Slashdot Mirror


Deploying Windows Updates?

WinBreak asks: "Well, I guess I'd be an 'IT Administrator' - but I work for a public library. The job consists of baby sitting 20-odd computers. The problem is, as a public library, we don't have much bandwidth - a simple 768K DSL line shared among everyone. It's good enough, for our normal traffic, and when people want to come in and do research (as long as there aren't too many kids on YouTube!). The problem comes when we need to do reformats and installs on machines. Most of our CD's for these machines are XP with Service Pack 1 - though we have a couple with Service Pack 2. For the SP1 CD's, we immediately deploy the SP2 Redistributable. But that still leaves OVER 100MB worth of downloads from Windows Update to go get. Our budget isn't great in the IT department, so spending money is not a great option - but I could sling together a grant proposal if need be. So how do others manage deploying a new install of Windows? Are we really expected to still download 100+MB per reinstall? Is Service Pack 3 on the horizon?" "I've heard of programs that download updates to a server computer and distribute them through the network to clients, but that only worked for files released on Microsoft's Knowledge Base, if I recall correctly - not for all Windows Updates."

122 comments

  1. Make one box a server. by Philip+K+Dickhead · · Score: 4, Informative

    Then install the FREE Windows Software Update Services (WSUS) on it. This becomes your single download point for the patches, and manages a local repository.

    Just download 'em once. The other machines will go there - instead of windowsupdate.microsoft.com.

    You can even schedule yur own times for retreiving and distributing patches, centrally. It might force you to build a domain, if you don't already have one.

    --
    "Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
    1. Re:Make one box a server. by PhilBrut · · Score: 5, Informative

      WSUS doesn't require a domain, but a domain will make it somewhat easier. Basically you need to tell the integrated AU client to talk the WSUS rather than Windows Update, and it comes with an ActiveDirectory GPO template with which to configure the machines. Without a domain you will need to import the registry changes manually. Everything you need to know is in the WSUS documentation. Oh, and WSUS isn't supported under Windows 2000 Pro or Windows XP Pro - that doesn't mean it won't work, but the recommended server platforms are Windows 2000 Server/Advanded Server and Windows Server 2003. Chances are you have at least one Windows server anyways. BTW you should seriously consider something like g4u or unattended (http://unattended.sf.net) for maintaining the machines.

    2. Re:Make one box a server. by DeltaSigma · · Score: 4, Informative

      Indeed, WSUS is the way to go without spending money. It's supported by Microsoft. It sports patches for Windows, Internet Explorer, Windows Media Player, Microsoft Office, and even definition updates for the (still beta) Windows Defender. It's a lot like hosting your own windowsupdate.microsoft.com really. You're given an overview of what patches a computer needs, and what patches WSUS has installed. You can choose to automatically approve certain types of updates. It gives you a lot.

      Requirements are a Windows NT 5.0+ server hosting IIS, and some sort of SQL database. The documentation will reccomend MSDE or MS SQL server. I personally reccomend MSDE.

      Try to remember to patch MSDE before you install WSUS.

      Loading all of this on an internet facing server (outside the firewall) is NOT reccomended (and may violate the license depending on how it's configured).

      Regardless, one should use the Microsoft Baseline Security Analyzer for any IIS server.

      That's the install routine off the top of my head. It actually helps to read the documentation for this particular MS Product. There are tons of helpful tips, such as, disabling languages you don't use (to reduce bandwidth and storage space consumed).

    3. Re:Make one box a server. by LoadWB · · Score: 1

      hehehe I will throw in my "Me, Too!"

      I use WSUS at all of my installations, Small Business Server 2003 and Windows Server 2003. If you do not have MSDE or SQL, WSUS installs the MSDE for you.

      Installation is painless and flawless, though be prepared to spend a weekend letting the machine download updates. Depending upon your installation, you could use 10GB or more storage space. In an environment with Server 2003, SBS2003, Exchange 2003, Windows XP, Office XP and 2003, and Windows Defender, I easily used 13GB. And that is without feature packs and other non-critical updates.

