Print - What You Need to Know About Windows Update Services

Windows Update Services (WUS) is the successor to Microsoft Software Update Services (SUS) and the application Microsoft previously referred to as SUS 2.0. Essentially a free Windows Server add-on that lets small and midsized businesses easily handle patch management for servers and clients, WUS is one of the most exciting out-of-band (OOB) Windows Server upgrades Microsoft has shipped since Windows Server 2003 debuted in April 2003. The product's functionality sits between that of Windows Update and Microsoft Update (a new service that the company will soon introduce), which are designed for individual users, and Microsoft Systems Management Server (SMS) 2003, which is aimed at high-end enterprises. The company also offers a fourth patch-management product, Microsoft Baseline Security Analyzer (MBSA), which can help individuals but is designed to let third-party developers create their own patch-management systems. Here's what you need to know about WUS.

A New Back End
Microsoft's patch-management strategy has been evolving steadily since early last year, when the company finally acknowledged that it was doing a poor job of helping customers keep their products up-to-date easily and seamlessly. However, before Microsoft could ship any new patch-management products, the company had to fix the infrastructure. Its existing products—Windows Update, SMS, MBSA, and SUS 1.x—all use different database back ends. As a result, these products often deliver varying results, even when run on the same systems. Microsoft says that work on a common patch-management back end started in 2003 and will continue through summer 2004, culminating in the releases of MBSA 2.0 and WUS in third quarter 2004. By that time, all Microsoft's patch-management tools will point to the same back end and provide consistent results.

Also helping WUS is the move from several patch-installer routines to just two, both of which will be based on the new Windows Installer (MSI) 3.0 technology, which provides for patches with far fewer reboots, new uninstallation capabilities, and massive patch-size reductions. And a new delta compression scheme will eventually make MSI 3.0—based patches as much as 90 percent smaller than equivalent patches released today, according to Microsoft.

New Features
In addition to a new name, WUS sports a wide range of desirable new features. Like earlier SUS versions, WUS provides businesses with a centralized patch-management infrastructure, which lets administrators approve then roll out patches to desktops and servers. WUS adds new content download types—including patches for Microsoft Office, SQL Server, and Exchange Server—to the previously supported Windows updates and service packs. WUS includes improved targeting capabilities that let administrators take advantage of organizational units (OUs) in Active Directory (AD) environments or manually created groups in workgroups to roll out patches to the most crucial systems first. The new service also includes bandwidth-management capabilities that let you control patch delivery during peak business hours so that you can ensure your networks won't be overloaded during crucial periods.

Thanks to a new topology scheme that supports parent and child WUS servers, WUS scales out more effectively than SUS, opening up this patching solution to distributed environments for the first time. If you're wondering how well WUS scales out, consider this: WUS is based on the same technology that Microsoft uses to run Windows Update, so it's proven to be both scalable and reliable. And now WUS can generate simple reports detailing key patch-management tasks (e.g., notifying you whether all your target groups received and installed the updates) and status reports. Unlike the more powerful SMS, however, WUS doesn't support ad hoc queries, which Microsoft describes as a more complex feature.

One feature that won't be changing is the price—none. Contrary to rumors, and despite all the powerful new features, WUS continues to be a free component of Windows Server.

How It Works
Behind the scenes, WUS includes a built-in Microsoft Data Engine (MSDE)—based database, but larger enterprises can use SQL Server for better performance. This database, called the WUS Catalog, connects to Windows Update, captures metadata about available patches, and stores the information locally. The metadata describes each patch, explains which systems it applies to, describes its dependencies, and provides other useful information. Locally, administrators can schedule patch deployment, test patches before deploying, and determine which systems should receive patches first.

Windows clients in the network are configured to go to the local WUS database rather than to global Windows Update servers. Clients accessing the WUS Catalog pull metadata, perform a scan against the system, and report back to WUS about which patches they need. "It's a basic pull architecture," Steve Anderson, director of marketing for Windows Server, said. "It tells the server, 'Here's what I need.'"

And on Windows XP Service Pack 2 (SP2) systems, WUS supports a new feature called install on shutdown. This feature lets Windows systems automatically install reboot-required patches as the system shuts down, ensuring that work isn't interrupted and the system reboots into a patched state.

Recommendations
Unless you're already using SMS or a third-party patch-management solution, you should evaluate WUS as soon as it's publicly available. Microsoft will ship beta versions of the product this summer and release the final version sometime in the fall. By that time, the company's overhauled patch-management infrastructure will be in place, and all of its patch-management tools will be working through a common back end as well. If you've been struggling with confusing, contradictory, and incomplete patch management on your Windows systems, rejoice. If Microsoft gets this release right—and early indications are that it will—your patch-management nightmare could be ending.

Paul, SUS was only good for a small environment, no more than 500 devices. Does the same hold true for WUS? Also, how does this play into MS new version of SMS? Thanks!

This surely sound good. I have been using SUS and did find it extemely useful, but it failed in report generation. WUS does give great assurances. All the best to the WUS team. Eagerly waiting for the software Thanx

This will be an important event if it works as intended, without a great deal of administrative overhead

Well i have nothing but i have a question my msn hotmail is not working i cant seem to chck my emails, plus my add/remove programs dont work would u know why that is that.

