a | ~122 KB | ~15 KB |
Windows 2000 SP 2 | ~100 KB | ~15 KB |
Windows XP | ~78 KB | ~15 KB |
SQL Server Database | Look for this information in a future release of this document. | Look for this information in a future release of this document. |
Feature Pack Performance Considerations
When deploying the Feature Pack tools in your enterprise, be aware that the following factors can affect performance.
Scan tool completeness considerations
Scan tool completeness is directly related to how current the database of software updates is. To ensure that the Scan tool is using the latest update information to create your inventory, and that your system resources are not taxed by unnecessary database download cycles do the following:
| • | Ensure that the software update database is current. If the Sync tool does not regularly download the updated version of the database, you risk the possibility of missing critical updates and creating an inaccurate inventory. |
| • | Ensure that your process for using the Sync tool to download the latest database of software updates reflects the update frequency for that database. It is best to schedule the database download to occur as soon after the database master copy is updated on the Web. For example, the Security Updates Bulletin Catalog, MSSecure.xml, contains security update information that Microsoft updates once a week. Therefore, downloading that catalog more than once a week (immediately following the Microsoft update) does not provide any additional benefit or protection to your system. After the catalog is downloaded, distribution points can be either updated automatically after the catalog download or on a separate automated schedule. |
A possible scenario for catalog update is as follows:
1. | The SMS site server uses the Sync tool to download the catalog into the package source folder once a week, for example, at 3:00 P.M. on every Thursday. | ||
2. | The SMS distribution points are scheduled to perform updates for the catalog, enterprise-wide, once a week, for example, at 6:00 P.M. on every Thursday. | ||
3. | Client cached copies of the catalog are refreshed once a week, for example, every at 9:00 P.M. on Thursday.
| ||
4. | SMS hardware inventory is scheduled weekly, for example, at 12:00 midnight on every Thursday to forward the 9:00 P.M. software update inventory results to SMS. |
Scan tool accuracy considerations
Scan tool accuracy is directly re