      Supposedly, WSUS will import your existing SUS store, but even following MS's documentation to the letter I have been unsuccessful. After several failures I just gave up and uninstall SUS before installing WSUS.

      A domain *is* helpful because you can push out GPO defining your update settings, but not entirely necessary as you can just manually install registry settings to do the same.

      Have fun!

    4. Re:Make one box a server. by afidel · · Score: 1

      Baseline security analyzer is not needed or support on IIS 6.0 on 2003.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    5. Re:Make one box a server. by toadlife · · Score: 1

      There should be no registry changes involved. The Group policy settings can be set on the client machines by opening up mmc and addings the "local group policy" snap-in. From there, you can add the WSUS settings to each machine.

      As for XP support, I'm pretty sure WSUS will not install on *any* of the desktop OS's.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    6. Re:Make one box a server. by PhilBrut · · Score: 1

      The registry is how the AU ciient knows how to talk to WSUS, the GP templates are the fancy GUI way of doing it.

    7. Re:Make one box a server. by toadlife · · Score: 1

      To clarify, I should have said "there should be no need to edit the registry manually", rather than "there should be no registry changes involved".

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    8. Re:Make one box a server. by SCPRedMage · · Score: 2, Interesting

      I've had WSUS import my SUS stuff successfully not once, but twice. The trick is to wait until AFTER you've "synch'd" it; that is, have it contact MS so that it can grab all the patch metadata, then you import the approvals and executables. WSUS is different enough from SUS that the data SUS has on patches isn't enough, so it needs to contact a WSUS server in order to know about the patches... THEN it can accept the SUS data.

      And yeah, everyone's been right on the domain bit; it's REALLY helpful to have one, but you can just create a .reg file and use that to add the settings into all your computers.

      And on my last note, I'd just like to say the main reason I love WSUS is that, unlike SUS, there's a command you can give ("wuauclt /detectnow") that causes the Automatic Updates client to contact the update server and detect updates right then and there, whereas with the SUS version of the AU client, you had to use clever registry hacks to fool it into thinking at had already started one and needed to resume it. Seems like a trivial thing, but it REALLY helps when building a new system...

      --
      My sig can beat up your sig.
    9. Re:Make one box a server. by SCPRedMage · · Score: 2, Informative

      Oh, and I should have thrown this in there...

      Yeah, WSUS's patch store can take up a HUGE amount of space, but there are two things you can do about it...

      The first is that you can narrow the kinds of patches you're downloading. If you're not running Exchange 2000 or Office XP, well then there's no reason to download those patch, now is there? What's more is that you can restrict the kinds of patches it'll download; whereas SUS only handled critical updates and security updates, WSUS runs the whole gamut; you can easily tell it to only get the stuff that'll keep your systems safe.

      The second is that you can tell the WSUS server not to download patches until a client actually needs them. This way you don't end up with a huge library of patches no one ever needs; saves LOTS of space, trust me.

      --
      My sig can beat up your sig.
    10. Re:Make one box a server. by toadlife · · Score: 1

      ...""wuauclt /detectnow:...

      Thank you. I never caught that when we updated to WSUS, and still thought you had to use the registry hack to get clients to check for updates.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    11. Re:Make one box a server. by sharkey · · Score: 1

      If WSUS will support it, use MS SQL 2005 Express. It's the replacement for the "free" database product (MSDE) from Microsoft.

      --

      --
      "Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
    12. Re:Make one box a server. by Jaseoldboss · · Score: 1

      Daft question but how does it integrate with WGA? Presumably the PCs 'need' to have their licence status checked?

    13. Re:Make one box a server. by SCPRedMage · · Score: 1

      My apologies on the long turn around on this...

