[THIN] Re: M$ Patching...

Question, does WSUS use the BITS technology that SUS does?  I ask
because...I can tell WSUS to roll patches at 6PM, but depending on traffic
and such, they may not roll until 9PM, and the reboot happened at 7PM, so I
am back in the same boat?  Patches with no reboot.

I am wondering if anyone else, with 24x7 shops, in large environments
handles this new situation. 

-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf
Of Evan Mann
Sent: Tuesday, August 23, 2005 12:02 PM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: M$ Patching...

There has been a large discussion on the WSUS list maintained via
patchmanagement.org about handling servers for reoobts.  Unfortunately, that
list is not available in an archive, but from many of the posts I read, it
seemed that most people still prefer to patch servers by hand, even those
with a large quantity. 

Everyone advocated testing patches first before installing them to avoid any
obvious BSOD's or lockups, but not everyone has the hardware or time to do
that.

Those who used an automated system seemed to schedule the approved updates
to install and then had pre-set windows to reboot.  Many still advocated
doing this manually, but people also did it automatically and would just
verify the server came back up and was working properly.
WSUS does not provide scheduled rebooting features, but most aftermarket
patch management products do.





-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf
Of Christopher Wilson
Sent: Tuesday, August 23, 2005 12:56 PM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: M$ Patching...

Latest implementation of WSUS allows you to assign client computers into
groups.  You have the option to approve patches for some collections of
computers and not others.  This would allow you to push patches to Citrix
servers on a separate timeline from the rest of the servers.
Similarly, if you have all your Citrix boxes in their own OUs, you can use
group policy to specify when the windows update
reboots take place.   Approve new patches on Sunday afternoon and
reboot Sunday evening.

Maybe that's an alternative...

hth,

CW

On 8/23/05, Schneider, Chad M <CMSchneider@xxxxxxxxx> wrote:
> ....but there will be some user interruption...Mon. night...maybe 
> again on Wed. night.
> 
> Those I have discussed with management, and they just are not an 
> option in our environment.  Rather have a single 1 hours window, once 
> a week, than scattered outages throughout the week.
> 
> -----Original Message-----
> From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On 
> Behalf Of Joe Shonk
> Sent: Tuesday, August 23, 2005 11:18 AM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] Re: M$ Patching...
> 
> The nice thing about rolling reboots is you don't have to do them all 
> in one night.  It can be done anytime during the week without user
interruption.
> 
> Joe
> 
> -----Original Message-----
> From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On 
> Behalf Of Schneider, Chad M
> Sent: Tuesday, August 23, 2005 9:10 AM
> To: 'thin@xxxxxxxxxxxxx'
> Subject: [THIN] Re: M$ Patching...
> 
> We do have a maint. window, Sun. nights...from 7PM-8PM, for Citrix 
> server reboots, a s well as some Database maint., which I am not 
> involved in, but it affects the Citrix applications.
> 
> Trouble with rolling reboots...user is on server 1 of 4 supplying the
apps.
> Server is disabled, users are notified and server is rebooted, in the 
> meantime, user logs onto server 2, same thing happens, users connects 
> to server 3, etc., etc. Potentials to get kicked out of applications 
> and have to log back in several times in a period of time.
> 
> -----Original Message-----
> From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On 
> Behalf Of Joe Shonk
> Sent: Tuesday, August 23, 2005 11:03 AM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] Re: M$ Patching...
> 
> Rolling reboots.... Surely the apps are n+1...  Every org has to allow

> for a maintenance window.
> 
> Joe
> 
> -----Original Message-----
> From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On 
> Behalf Of Schneider, Chad M
> Sent: Tuesday, August 23, 2005 8:54 AM
> To: 'thin@xxxxxxxxxxxxx'
> Subject: [THIN] Re: M$ Patching...
> 
> So my servers and applications would be unavailable for @ 2 hours 
> (5:30PM-7:15PM)....that will not fly.
> 
> -----Original Message-----
> From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On 
> Behalf Of Jeff Pitsch
> Sent: Tuesday, August 23, 2005 10:49 AM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] Re: M$ Patching...
> 
> So script it.  At xPM, disable logins, send messages about servers 
> going down, kick users out, schedule the patch download/install at 
> 5:30.  By 7pm your all set.  Use SUS (Free as in beer) so you can pick