I formatted my computer reinstalled win xp pro. Reinstalled verything from my driver's everything. But windows Xp Updater for Critical updates Locked stopped working it won't let me update any more i tryed getting the patch's but it's still not working i tryed reinstalling SP1 to see if that helps nothing it still won't Auto Update Or Let me update I have turned on and sett the auto update and nothing . how do I fix this.

I'm a user of SUS 1.1. The concept is fine but the implementation is tricky (only works with Administrator). If Microsoft releases the WUS like the article describes, is a step forward.

SUS good for no more than 500 devices? We use SUS and have around 1100 workstations spread accross 6 locations. It has worked like a charm.

I keep getting e-mail from Microsoft that tells me to download this patch immediaely. Is this really from Microsoft before it came up on my deskstop to down load updates. Have never received email before. Is this safe and is it really from Microsoft ? Please let me know.

How will be the Update procedure from SUS 1.0 to WUS? Will I use the same architecture proposed for SUS 1.0 when migrating/updating to WUS?

formatted my computer reinstalled win xp. Reinstalled verything from my driver's everything. But windows Xp Updater for Critical updates Locked stopped working it won't let me update any more i tryed getting the patch's but it's still not working i tryed reinstalling SP1 to see if that helps nothing it still won't Auto Update Or Let me update I have turned on and sett the auto update and nothing . how do I fix this.

Rob, we are running SUS on 27,000 clients, not sure where your 500 device limit came from, granted we have several SUS servers deployed throughout the country, but still.

With the current version of SUS how do I deploy to all my users without having Active Directory currently installed? And how if possible could I force a shutdown? Thanks,

We´ve build 5 instances of SUS with VMware on one server. With this software we realized a good group function for supplying special updates for special servers or workstations with only one patch-pool.

This is a step forward, but why is it only for free with Windows 2003? How much will it cost for Windows 2000? I think it should be called Microsoft Update Services.... Just my .01 cent.

SUS only good for up to 500 PCs? What utter rubbish! We're using it on 1,200 PCs from a single server all updating over a 2 hour window from 15 sites across Europe. Lack of reporting is a shame, but nothing more. SUS has kept 99% of our machines 99% patched and given it costs nothing that's good enough for me. Given our experience I'd expect a single SUS server to be able to cope with 3,000 - 4,000 clients without problem. The other thing I feel we're lacking is the ability to call the SUS client from the command line to give it an "update now" kick - e.g from a login script - maybe that will make it's way into WUS. Will WUS be a drop in server replacement for SUS, or will we have to change the clients from SUS to WUS meaning a migration phase?

SUS , WUS etc.. Sounds great going to test it now, I am so sick of running around to peoples desktops, leaving memos for them to log off.. etc.. anyway I am concerned about the QA re the updates, not often but sometimes we have issues with updates that involve rollbacks or re-osing, Is there a decent site that address these issues? Thanks!

I am presently deploying SUS 1.X on my network now and the test environmnet seems to be working well except that I have a problem configuring XP clients to update from the server. How dow I go about this? The promises of WUS looks great and would be a great relief for many administrators, but should its deployment be limited to windows 2003 server? Thanks.

Don't forget Window NT workstations users. Many companies in Brazil uses NT 4.0 that is very stable and require less machine resources

I haven't been able to update ANYthing on my XP and being just a garden variety nettie trying to start a business, I don't know why. Only thing I've done different is install a spyware blocker because I am also a teacher, and the popups were preventing me from getting my (mandatory) online grade reporting done. If it's critical, and the updates can't be installed, I'm doomed! Help help!

My Windows XP Update and Search both stopped working, Tried reinstalling IE but can't make them work, what can be done to fix these problems short of reinstalling entire windows?

Where can I find information on WUS and MBSA 2.0? This will be a great improvement in patch-management and I want to get on board.

Sounds wonderful... I would like to begin testing ASAP. Where can I get my hands on the Beta version of WUS?

Update of SUS - to the WUS team: - Is it possible to have different "update profiles"? - More report concerning the clients updates ? - The possibility to not ask anything to the client (even a reboot, the reboot will be done at the end of the day) - Deploy an urgent patch automatically from the server. that's all for the moment. Thanks to secure your own products....

jgeraghty, you can use GP from the domain controller to push down necessary configuration to your XP clients, that's what we did in both test and production environment. As many have mentioned, lack of reporting is a shame. It would be great if given the MSDE/SQL capabilities in WUS to have reporting functionality so that it will be easier for corp. to track patches that have been successfully deployed thru SUS or WUS. Right now, we are using obsolete method - which is tracking by logon scripts to check for crucial patch is really installed whenever user logs on.

Been using SUS and it has worked out great for us. No running around to each desktop all the time. Controlled the client settings through GP and like I read from someone else it has been about 99% effective. WUS looks like it fills a critical gap, the reporting feature. Wading through the IIS log now to identfy failures is enough to pull your hair out. Looking forward to WUS

Microsoft's SUS_Deployguide_sp1.doc mentioned below. So configuration does matter for how many client you can support, isn't it? Determining Hardware Requirements The minimum configuration for a server running Software Update Services is: • Pentium III 700 MHz or higher processor. • 512 megabytes of RAM. • 6 gigabytes (GB) of free hard disk space for setup and security packages. This configuration will support approximately 15,000 clients using one server running SUS.

I have deployed SUS 2.0 in our organisation and found it to be slightly tricky to setup initially, but once working I have had no problems with reliability. If the "WUS" application delivers what it promises then I will be first in the queue for the Beta.