      WGA creeps in as an update; as of yet, M$ has yet to begin pushing it through WSUS, which means as long as your systems are pointing to a WSUS server, the only way they could ever get them is if they were to go the the Windows Update website and install it from there. For the record, in a domain environment, you can disable access to that website, too.

      If M$ ever DOES begin pushing WGA through WSUS, it will appear as an update, just like any other; while you CAN tell WSUS to automatically approve updates for installation, if WGA is something that you're wary of, you might want to approve manually, instead. In addition, WSUS does not recognize WGA in any way, so even if you DO have systems that fail the WGA test, WSUS will continue to service them without skipping a beat.

      --
      My sig can beat up your sig.
    14. Re:Make one box a server. by Jaseoldboss · · Score: 1

      It's ok, email notifications are set ;-)

      I thought it would be difficult for them to delegate checking of licence keys to WSUS boxes as it must be a pretty big database over at redmond!

  2. download once by jrl87 · · Score: 1

    You could just download the stad-alone sp2 installer and put it on a cd and use that every time.

    1. Re:download once by stevo3232 · · Score: 1

      He's already using the standalone SP2 installer. He's talking about all of the stuff that was released /after/ SP2.

      --
      s.clementmonkey@sympatico.ca, remove the 'monkey'.
    2. Re:download once by tomhudson · · Score: 2, Informative
      So do like everyone else does - use AuoPatcher, and avoid Microsoft's WGA spyware.

      http://autopatcher.com/

    3. Re:download once by secolactico · · Score: 4, Insightful

      So, instead of MS' spyware, I have to trust some third party's executable software?

      Don't get me wrong, autopatcher is a great idea and as far as I know there's nothing wrong with it, but seeing as their page is still under construction and I've never heard of them before, I'll abstain from using them except in a testing environment.

      --
      No sig
    4. Re:download once by tomhudson · · Score: 2, Informative

      They've been around for a couple of years now ... its - as they say - "The new site is under construction" Neowin's been around since 2000.

      Look at the page views in the forums http://www.neowin.net/forum/index.php?showforum=89

      Yesterday's "AutoPatcher XP June 2006" announcement http://www.neowin.net/forum/index.php?s=cb19fcf468 bcd977d13b309c7a176c4d&showtopic=471109 already has over 150,000 reads.

      Or do a search here on slashdot for comments about autopatcher: http://slashdot.org/search.pl?tid=&query=autopatch er&author=&sort=1&op=comments and read what others have to aay. Lots of people here are already using it.

    5. Re:download once by William-Ely · · Score: 1

      Autopatcher is really good. Basically it's just a GUI that lets you select what updates you want to install and runs the appropriate installer for that update, they don't repackage or modify the updates from MS. I used it a lot when I worked as a PC tech. I burned it onto a CD and took it with me on service calls so I could install updates on clients computers without having to depend on their internet connection. Just my $0.02.

      --
      Mod me down with all of your hatred, and your journey towards the dark side will be complete!
  3. How about... by kinzillah · · Score: 1

    You make a HD image and use ghost or similar to deploy it?

    --
    Douglas P. Price
    1. Re:How about... by lanswitch · · Score: 1

      Norton Ghost is the easiest and fastest way to support a small number of computers. You could then protect them against lusers by using DeepFreeze (http://www.faronics.com/canada/deepfreeze.asp).

  4. SP3 by Curtman · · Score: 4, Funny
    Is Service Pack 3 on the horizon?


    Yeah it's called "Vista".
    1. Re:SP3 by dhalsim2 · · Score: 2, Informative
      Is Service Pack 3 on the horizon?

      XP SP3 won't come out until 07H2: http://news.com.com/Microsoft+XP+SP3+wont+arrive+u ntil+07/2100-1016_3-6027741.html

      They don't want SP3 to distract people from Vista, so they scheduled it for WAY after Vista launch.
  5. Imaging Software by smvp6459 · · Score: 2, Interesting

    Have you ever considered using imaging software to deploy one image to all the machines (if they're identical) or create individual images for each machine (if they're different)? Norton/Symantec Ghost, Acronis True Image, or g4u (Ghost for Unix) if you're looking for an OSS solution.