> which patches get applied.
> 
> Jeff
> 
> On 8/23/05, Schneider, Chad M <CMSchneider@xxxxxxxxx> wrote:
> > Yes, we reboot all 70, minus a handful in other time zones, @ 7PM on
Sun.
> > nights.
> > What we had done the last 4 years, is install the patches, during 
> > the week, and wait for the servers to reboot on Sun. night.  Worked 
> > fine for
> years.
> >
> > I manually install the patches, so to try to manually install the 
> > patches, on 70 servers, notifying users, kicking users out, 
> > disabling servers, etc, takes a great deal of time.  In the midst of

> > all of that....any server I patch, until the reboot, will get the 
> > prompt for each
> user's session.
> >
> > -----Original Message-----
> > From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]
> > On Behalf Of Jeff Pitsch
> > Sent: Tuesday, August 23, 2005 10:31 AM
> > To: thin@xxxxxxxxxxxxx
> > Subject: [THIN] Re: M$ Patching...
> >
> > So how do you do it now?  You must have a rolling schedule for the 
> > updates, correct?  I highly doubt your rebooting all 70 servers at 
> > the same time.  It doesn't take that much more time to schedule the 
> > downloads around the reboot times for the servers.  What if the 
> > updates require an update to HKCU?  how do you take care of that?
> >
> > Jeff Pitsch
> >
> > On 8/23/05, Schneider, Chad M <CMSchneider@xxxxxxxxx> wrote:
> > > 24x7 shop, 250+ applications, 70 servers....I would have to 
> > > schedule weeks of time, off hours, to disable 
> > > servers/applications, install patches, reboot servers, install CTX

> > > patches for the installed M$ patches, reboot again, enable 
> > > servers....would take weeks to complete, if I did nothing else, 
> > > during my evneings/off hours, and M$ patches are released so
frequently, that would be my only job.....
> > >
> > > We do weekly reboots.
> > >
> > > -----Original Message-----
> > > From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]
> > > On Behalf Of Jeff Pitsch
> > > Sent: Tuesday, August 23, 2005 10:18 AM
> > > To: thin@xxxxxxxxxxxxx
> > > Subject: [THIN] Re: M$ Patching...
> > >
> > > Don't do updates until you can reboot the servers?  Don't do 
> > > updates while users are on the servers?
> > >
> > > Jeff
> > >
> > > On 8/23/05, Tasita Ebacher <tebacher@xxxxxxxxxxxxxxxxxxxxx> wrote:
> > > > Jim, I don't think ANY of those GP options solve this issue!
> > > >
> > > > I've been trying to solve this issue for months now!  All my 
> > > > Terminal Services uses get the "Updating your computer is almost

> > > > complete. You must restart your computer for the updates to take

> > > > effect.  Restart now, Restart Later" pop-up with the buttons 
> > > > grayed out so they can't even close the window!
> > > >
> > > > I don't even have "Computer Configuration\Administrative 
> > > > Templates\Windows Components\Windows Update - Do not display 
> > > > Install and Shutdown" in my GP... (isn't this for XP SP2?)
> > > >
> > > > I have "Computer Configuration\Admin Templates\Windows 
> > > > Components\Windows Update - Allow non-administrators to receive 
> > > > update notifications" set to Disabled. This only prevents users 
> > > > from receiving the actual prompts to update windows, not the 
> > > > restart
> prompts.
> > > >
> > > > I have "Computer Configuration\Admin Templates\Windows 
> > > > Components\Windows Update - No auto-restart for scheduled 
> > > > Automatic Updates installations" set to Enabled, which will just