I am running SUS 1.X and I find it pretty good. However, reporting is a big issue. WUS sounds great but why not Windows 2000? Make be im not ready to go to 2003 yet.

We looked into SUS to deploy patches to about 1,100 PC's. Unfortunately, almost none of our users have admin rights. That means when updates are installed, all they get is a notification to reboot where "yes" is there only option. In trials our users clicked "yes" which rebooted and closed all running apps. This cause DB corruption, and users lost open doc's. I can only hope that WUS will provide completely silent installs with no user interaction.

PROBLEMS! PROBLEMS! IS THIS WHAT IS CAUSING MICROSOFT'S MAJOR WEB SERVER MALFUNCTIONS RECENTLY! AND NO HELP I "SITE" CAN'T ACCESS HTTP... ANYONE BEEN SEEING " THE PAGE CANNOT BE DISPLAYED" OR ERROR 0X800C0005 ! BET SO!

If you ask me, the greatest attribute of WUS is going to be support for additional MS products. We are migrating to native AD, but until then, options are limited for deploying Office SP's.

I'm currently using SUS and it works fine. My one complaint is that the GUI needs to display feedback about the status of client installs. If WUS hold true to the improvements mentioned in this instantDoc that would be awesome. Also, is it a simple upgrade form SUS to WUS and how can I get a beta copy?

We are currently running SUS. What is, if any, the upgrade path to WUS? Is it an upgrade, do you need to totally reinstall?

We have used SUS to update 300 pc's and have not had any problems, I have it set to update at 5:00am every morning and to do a reboot if needed after the update. The user does need to be logged in, just sitting at a Novell logon prompt( we have Novell as our network OS) The only issue I have with SUS is the reporting/tracking updates to which pc's. It has worked fine on our windows 2000 and XP machines.

I have been using SUS for over a year now, never had a problem. looking forward to using WUS.

We're using SUS for approx 2000 devices. Works like a champ. I don't know how the 500 device rumor began.

If this comes through as you stated, it will be a dream come true amongst the nightmare of keeping our network w/s current. Do we have to signup anywhere to be notified when this is ready?

We have SUS running here but found it lacking in reporting and only covered a small portion of patching. We deployed HFNETCHK Pro to cover us completely. (http://hfnetchk.shavlik.com/support/hfpro4help/HFN.htm#HFNetChk_4_vs._WIndows_Update.htm) The reporting is also excellent in HFNETCHK Pro. SUS is ok and limited, it is free... but if you need a Corporate solution SuS does not cut it (for me anyway). I am watching WUS for now and hope that it will be what I need in the future.

Check out shavlik, www.shavlik.com, they are the creators of the MBSA and what powers SUS, that should be the point of review against WUS the shavlik HFNTCHK4PRO you can download a free preview. SUS is not a good tool in my opinion. WUS should be better...

SUS 1.x works great, but there are a few things that would make it much better... Multi-threading would allow a single server to manage multiple different groups of computers that may have different needs (slow wireless laptops vs. high-speed desktops). If it is integrated with Active Directory, then there must be a way to assign a different "update policy" to different containers. Simply pointing to multiple WUS servers will not be scalable in a large environment. The solution proposed by Norbert using VMware is clever, but we do not have VMware and that should be unnecessary. It doesn't matter if the software is free if you need to purchase additional software or additional servers. Also, reporting is practically nonexistent in SUS 1.x. I want to know what machines have pulled what updates at what time. This will allow me to determine the capacity of the server that it is running on and manually update workstations that have connection issues. Also, details for each upate should be available through the console--especially when the package causes a reboot. Reboots caused by SUS generates a lot of complaints, especially when the user does not have any choice but to reboot. I look forward to testing WUS. Even with its shortcomings, SUS has been a valuable tool.

I have p3(933) cpu,(at/x cabinet)but when i shut down my system in case of 2000 & xp i got amsg (it is safe now to turn off ur computer then i had to to switch off my computer manully.

We have been using SUS 1 SP1 for a few months now but I am having trouble downloading the new patches. I run the Synchronization in the evening and then again in the mornig when I arrive but the server never pulls anything down. The server is setup to Synchronize directly from the Microsoft Windows Update servers. What am I missing?

kabeerbhati - Check Power Options or Power Management, and change APM to enable Advanced Power Management Support.. I think a complete installation guide is of paramount importance to WUS, SUS lacked this.

Even though the release of the Microsoft WUS service sounds like a move in the right direction. All the literature I have read has indicated that, to benefit from the full functionality and reporting SMS 2003 will need to be purchased. Is this correct

Here's an idea... Release a product (software) that is stable and secure, then Microsoft won't need to provide a free product like SUS / WUS. Since that's not likely to happen anytime soon, we are excided about the NEW version coming soon.

We're using SUS 1.1 for around 700 machines in 13 International locations from NY to Tokyo. It's a doddle to configure and use. Downfalls: Reports? What reports? MBSA is incapable of detecting some of the patches that are installed and is useless to me. We have resorted to trust and random checks. So far, so good. No pathc deployment issues. The approval screen has a quirk. When we approve some new patches, previously approved pathes seem to become unapproved. And nope, they are not reissued patches seeking new approval. Otherwise, it's free and it does the job.