    There's also software out there that can lock down XP, keeping any changes from becoming permanent...I used a program called DeepFreeze to minimize maintenanc on an 12 computer lab I ran.

    Reinstalling Windows from scratch is a little inefficient compared to imaging or locking down the machines.

    1. Re:Imaging Software by tomasvilda · · Score: 2, Informative

      You can even create one image using Acronis True Image and then restore to different machines using Acronis True Image with Universal Restore plugin, that reconfigures original image to match machine you are restoring.

    2. Re:Imaging Software by lazyevil · · Score: 1


      Personally, I'm a linux guy. But when I've got to image windows, I use their sysprep tools from the resource kit cd's, and then use ntfsclone from the ntfsprogs package to do the actual backup and restore.

      Conceptually, the whole thing is easy. Sysprep removes the windows registry identification, device map, and just redetects them upon first boot. However, theres a few steps you'll need to do after restoring from sysprep, but you can automate them. Things like having a random hostname generated for you. OK, not the best - so I make cygwin part of the image, and hack up some bash script to do a reverse DNS lookup on the localhost IP (from static MAC based DHCP lease), and have it rename itself using the netdom tools. Agh... oh yeah, so you pretty much need cygwin to automate your imaging process if you're going to use sysprep. Given enough time you can make it smo~oth, but you gotta sit down and hack it.

      And if this was linux, I'd say use SIS.

      --
      RTFM, cause bitches love dat shit.

    3. Re:Imaging Software by rikkards · · Score: 1

      One thing I found you can do is include an * at the end of the workstation name for that part of the sysprep.inf , this will stop the automated section so you can plunk in the name as it is considered an invalid character. Everything else will still apply as expected. You can't do it through the gui setup tool, you have to open the file and manually input it.

  6. Slipstream the hotfixes. by BobSixtyFour · · Score: 2, Informative

    Slipstream both the hotfixes and the service pack 2 onto the cd. It's possible. If not, get at least the sp2, it'll save you time when patching (sp2 takes awhile to install, especially on older machines)

    1. Re:Slipstream the hotfixes. by VGPowerlord · · Score: 1

      I've also found out the hard way that Windows XP original edition won't install on some newer PCs, even those with HDs smaller than 137GB.

      The Windows XP installer kept bombing with either protection errors or divide by zero errors (I can't remember which) until I used another computer to create a slipstreamed copy of XP with SP2.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
    2. Re:Slipstream the hotfixes. by michelcultivo · · Score: 1

      You can make a new install CD with the lastest service packs, hotfixes and patches: http://www.extremeoverclocking.com/articles/guides /Windows-Slipstream-Guide_1.html

      Originally introduced with Microsoft's Windows 2000 operating system, the ability to integrate service packs and hotfixes into the initial installation of the operating system became known as "slipstreaming". The process of slipstreaming a service pack or hotfix is nearly identical for Windows 2000, Windows XP, and Windows 2003. In fact, when a service pack is released the Retail / OEM Windows CDs eventually get shipped with the integrated update.

    3. Re:Slipstream the hotfixes. by baadger · · Score: 1

      Weren't Microsoft releasing monthly or quarterly service pack-like roll-up's? I can't find the link atm...

  7. Multiple concepts to be considered. by khasim · · Score: 1

    #1. Getting a clean install onto the machine(s).

    #2. Keeping the clean install updated.

    #3. Keeping unauthorized software off of the clean, updated install(s).

    If you don't have all three, you'll be running through the processes again and again and again.

    #1. This is the easy part. To save time, take an image of the machine(s) after you've finished.

    #2. You can download any patch from Microsoft for "network deployment" so your bandwidth won't really matter. Just start the download process when you're closing up the library.

