Microsoft provides several techniques for applying
updates:
-
Directly from Microsoft For
home users and small businesses, Windows 7 is configured to
retrieve updates directly from Microsoft automatically. This
method is suitable only for smaller networks with fewer than 50
computers.
-
Windows Server Update Services
(WSUS) WSUS enables administrators to approve updates
before distributing them to computers on an intranet. If you want,
updates can be stored and retrieved from a central location on the
local network, reducing Internet usage when downloading updates.
This approach requires at least one infrastructure server.
-
Microsoft Systems Center Configuration Manager 2007
(Configuration Manager 2007) The preferred method for distributing software and
updates in large, enterprise networks, Configuration Manager 2007
provides highly customizable, centralized control over update
deployment, with the ability to audit and inventory client
systems. Configuration Manager 2007 typically requires several
infrastructure servers.
The sections that follow describe the Windows Update client,
WSUS, and Configuration Manager 2007.
Whether you download updates from Microsoft or use WSUS, the
Windows Update client is responsible for downloading and installing
updates on computers running Windows 7 and Windows Vista. The
Windows Update client replaces the Automatic Updates client
available in earlier versions of Windows. Both Windows Update in
Windows 7 and Automatic Updates in earlier versions of Windows
operate the same way: they download and install updates from
Microsoft or an internal WSUS server. Both clients install updates
at a scheduled time and automatically restart the computer if
necessary. If the computer is turned off at that time, the updates
can be installed as soon as the computer is turned on.
Alternatively, Windows Update can wake a computer from sleep and
install the updates at the specified time if the computer hardware
supports it.
The Windows Update client provides for a great deal of control
over its behavior. You can configure individual computers by using
the Control Panel\System And Security\Windows Update\Change Settings
page. Networks that use Active Directory Domain Services (AD DS)
can specify the configuration of each Windows Update client by using
Group Policy.
After the Windows Update client downloads updates, the client
checks the digital signature and the Secure Hash Algorithm (SHA1)
hash on the updates to verify that they have not been modified after
they were signed by Microsoft. This helps mitigate the risk of an
attacker either creating malware that impersonates an update or
modifying an update to add malicious code.
Windows Server Update Services
WSUS is a version of the Microsoft Update service that you can
host on your private network. WSUS connects to the Microsoft Update
site, downloads information about available updates, and adds them
to a list of updates that require administrative approval.
After an administrator approves and prioritizes these updates,
WSUS automatically makes them available to any computer running
Windows Update (or the Automatic Updates client on earlier versions
of Windows). Windows Update (when properly configured) then checks
the WSUS server and automatically downloads and installs updates as
configured by the administrators. As shown in Figure 1 you can
distribute WSUS across multiple servers and locations to scale to
enterprise needs. WSUS meets the needs of medium-size organizations
and many enterprises.
You must install WSUS on at least one infrastructure server,
such as a computer running Windows Server 2003, Windows Server 2008,
or Windows Server 2008 R2. To deploy updates to computers running
Windows 7, you must have WSUS 3.0 SP2 or later installed on your
server.
Note
MORE INFO WSUS
For more information about update
management with WSUS, visit http://www.microsoft.com/wsus/.
Configuration Manager 2007
Configuration Manager 2007 is a tool for efficiently managing,
distributing, and inventorying software in enterprise environments.
Although WSUS is sufficient to meet the needs of medium-size
organizations, Configuration Manager 2007 can supplement WSUS in
enterprise organizations that manage hundreds or thousands of
computers.
Tip
TIP
You definitely won't need to know how
to use Configuration Manager 2007 for the exam, but it wouldn't
hurt to be familiar with what it can do. For more information
about Configuration Manager 2007, visit the Configuration Manager
2007 Web site at http://www.microsoft.com/sccm.