I just installed SUS for the first time. When I launch the SUS my Browser returns an Error 403 Forbidden. I have Administrative rights to the server, which is running Server 2000? Any thoughts?

We use SUS on an environment of 3000 computers, and it runs fine. Helped us defeat sasser, because almost all machines were patched before the outbreak. However forget reporting with sus, and the client could use some more options as well. Our users don't like that popup that forcess them to reboot (and can only be defeated by hacking the client, since there no policy to disable the reboot). Looking forward to wus with the install on shutdown feature.

Will WUS work in a non-AD environment? We are using SUS currently in a non-AD environment and it works wonders. The only downfall has been having to initailly touch each computer to install a group policy template and configure it. (Perhaps there is an easier way and I just haven't figured it out yet...) Nonetheless, SUS works wonders and is a breeze to manage! I use SQL to create readable reports from the logs. I work in a hospital and with HIPPA regulations, we require tight security. What do I need to do to be a Beta tester? Will WUS require a dedicated server? I have a Win2K3 server that serves as a TS Licensing Server. Will I be able to run WUS on this server along with that function?

SUS 2.0 it a bit tricky to setup…but once I got to work it certainly makes our life easier. WUS sound pretty good. When can I get the BETA?

I am a current user of SUS 1.1. We have found that this version of SUS does not offer report management. Does WUS offer more than 1 type of report?

Why would Update KB840374 make me lose my 2004 Earthlink e-mail? After install and reboot it reverted my e-mail to an old cache copy.

My computer will not let me login. When computer boots, I get a box that says all. I click ok and then when I try to put in my password and user name an error pops up the local policy of this system does not permit you to logon interactively what can i do? System is 2000, I don't want to lose any of my files and i don't have a reboot disk

Folks, i am using Shavlik's HFNetChk Pro, xclnt and great reporting on all patches / sp's. I have used it consistantly for 12 months and it works !! A very simple interface and you can also setup different groups to update ( servers, client w/s, etc) and schedule them also.

(Perhaps this is a stupid question but I am going to ask it anyway :-D) I am thinking of using SUS in my network (approximately 400 users), But I haven’t got the License for Windows 2000/2003 server yet. So I was wandering if there is any possible way to run SUS on Windows 2000 or XP?

SUS Server installation was easy and even the clients configuration was great worked fine enough except for some limitations. It would be great if WUS has a web page included like Microsoft update site so we could easily use it in case of wan. Also if it would scan given IP ranges and push updates as HFNTCHK4PRO does it have no match in update management softwares. And also if the installation method is clearly mentioned so that even novices wont have a problem installing and maintaing it.

Windows patch management is a nightmare. This product looks like it is another extremely minor improvement that looks difficult to manage. I can not believe that anyone finds this technology beneficial. Windows patches should be completely automatic, not require users to have administrative rights, and never cause a re-boot, similar to Norton Anti Virus automatic virus updates. Until this happens, Windows patches will always require excessive manual intervention from system administrators and Windows will always be unstable and insecure.

Paul, since a few months before i tried to install SUS SP1 at first. The installation of the server and the rollout of the wuau22ger.msi to the clients could be completed successfully. After trying to roll out the approved patches at a fixed time (noon), nothing happens. One day later, some clients have received the patch and one more day later the next few clients were completed, but not at all. The logfile of the clients told me, that the agent could not reach the current SUS server or his path. I have different (hardware) clients. In another location it works quite good and without any interruption the local admin has told me. Can you help me? Best regards, Kai (from Germany)

THIS ARTICLE IS VERY USEFULL FOR ALL PEOPLE THAT HAVE PROBLEM . BY THE WAY, I NEED TO KNOW HOW CAN I WORK MY SCANPRISA 640P ACER IN THE WINDOW XP THAT I HAVE NOW. TANK. DR. SABA MUSA. MY EMAIL IS sabamusa1@hotmail.com

This in regarding to pamelas comment on may 15 2004 that she cant log on interactively well the best solution in yur case wud be either u attach yur hard drive to another computer and collect yur data or use ERD Commander after u have that software u can make a bootable cd with which even reset yur administrator password.

I've had to reinstall me windows 2000 Pro and after that I've never been able to get any hotfixes. You sent me the security undated CD. How can I install al the fixes?

According to the SUS white paper, a singel SUS server can support up to 15000 clients.

We use SUS 1.x and feel that it works fine. The one rub is, has anyone had the cumulative IE 6 patches not stick when installed and continually install over and over again? Example is the MS04-004 patches (KB831167). The patches will not stick and everynight SUS tries to install the patch over and over. Bit of a problem on Servers :)

for all of you needing reporting for sus 1.1 there is a free download that will give you the reporting you are looking for at www.susserver.com, look at McWebs tool, works like a champs and we run sus 1.1 on 3000 systems at 99 percent success. It was not hard to deploy, just push some registry keys. As far as the reboot, if users don't read messages, what can you do. If it is totally silent and they never reboot since the install is totally silent, patches may not take affect regardless if you use sus or any other product. Perhaps notifying your users that SUS would be released and what they may see and the importance. We have very little issues with 1.1

Please post your tech support issues somewhere else. SUS is OK, would be nice to enable a visable property of approved updates. WUS sounds nice being in a database format I can write what ever report I would like

I have a question about SUS/WUS. Will you be able to use it after an OPK installation by running an command line ? Thanks

Just for the record (and it may have been answered but I did not see it), WinUS has the ability to update SUS client software to the WinUS version. Presumeably then, no additional work should be needed on the client end when shifting from SUS to WinUS.

so many of these questions and problems people are having (like controling reboots) are answered in the SUS deployment guide.....duhhh....oh my gosh, you mean read the instructions?