    #3. Group policies or 3rd party software that returns the machine to a pristine state (and every time you make a mistake, you can use that image you created in step #1).

  8. If all most of them are doing is surfing the net . by tomhudson · · Score: 0, Offtopic

    (since someone has to say it ...)

    If most of those computers are "pubic access" to surf the net and check webmail, just dump Windows for any one of the major linux distros. Cheaper, easier to maintain, less prone to malware. SuSE also lets you create local repositories for updates, so you can just download them once and roll them out.

  9. Is this really a problem? by David+E.+Smith · · Score: 4, Informative

    There are a multitude of ways around this.

    Ghost the machines, and keep your images updated every couple of months.

    Make a slipstreamed CD that includes all the current updates. This is a dead-simple way to do so..

    If your network were bigger, you could use WSUS to keep a local repository of all the updates, so you're just downloading them once, and the WSUS server hands them out to all your local computers.

    1. Re:Is this really a problem? by baadger · · Score: 2, Informative

      Theres no reason to go download third party patch sets when you can get all the hotfixes you need in one go from Microsoft. They update the images monthly.

    2. Re:Is this really a problem? by David+E.+Smith · · Score: 1

      True, but the third-party link I provided integrates all the patches directly into the installation process. Instead of installing Windows, then installing patches, you just install Windows and all the patches are already there. It's a bit quicker. If you're not doing this sort of thing very often, it's probably okay, but if you're wiping machines more than once a week, I'd say the integration is worthwhile.

  10. nLite by corychristison · · Score: 4, Informative

    Check out nLite. It's an easy interface to create slipstreamed discs.

    They also offer a bunch of packages (called "Addons") you can embed into this disc, as well: Java, Firefox, AVG Antivirus, WinRAR, etc.

    Every month or two I will make a new disc for installs [for customers/friends]. The unattended mode is very handy. ;-)

  11. Save the patches on your server by alanjstr · · Score: 3, Insightful

    Why do you keep downloading them? Why not keep them in a central location? Put them on a server, or burn them to disc.

    1. Re:Save the patches on your server by larien · · Score: 1

      1. MS do their damndest to make it difficult to find & download the patches 2. That doesn't integrate into Windows update, so you'd have to go round all the PCs manually applying hotfixes.

  12. Image disk and WSUS by hrbrmstr · · Score: 3, Informative

    Well, for starters, you should be making an image installation disk for your fresh installs that incorporates (or, in MS terms - "slipstreams") what you need into it. This is especially handy if you don't have the same hardware. Check out nLite - http://www.nliteos.com/nlite.html - for more details on how easy it can be to do this. This saves hours of time. Days, if you have tons of boxes to refresh.

    Next you'll need a WSUS - http://www.microsoft.com/windowsserversystem/updat eservices/default.mspx - box somewhere on your network which will take care of those monthly downloads for you and only do the heavy download lifting on one machine. You'll need to configure all your other boxes via group policy or registry hacks to point to this server instead of the mothership @ Microsoft so they can get the updates from there.

    With these two steps, you'll free up bandwidth and have more time to hit the stacks!

    --
    Mind the gap...
  13. Those links may help by ChatHuant · · Score: 1

    Slipstream SP2
    Slipstream security updates as well
    Or get updates as ISO images and burn your own CDs

  14. SUS is what you want by Redhawk · · Score: 2, Informative

    SUS is tailor-made for the situation you're talking about. Assuming you've got a domain in your library, put a proposal together to get another box, throw a flavor of Server 2K3 on it, and get SUS. SUS will synch to the Windows Update site, so anything available there will be available to you internally. Then you approve the patches you want to push, and Bob's your uncle.

    Assuming you can get the approval for the server + software bits, you'll achieve what it is you're trying to do - not soak your 'Net connection and still keep a reasonable level of patchedness for your lab machines.

