Most efficient way to install security updates in a Domain?

fonestar1978

Hi,

I'm not sure I am clear on this topic. What is generally considered the best way to install security updates or just updates in general on a Domain? I am trying to make sense of several examples and different people's instructions.

Would it be to install a new template in a shared folder of a DC?


Thanks!

OoteR

I just use WSUS on a non-DC server, and set policies to different groups of machines to pull updates at different times... Using WSUS I can approve updates etc as they come in and apply when I want to.

rwwest7

-Set up a WSUS server
-Set a GPO to point all your domain clients to your WSUS server instead of the windows update website.
-Done

After that the pain in the but is remembering to approve updates. Also you need to decide if you want to force a download and install, just download and notify, or just notify.

rwwest7

fonestar1978 wrote: »

Hi,

I'm not sure I am clear on this topic. What is generally considered the best way to install security updates or just updates in general on a Domain? I am trying to make sense of several examples and different people's instructions.

Would it be to install a new template in a shared folder of a DC?


Thanks!

I think you're think of security templates. Are you talking about windows updates or configuring security? Either way Group Policy is your answer.

phoeneous

rwwest7 wrote: »

I think you're think of security templates. Are you talking about windows updates or configuring security? Either way Group Policy is your answer.

Bingo. You can create group policy for either wsus or security templates.

Hyper-Me

rwwest7 wrote: »

-Set up a WSUS server
-Set a GPO to point all your domain clients to your WSUS server instead of the windows update website.
-Done

After that the pain in the but is remembering to approve updates. Also you need to decide if you want to force a download and install, just download and notify, or just notify.

I found it handy to set WSUS to email me whenever new updates were synchronized. That elminiated me checking it every couple of days (or forgetting altogether).