I installed SUS server and i have syschornize the server with all updates, my sus serevr is working, how can i test with my network clients. thanks

To those who have asked about the availability for Windows 2000, yes it is available. From the Microsoft faq on WUS: Q. On which platforms does Windows Update Services client run? A. • Windows 2000 Service Pack 3 and later • Windows XP and later • Windows Server™ 2003 Q. On which platforms does Windows Update Services server run? A. • Windows 2000 Service Pack 4 and later • Windows Server™ 2003 Q. Will Windows Update Services only update Windows operating systems? A. No. Windows Update Services will support updating Windows operating systems as well as all Microsoft corporate software over time. When initially released, Windows Update Services will support updating Windows XP Professional, Windows 2000, Windows Server 2003, Office XP, Office 2003, SQL Server™ 2000, MSDE 2000, and Exchange 2003. Support for additional Microsoft products will be added over time—without the need for upgrading or redeploying a Windows Update Services implementation. for other information please visit: http://www.microsoft.com/windowsserversystem/sus/wusfaq.mspx

I am surprised that in six months on and off, mostly off, I read I learned how to build my first computer and program it with basically no problems thanks to the good info supplied to this one finger scrap metal collector. Later found out that I basically have the equivalent of the computer that was used in the making of [THE MATRIX] and have added a HP laser printer, epson 1660 scanner digital speakers, wingman rumble pad. My screen isn't great, but I got it from a dead friend. Today I am loading adobe reader/adobe manager/and canon digital video solutions disk and going to The Plaza of Nations to video Bob Dog's Circus Side Show in Vancouver Canada. Not bragging but you can learn a lot more from finding all the information and understanding it before buying or downloading something. Sure hope this new system is the fix Bill had promised us consumers before.

Great article, but does not answer my question. I have installed SUS SP1, and synchronization seems to work properly according to the sync log. The approve window however gives me a "http 500 internal server error" message, yet every other page with the interface works. IIS has been restarted just to be sure.

Does SUS or will WUS support WOL? Also, if the taget machine is locked down, will either of these products be able to launch the updates in administrative mode?

SUS does work in a non active directory domain. Been doing it for at least a year. Use login script to write registry entries and it will work.

I did a windows update and updated drivers that they suggested I update. The driver was for my ATI graphics. What a surprise when I rebooted and found that there was now NO DRIVER installed, and my display was a 5x5 patch in the middle of my desktop. thats the last time I do a windows update.

I'm looking for a SUS/WUS system for stand alone clients. I have lots of stations were users logonto the station as restricted user and updates are not done automatically. Can anyone help.

Need this ASAP. Too many issues with SUS, never know if its really working without going machine to machine. Was about to buy a patch management tool, but will wait now. Can I beta test!?

My dream would be that WUS would be distributed using SUS so that all the SUS servers get automatically updated to WUS and the client PCs would recieve the WUS Client through SUS. - Making implimentation this easy would be a great thing.

Hi, I am using SUS right from first day. It is great tool to save time spent on patch updates and ultimately internet bandwidth. Still I have some doubts on SUS , AS it is not having good reporting capabilities. Also very difficult to find the client connecting to SUS Server (Local) or Internet based MS Server for downloading patches. Another thing is that repitative installation of IE patches with out any reasons. MBSA 1.2 shows different results with local SUS and MS server like giving error " version of file found greater.Error about MS-XML and MDAC components patch missings with all versions display. Let us hope for WUS to overcome these problems and support for office products updation,Sql etc. Cheers/Mahesh N

Here's the URL to the White Paper that can answer just about every question you guys have about SUS http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx

WUS is really great. solves many issues we were facing with SUS. like reboots and unique time constraints.

SUS is not able to ensure no reboot on servers, when noone is logged in (like servers should work). This is the biggest disadvantage of SUS. To those, telling RTFM: you sould do this correctly. MS describes how shutdown can be controlled. But the reboot can not be supressed, when no one is logged on. This results in the situation, that SUS can not be surely used in an automated process on servers without defined regular downtimes.

As it is possible to be put to install the parch with SUS without the user takes part, automatic when user loggon.

OK I'm new to the SUS, WUS stuff. I'm looking for something to update 3rd party software that uses installshield. Will SUS or WUS help me with this? I have approx 550 machings I want to push software and patches out to.

Very informative! Lets see if it lives up to what these people have said about it!

Hi everyone Her is the "the ressourse for the SUS consept". Here are some untold pointers on configurering and some reporting source files that works. Look at http://www.susserver.com/ Be safe everyone

Will WUS be able to receive offline updates for updating standalong "internetless" networks? (i.e. Admin downloads updates through Windows Update Catalog and transfers them via removable media to an offline WUS server.)

Will WUS be able to push patches to clients intelligently without breaking the system?

I have a question : How can i see that the susserver is working on a client pc, when i have used the registry settings and not the active directory ? (ps i use a unix based network)

After installing Symantec Antivirus I still experiance some viruses eg boot malmo, netsky.b@mm etc How do i get assistance?