> > > > cause the computer to ask the user to restart rather than just 
> > > > rebooting on it's own.
> > > >
> > > > And, after all this, my users STILL get the reboot-prompt
pop-up.
> > > > So, is there actually a way to prevent this?
> > > >
> > > > Tasita Ebacher
> > > > 702 Communications
> > > > Data Systems Engineer
> > > > CCNA
> > > >
> > > >
> > > > On 23/08/05, Jim Kenzig Kenzig.com <jkenzig@xxxxxxxxx> wrote:
> > > > >
> > > > > Aaaargh is it here?:
> > > > >
> > > > >  The policies are accessed in the Computer 
> > > > > Configuration\Administrative Templates\Windows 
> > > > > Components\Windows Update node of Group Policy Object 
> > > > > Editor.Do not display Install and
> > > > Shutdown option.
> > > > >
> > > > > here?:
> > > > >
> > > > >
> > > > > Computer, Admin Templates, Windows Components, Windows Update.
> > > > >
> > > > > In particular, "Allow non-administrators to receive update
> > > > notifications"
> > > > >
> > > > > or here?
> > > > > Computer Config-> Admin Templates-> Windows Components-> 
> > > > > Windows Update
> > > > >
> > > > > Set "No auto-restart for scheduled Automatic Updates
installations"
> > > > > to
> > > >
> > > > > Enabled
> > > > >
> > > > > Group policy is such a pain in th butt!
> > > > > JK
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >  ________________________________
> > > > >
> > > > > From: thin-bounce@xxxxxxxxxxxxx 
> > > > > [mailto:thin-bounce@xxxxxxxxxxxxx]
> > > > > On Behalf Of Jim Kenzig Kenzig.com
> > > > > Sent: Tuesday, August 23, 2005 8:50 AM
> > > > > To: thin@xxxxxxxxxxxxx
> > > > > Subject: [THIN] Re: M$ Patching...
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Where is this specifically?...I'd like to write an FAQ item on

> > > > > this
> > > > one.
> > > > > We've had the same problem since we went to Windows 2003
Server.
> > > > > So we
> > > >
> > > > > can't be alone.
> > > > > Jim
> > > > >
> > > > > Dogers <dogers@xxxxxxxxx> wrote:
> > > > >
> > > > > You'll want to have a look at the GP options for the update 
> > > > > service
> > > > > - you can force the reboot message not to show for users
> > > > >
> > > > > >
> > > > ********************************************************
> > > > This Weeks Sponsor: triCerat Inc.
> > > > You need Day Zero Protection!
> > > > Get Proactive with triCerat's Simplify Suite.
> > > > Solve printing, security and profile problems before they occur.
> > > > http://www.tricerat.com/?thethintl2
> > > > **********************************************************
> > > > Useful Thin Client Computing Links are available at:
> > > > http://thin.net/links.cfm
> > > > ThinWiki community - Excellent SBC Search Capabilities!
> > > > http://www.thinwiki.com
> > > > ***********************************************************
> > > > For Archives, to Unsubscribe, Subscribe or set Digest or 
> > > > Vacation mode use the below link:
> > > > http://thin.net/citrixlist.cfm
> > > > ********************************************************
> > > > This Weeks Sponsor: triCerat Inc.
> > > > You need Day Zero Protection!
> > > > Get Proactive with triCerat's Simplify Suite.
> > > > Solve printing, security and profile problems before they occur.
> > > > http://www.tricerat.com/?thethintl2
> > > > **********************************************************
> > > > Useful Thin Client Computing Links are available at:
> > > > http://thin.net/links.cfm
> > > > ThinWiki community - Excellent SBC Search Capabilities!
> > > > http://www.thinwiki.com
> > > > ***********************************************************
> > > > For Archives, to Unsubscribe, Subscribe or set Digest or 
> > > > Vacation mode use the below link:
> > > > http://thin.net/citrixlist.cfm
> > > > ********************************************************
> > > > This Weeks Sponsor: triCerat Inc.
> > > > You need Day Zero Protection!
> > > > Get Proactive with triCerat's Simplify Suite.
> > > > Solve printing, security and profile problems before they occur.
> > > > http://www.tricerat.com/?thethintl2
> > > > **********************************************************
> > > > Useful Thin Client Computing Links are available at:
> > > > http://thin.net/links.cfm
> > > > ThinWiki community - Excellent SBC Search Capabilities!
> > > > http://www.thinwiki.com
> > > > ***********************************************************
> > > > For Archives, to Unsubscribe, Subscribe or set Digest or 
> > > > Vacation mode use the below link:
> > > > http://thin.net/citrixlist.cfm
> > > >
> > > ********************************************************
> > > This Weeks Sponsor: triCerat Inc.
> > > You need Day Zero Protection!
> > > Get Proactive with triCerat's Simplify Suite.
> > > Solve printing, security and profile problems before they occur.
> > > http://www.tricerat.com/?thethintl2
> > > **********************************************************
> > > Useful Thin Client Computing Links are available at:
> > > http://thin.net/links.cfm
> > > ThinWiki community - Excellent SBC Search Capabilities!
> > > http://www.thinwiki.com
> > > ***********************************************************
> > > For Archives, to Unsubscribe, Subscribe or set Digest or Vacation 
> > > mode use the below link:
> > > http://thin.net/citrixlist.cfm
> > >
> > > ********************************************************
> > > This Weeks Sponsor: triCerat Inc.
> > > You need Day Zero Protection!
> > > Get Proactive with triCerat's Simplify Suite.
> > > Solve printing, security and profile problems before they occur.
> > > http://www.tricerat.com/?thethintl2
> > > **********************************************************
> > > Useful Thin Client Computing Links are available at:
> > > http://thin.net/links.cfm
> > > ThinWiki community - Excellent SBC Search Capabilities!
> > > http://www.thinwiki.com
> > > ***********************************************************
> > > For Archives, to Unsubscribe, Subscribe or set Digest or Vacation 
> > > mode use the below link:
> > > http://thin.net/citrixlist.cfm
> > >
> > ********************************************************
> > This Weeks Sponsor: triCerat Inc.
> > You need Day Zero Protection!
> > Get Proactive with triCerat's Simplify Suite.
> > Solve printing, security and profile problems before they occur.
> > http://www.tricerat.com/?thethintl2
> > **********************************************************
> > Useful Thin Client Computing Links are available at:
> > http://thin.net/links.cfm
> > ThinWiki community - Excellent SBC Search Capabilities!
> > http://www.thinwiki.com
> > ***********************************************************
> > For Archives, to Unsubscribe, Subscribe or set Digest or Vacation 
> > mode use the below link:
> > http://thin.net/citrixlist.cfm
> >
> > ********************************************************
> > This Weeks Sponsor: triCerat Inc.
> > You need Day Zero Protection!
> > Get Proactive with triCerat's Simplify Suite.
> > Solve printing, security and profile problems before they occur.
> > http://www.tricerat.com/?thethintl2
> > **********************************************************
> > Useful Thin Client Computing Links are available at:
> > http://thin.net/links.cfm
> > ThinWiki community - Excellent SBC Search Capabilities!
> > http://www.thinwiki.com
> > ***********************************************************
> > For Archives, to Unsubscribe, Subscribe or set Digest or Vacation 
> > mode use the below link:
> > http://thin.net/citrixlist.cfm
> >
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
> 
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
> 
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
> 
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
> 
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
> 
> ********************************************************
> This Weeks Sponsor: triCerat Inc.
> You need Day Zero Protection!
> Get Proactive with triCerat's Simplify Suite.
> Solve printing, security and profile problems before they occur.
> http://www.tricerat.com/?thethintl2
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ThinWiki community - Excellent SBC Search Capabilities!
> http://www.thinwiki.com
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode

> use the below link:
> http://thin.net/citrixlist.cfm
>
********************************************************
This Weeks Sponsor: triCerat Inc.
You need Day Zero Protection!
Get Proactive with triCerat's Simplify Suite.
Solve printing, security and profile problems before they occur.
http://www.tricerat.com/?thethintl2
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
ThinWiki community - Excellent SBC Search Capabilities!
http://www.thinwiki.com
***********************************************************
For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use
the below link:
http://thin.net/citrixlist.cfm
********************************************************
This Weeks Sponsor: triCerat Inc.
You need Day Zero Protection!
Get Proactive with triCerat's Simplify Suite.
Solve printing, security and profile problems before they occur.
http://www.tricerat.com/?thethintl2
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
ThinWiki community - Excellent SBC Search Capabilities!
http://www.thinwiki.com
***********************************************************
For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use
the below link:
http://thin.net/citrixlist.cfm

********************************************************
This Weeks Sponsor: triCerat Inc.
You need Day Zero Protection!
Get Proactive with triCerat's Simplify Suite.
Solve printing, security and profile problems before they occur.
http://www.tricerat.com/?thethintl2
********************************************************** 
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
ThinWiki community - Excellent SBC Search Capabilities!
http://www.thinwiki.com
***********************************************************
For Archives, to Unsubscribe, Subscribe or 
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm

Other related posts: