As embedded computing evolves and requires more capable and connected operating systems, the designers and administrators of those systems must address the latest security, manageability, and supportability needs. For example, certain classes of retail devices require an Internet connection for downloading advertising content from a subscription-based partner Web site. Other retail devices may be on a closed network, yet would still benefit from an easy to maintain update strategy.

The prevalence of viruses, malware, and similar security threats pose additional challenges. Furthermore, retailers complying with PCI standards recognize the need to deploy critical patches within a month of release. Windows® Embedded POSReady enables you to overcome these challenges when designing and maintaining operating systems for retail devices by giving you the ability to deploy operating system updates to the devices by using the Windows Update Agent pulling either from the retailer’s Windows Server® Update Services (WSUS) server or directly from the Microsoft Web site.

Windows Embedded Standard, the successor to Windows XP Embedded, has a range of technologies it can leverage to update in-field images, such as a WSUS client, a Systems Management Server (SMS) client, and more. However, Windows Embedded Standard does not support connecting to and downloading updates from Microsoft because each particular Windows Embedded Standard image is a customized subset of the Windows XP Professional binaries. It would be impossible to guarantee that any particular update would be relevant for or even function properly once applied to a device running a customized operating system image. With Windows Embedded Standard, it is the responsibility of the retailer who intends to apply those updates to obtain them from their original equipment manufacturer (OEM).

The OEM downloads updates from Microsoft, tests the updates against the custom operating system image, and then delivers those updates to retailer.

Windows Embedded POSReady represents a known subset of binaries from Windows XP Professional, which enables the Windows Update Agent running on the Windows Embedded POSReady image to check if any updates are available to apply to the image. This architecture of Windows Embedded POSReady provides you with a reliable update strategy for the operating system layer of your solution. Retailers who wish to validate updates in a test environment before deploying to their devices may still opt to use a WSUS server to deploy those updates by configuring the Windows Update Agent to pull from their WSUS instead of directly from Microsoft.With Windows Embedded POSReady, you can configure Automatic Updates through the Control Panel applet, as shown below:

For networks of more than just a few computers, administrators may want to manage the update process through WSUS. By using WSUS with Active Directory group policy, administrators can manage settings and the distribution of updates. To learn more about WSUS, see http://technet.microsoft.com/en-us/wsus/default.aspx.

If you are deploying retail devices in an Active Directory environment, Microsoft recommends that you create a new Group Policy object (GPO) that contains only WSUS settings. It is strongly advised to not edit the Default Domain or Default Domain Controller GPOs. This new GPO gives retailers the flexibility to have different groups of devices configured with their own unique WSUS settings. You can then link that new GPO to the appropriate Active Directory container for your environment. In a simple environment, that can be the domain. In a more complex environment, you might link that GPO to specific organizational units (OUs).

If you are deploying retail devices in a non-Active Directory environment, you can still configure the Windows Update Agent to pull updates from a WSUS server. The Control Panel applet doesn’t have a setting for the WSUS server path. Instead, you can either use the Group Policy Object Editor to edit the Local Group Policy Object or you can change registry settings. For more details, see http://technet.microsoft.com/en-us/library/cc708449.aspx.

For more information on best practices with WSUS, see http://technet.microsoft.com/en-us/library/cc708536.aspx.Retailers looking for an update strategy including application updates can use Systems Management Server (SMS) or its successor System Center Configuration Manager (SCCM) with Windows Embedded POSReady. For more information about SCCM, see http://www.microsoft.com/systemcenter/configurationmanager.