When I get a message for a critical update from Microsoft, and I try to do the Windows Update all I get is a blank page. I cannot get the Scan to Scan my computer for updates either. This has been going on for about 2 months. Can you help PLEASE! Thank you for any assistance you may give me.

Can WUS be setup as a standalone server connected to clients but with no access to the Internet? Can we add updates manually and then let WUS deploy them?

We dropped SUS after 4 months mainly because of lack of reporting and difficulties patching our servers. We went to Prism patching by New Boundary. It did cost money, relatively cheap though.

i can not get windows updates now it gives me a error 0x800c0005 dont know how to fix this my pc is still less than a year old windows xp plz let me know if you can help thx

SMS is an excellent "software status" reporting tool and very good for scanning for patch compliance, however its active patch management capacity is a bit weak. Even with a package advertisment schedule from 10pm to 5am our network still only has an 80% patch compliance on applicable computers. This is not acceptable because of the nature of our network and the need for security and having 1500 unpatched clients that require manual updating is a real pain in the ass and a waste of time. I'm hoping to implement SUS/WUS to deploy all windows related patches and to use the existing SMS infrastructure for patch compliance reporting since SMS has repeatedly proven that even with a powerful main server, an extended advertisment scedule, and 6 distrubution points that is is not capable of delivering the 98% or better patch compliance level that is essential on our network. I hope WUS measures up!

One question....while WUS is updating my installations of Windows who is updating WUS? Thanks to you Billy Gates, for creating a computing environment where stuff is so buggy I have to actually purchase more hardware to keep track of your mess. What a Wuss.

One answer....If you don't like it, get out of information systems. ;) A computing environment that's buggy?? Be happy the majority of the world population is using a standard platform...otherwise...it would redefine buggy. And when you're worth an estimated 31.79 billion dollars, you can pretty much do what ever you want. WUS is an attempt to organize your mess.

I'm using Sus and i'ts a nice toll but I have a problem installing patches when the user is not administrator on the local machine. Poweruser doe's not solve the problem either any suggestions?

Is there a way to hide the User Interaction Dialog Box while the updates are being grabbed from the SUS Server to the Client? The user has the option to cancel the update process unless they are logged off when the update occurs from the SUS Server.

"..culminating in the releases of MBSA 2.0 and WUS in third quarter 2004" (for all those here that read the posts but didn't read the article....) I have been using SUS 1.0 for a bit now and it saved us from messing around with proxy/nat/isa modifications; I eagerly await WUS and it's reporting engine for post patch info. As for those buggy comments....I run an all MS network and have few problems except for those involving proprietary applications; if you can maintain a tight ship MS is very easy to to troubleshoot and fix. The problem is not MS, it is the people that endlessly attempt to find flaws in MS. It's all just 1's and 0's.......

Alex Heylin There is a command tool for SUS that pulls the patches from directly from the SUS server. The executable is called NWSUSUTIL.EXE and works like a champ. Try it out. You may be able to find it on google.

What versions of Windows can be patched with this. Have got Windows 2003\NT servers and NT\XP workstations

I have been using SUS 1.x for a few months not on many systems like the other users but over 2 states and it works like a charm. It took me a while to configure cause it was my first server but after it was configured and tested i just used a reg file to point all the computer to my server. I can't wait for WUS!!!!!

I am Deploying SUS, I am curious if when it downloads the updates to the clients, does a administrator have to be logged in to install the updates? Or can power users be logged on adn it will install with administrative rights?

I have deployed SUS 2.0 in our customers. When WUS releases I will deploy. WUS is great idea. Thanks MSFT. Levent

I don't know about updating the update servers but in my opinion, I definitely don't like it. It seems like I can't update my system for no reason. Well, for some people, the updates seem to work but in my system, ALL the updates fail.

Well, I have been using updateEXPERT to patch my Servers for years. It provides all the functionality we need- and more. Check it out at www.amtsoftware.com

BEWARE of the BITS ,if you like billy gates in your private life then enjoy .BITS=backgroung intelligence transfer service ,might as well say a TROJAN for billy .

Thanks for such a nice article. Regarding MS new Patch Mgmt Solution for End user/ SMB is any chance of a complete solution from MS. Is it support agent less architecture & Disconnected network for Patch mgmt? Waiting for response, Best regards, Sekhardash.

SUS limit of 500 clients? We have 50,000 clients using 10 SUS servers in parent-child setup.

We also used sp2 and it crashed our computers!!! I agree with anonymous user november 17, this might be a good story!

I am installing a test scenario with SUS 1.0 SP1 and, so far, no major problems found. Lack of report is a reality but the tool is free. If you want more, wait for WUS, or use SMS or similar, and pay for it. I have deployed XP SP2 on many computers, and most of the failures were due to problems that already existed. Normally, a clean installation of the operating system, followed by SP2, solved the problem. In some cases is the hardware that is not supported (check HCL), and replacement is the only solution. For those who post some questions like "How do I fix this...", my advise is: get educated, or consult an educated computer speciallist. When you are ill, you consult a physician (medical doctor). Right? For those who blame Microsoft, "Billy" Gates (strange, no one blames Steve Balmer, here my advice: use other operating systems, products, what ever. You have no obligation to use Microsoft. Feel free to design a brand new operating system, or productivity suite, and make it free for the world. Fernando Costa Portugal

Boy, some of the comments posted above are paranoid as hell. For those that distrust BITS and SP2, all I can say is that if you deploy ANY software into your production environment without testing it in a lab first, you are asking for trouble. That's just common sense. Run network packet sniffers to see what traffic is going on behind the scenes. Test on every configuration you have at your disposal. I do it and I've never had a problem with SP2 or BITS.

