Earlier this month InfraScience was on site with one of our customers who run Microsoft System Center Configuration Manager 2007 (or ConfigMgr for short). The engineer that handles their software update operations each month asked if we would look at something strange in his ConfigMgr console. Normally he sees nearly 5000 machines requiring the latest Microsoft OS security updates for Windows XP, but this month he only saw 1/10 of the machines needing the updates. The other 90% of the XP clients reported that the updates were not required.
It took a couple of clicks to confirm why the updates were not required. The software updates released on August 10th, 2010 were the first updates released by Microsoft that did not apply to XP Service Pack 2. And why? XP SP2 reached end-of-support on July 31, 2010. So the detection mechanism built into each update that is read by Windows Update on the client reports this update is just not applicable, and reports that to management systems for ConfigMgr and Windows Server Update Services (WSUS)
July 31st was also the end-of-support date for all versions of Windows 2000. So the bad news is that no security updates will be released for either of these platforms.
The good news is that ConfigMgr and WSUS can be used to upgrade XP SP 2 to SP3, which is still supported until April 2014. Our customer was already rolling out XP SP3 via ConfigMgr, but this deadline has given them the push they needed to accelerate the update to all of their machines despite the unwillingness of their application teams.
The software updates feature in ConfigMgr is a powerful tool for deploying updates of all forms to an enterprise environment. What type of updates? Monthly security updates, Forefront definition updates, device drivers, feature packages like .NET Framework 4, service packs like XP SP3 and Office 2007 SP2. And the list is not limited to Microsoft releases. Third party updates from Adobe and Citrix are available to be published to your ConfigMgr environment using System Center Updates Publisher (SCUP). Even your own internal applications can be defined and published.
When ConfigMgr clients check for policy, they get the list of updates available and released from the ConfigMgr Software Update Point. If any updates are required and not installed, the client will connect to a local distribution point and retrieve only the updates required for that machine. This behavior can be scheduled using the scheduling capabilities within ConfigMgr.
InfraScience is uniquely qualified to work with companies requiring assistance on this topic. Call or email for more information on our Microsoft Desktop and Systems Management Services.
Mark Collett, Senior Consultant
InfraScience