I agree. Anyone whining about what SP2 did to their production environment should have tested it first in an isolated (non-production) environment. If you don't have that luxury, get it or insist on NOT deploying the software.

dears, excuse me my English. I did install wus in new win2k sp4. I install IIS, but didn't creat a new web site. I am not obtaining to bring update/synchronise server. Thanks

NUNO CACHINHO - This is a very usefull program. i have it in my company since may 2003 and this is working fine...all pc (150) ara conected and every thing is ok. you can search to get report for use with SUS...find in Web... regard's from POrtugal

Well, MS still has no grip on the situation. Debian GNU/Linux has the worldfamous "apt-get" packet management system that *works* withiut restarts. For free. I stay with my plan replace XP with Debian GNU/Linux Sarge.

WUS seems to be working great! We're using it in a test environment with 2K and XP and only see 2 problems. Some updates repetively try to install after installing, and sometimes the agent fails to report the update status to our WUS server. Other than that, it's awesome! We have a little over 100 clients, can't wait for the final release of WUS!

Oh blind people, continue trusting in the wolf with sheep skin, you will be more controlled every day, and your data will be collected without you know it. Remember: information=power=money Long life to Open Source!!!

Open Source Blows and if all you linux ass jockies knew anything about Windows you'd be sayin' the same thing. Short life to Open Source!!!

An anon user said: "Open Source Blows and if all you linux ass jockies knew anything about Windows you'd be sayin' the same thing." But without making any points to back it up. I'm an old grey haired systems weenie who's supported everything from Multics to XP, and I use no Windows on my home network because I can trust the standards compliance of the Mac and the Linux machines, and I'm clueful enough to do real integration without the behind-the-scenes garrulous promiscuity of Windows.

I've read through the posts that are making on here and I've come to the following conclusions: 1. It appears that most of you are working as some sort of systems administrator. 2. You haven't read the documentation completely otherwise you'd be removing your statements. 3. If you are a system administrator. Quit whinning about the lack of reporting and write an app or script to parse the log files on \\ServerName\c$\WINNT\system32\LogFiles\W3SVC1. It's so simple...well...for the ones of us that use our brains. 4. If you can't deploy more than 500 systems. You've obviously got shotty equipment, low bandwidth or lack of configuration skills. All of which is not Microsofts fault. Blame yourself.

I totally agree! People should read the directions before making asses out of themselves.

Amen, brother. My SUS has worked wonderfully from the start, I did read before deploying and was aware of the hicupps before hand. Perfection is possible with windows and I have had Servers running for 5+ years without a problem, and I have them customized to the hilt and they are with latest SP and Patches! Smooth running puppies!

Hallo, I am a student from Germany and I have to answer some questions for the wus server. 1. How does the updates will be assign? 2. Can I remove the updates from the clients (uninstall) and how ?

To deploy SUS without Admin rights, you can utilize VBScript and use your own admin rights. The script modifies the Registry. Here it is: Sub WU 'WScript.Echo strComputer Const HKEY_LOCAL_MACHINE = &H80000002 On Error REsume next Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") 'Set objShell = WScript.CreateObject("WScript.Shell") '*****Creates two keys and two REG_SZ values***** strKeyPath="SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" strKeyPath2="SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" objReg.CreateKey HKEY_LOCAL_MACHINE, strKeyPath objReg.CreateKey HKEY_LOCAL_MACHINE, strKeyPath2 '******Creates 7 DWORD entries and values strEntryNameUPD="NoAutoUpdate" '1 strdwUPD=0 strEntryNameOpt="AUOptions" '2 strdwOPT=4 strAIMU="AutoInstallMinorUpdates" '8 strdwAIMU=1 strDF="DetectionFrequency" '9 strdwDF=22 StrDFE="DetectionFrequencyEnabled" '10 strdwDFE=1 strRRT="RebootRelaunchTimeout" '11 strdwRRT=30 strRRTE="RebootRelaunchTimeoutEnabled" '12 strdwRRTE=1 strRWTE="RescheduleWaitTimeEnabled" '13 strdwRWTE=1 strEntryNameDAY="ScheduledInstallDay" '3 strdwDAY=0 strEntryNameTIME="ScheduledInstallTime" '4 strdwTIME=3 strEntryNameUSE="UseWUServer" '5 strdwUSE=1 strNoReboot="NoAutoRebootWithLoggedOnUsers" '6 strdwNoReboot=1 strResched="RescheduleWaitTime" '7 strdwReSched=5 '***Server values***** 'Rgsize strEntryNameWUServer="WUServer" strValueWUServer="http://Netbiosnamehere" strEntryNameWUStatus="WUStatusServer" strValueWUStatus="http://Netbiosnamehere" strEntryTarget="TargetGroup" strvalueTarget="Admin PCs" ' Reg dword strEntryTE="TargetGroupEnabled" strValueTE=0 objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strEntryNameUPD, strDWUPD objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strEntryNameOpt, strDWOpt objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strEntryNameDAY, strDWDAY objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strEntryNameTIME, strDWTIME objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strEntryNameUSE, strDWUSE objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strNoReboot, strdwNoReboot objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strResched, strdwReSched objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strAIMU, strDWAIMU objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strDF, strDWDF objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strDFE, strDWDFE objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strRRT, strDWRRT objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strRRTE, strDWRRTE objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath2, strRWTE, strDWRWTE objReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strEntryNameWUServer, strValueWUServer objReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strEntryNameWUStatus, strValueWUStatus ' commented out objReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strEntryTarget, strValueTarget ' commented out objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strEntryTE, strValueTE End Sub Const ForReading = 1 Set objDictionary = CreateObject("Scripting.Dictionary") 'for Netbios names Set objDictionary1 = CreateObject("Scripting.Dictionary") 'for Netbios not active Set objFSO = CreateObject("Scripting.FileSystemObject") 'to open Netbios.txt Set objTextFile=objFSO.OpenTextFile("L:\vbscripts\netview\netbiosmaster.csv", ForReading) 'creating object Set objTextFile1=objFSO.CreatetextFile("NOtOn.txt", 2) 'txt file of PC not on n=0 i=0 Do While objTextFile.AtEndOfStream <> True strNextLine=objTextFile.ReadLine STRNextLine=trim(strNextLine) objDictionary.Add i, strNextLine i=i+1 Loop objTextFile.Close '***Steps through the array/dictionary For each objItem in objDictionary StrComputer= objDictionary.Item(objItem) '***Pings PC to see if Active '*** if not active writes to a text file. Set objFSO = WScript.CreateObject("Scripting.FileSystemObject") Set objShell= Wscript.CreateObject("Wscript.Shell") objName=objFSO.GEtTempName objTempFile=objName strCommand= "cmd /c ping.exe -n 3 -w 1000 " & strComputer &" > " & objTempFile objshell=objShell.run (strCommand, 0, True) Set objTextFile=objFSO.OpenTextFile(objTempFile, 1) Do While objTextFile.AtEndOfStream <> true strText=objTextFile.ReadLine 'WScript.Echo strText Temp=Instr(strText, "Reply") If Temp > 0 Then '***Call Windows Update Subroutine WU 'edit registry p=p+1 'computers that are on(could ping) Exit Do Else if Instr(strText, "could not find") Then n=N+1 ' Computer that are off objDictionary1.Add n, strComputer o=o+1 Else if Instr(strText, "timed") Then n=N+1 ' Computer that are off objDictionary1.Add n, strComputer End if End if End if Loop objTextFile.Close objFSO.DeleteFile(objTempFile) Next For Each objItem in ObjDictionary1 Templine= Templine & vbcrlf & objDictionary1.Item(objItem) Next objTextFile1.Write Templine objTextFile1.Close WScript.Echo p & " computers configured!!" WScript.Echo o & " Computers could not be pinged!!" You will need a text file called netbios.txt with all of the PCs you would like to configure for WUS

Just installed WUS with SMS 2003 on the same server, planning on retiring the collections from SMS, and only do inventory and hardware checking. I'm betting on WUS to keep my pc's up to date. Congratulations to the MS Team!

We've been using WUS B2 for a while. Basically it works, but man is it a pain to troubleshoot and manage. It is better than SUS, but it needs to get a lot better before RTM.

So how does WUS work in a disconnected environment? Can you control when a client downloads patches and when it applies those patches? Can you supress reboots? It looks to me like your idea of "What you need to know about Windows Update Services" is limited to the information Microsoft chooses to put in their press releases. Simply regurgitating Microsoft marketing hype and passing it off as your own research really does your readers a huge dis-service. How about a critical, in-depth analysis of the product next time?

Any idea on when WUS is being released? Seems nothing much is happening about it at the moment

I am using WUS beta on 2003Server. I can't seem to figure out how to get the "status of updades" report to refresh. The only time it refreshes is when a new client is found and added to the computer group. I have tried wuauclt.exe /detectnow without any results. Please help

I cannot get any computers to show up in the list of computers to add to WUS. Any ideas?

There are no computers to view in the WUS Computers View. Also getting an event ID 30. The server was unable to read the file C:\Program Files\Microsoft Windows Update Services\Administration\errors\AccessDenied.htm. The file does not exist. PLEASE HELP!!!

Firstly - Paul - Good article... WUS does look great... we ARE having teething probs but its a beta so expect nothing else. As for some of these guys and gals posting questions here... it makes me wonder... if they are running IT departments... God help us!

Interesting read Paul. Adding to the last person's comment. How does this help out those who are legitimately wanting to know answers to their questions apart from raise your ego that you are running an IT Dept.

For people looking for help with WUS Beta MS have a support newsgroup which can be found here. http://www.microsoft.com/windowsserversystem/wus/newsgroup.mspx

To add even further to the last person's comments ... have you read some of the comments on this site? I wouldn't let these people loose with the remote control for my telly. Someone couldn't get his Hotmail account to work! Forget WUS, lets just pan the muppets.

Anybody Know a final Relase date for WUS. Microsoft keeps saying first half of 2005 but nothing concrete at this time?

Been a while since I last visited... To add even further to the last person's comment. You obviously have Foxtel and express difficulty in using the remote..?

Hi Everyone, I was wondering is WUS compatible with Small Business Server 2003..? Has anyone installed WUS onto SBS 03..? Are there any problems associated..? Regards, Lone Ranger