    Redhawk

    PS - If you're not on a domain, then SUS likely won't fly for you, as it ties into Active Directory and all those goodies.

    1. Re:SUS is what you want by snuf23 · · Score: 3, Informative

      SUS got turned into WSUS (Windows Server Update Services). WSUS is much better than SUS was and now supports Office and Exchange updates as well as Windows.
      It can work even if you don't have a domain, you just need to make a registry change in the client computers rather than a GPO.

      --
      Sometimes my arms bend back.
  15. Autopatcher by crvtec · · Score: 3, Informative

    You could also try AutoPatcher for Post SP2 updates. http://www.autopatcher.com/

    1. Re:Autopatcher by ermannob · · Score: 1

      Autopatcher is definetly THE solution, specially when you deal with different machines (and Ghost images aren't useful). 15/20 minutes and you're done. I use Autopatcher regularly when a new pc is going out of my shop. And no WGA required!

    2. Re:Autopatcher by Anonymous Coward · · Score: 0

      I have used Autopatcher since I think when it came out. It does a pretty good job and you can extend it to include "modules" like the Firefox browser maybe an anti-virus program (basically things you would install on a machine afer laying down a fresh XP).

      The autopatcher solution is nice where you have multiple hardware configurations but is mainly used for fresh installations. They offer full and lite versions and update usually once a month (so sometimes you have to fall back to a previous "Full" month - like current is April - full, May update, June update).

      And it's free.

      The only problem you could possibly run into is what lies in their future due to WGA (Windows Genuine Advanage or We're Getting A**-****** depending upon you POV). Theoretically if Microsoft wanted you to go through ONLY windows update or WSUS then it would make the software pretty much illegal (they have discussed this thoroughly in their forums - coming to the conclusion of we are going to support this until MSoft's lawyers tell us not to).

  16. RyanVM's Windows XP Post-SP2 Update Pack by westlake · · Score: 4, Informative
    RyanVM's Windows XP Post-SP2 Update Pack

    Last updated July 14. About 45 MB with optional add-ons like WMP 10. You'll see a full list of what's included on the front page.

  17. Script the update process. by rowama · · Score: 1

    We use AutoIT extensively (http://www.autoitscript.com/autoit3/). It was originally developed to help with this sort of task, but now it is an extensive Windows, open-source scripting language. I prefer using it from Python via COM interface. We've been able to quickly solve emergent, repetitive IT tasks with this tool.

  18. Slipstream + autopatcher by Lord+Kano · · Score: 0, Redundant

    Slipstreap SP2 onto an install CD, and download the current autopatcher.

    You'll save loads of time, and bandwidth.

    LK

    --
    "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
  19. Re:If all most of them are doing is surfing the ne by Sigma+7 · · Score: 1
    If most of those computers are "pubic access" to surf the net and check webmail, just dump Windows for any one of the major linux distros.


    Library computers are not necessarly browser kiosks.

    Some people use the library computers to do work, which means users expect to read/write MS Word documents. Some of these users don't know how to use anything other than Microsoft Word and would completely panic when forced to use the "forign" OpenOffice.org (unless it is skinned to look no different), and can also panic on very subtle differences between Windows and XWindows.

  20. What software do they use for researching? by bergeron76 · · Score: 1

    If it's just a browser for accessing the web, I'd install linux (running Firefox) on those computers. You can access any research material online in this configuration.

    --
    Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
    1. Re:What software do they use for researching? by ocbwilg · · Score: 1

      If it's just a browser for accessing the web, I'd install linux (running Firefox) on those computers. You can access any research material online in this configuration.

      Brilliant. Now all he needs is a way to simplify and automate the process of downloading and installing OS patches to Windows, which is what he actually asked about (not "which OS and browser should I use"). I would recommend WSUS (as most people who actually addressed his question did). Mainly becuase it's free if you already have a Windows server, it's based on the Windows update technology, is extremely easy and simple to set up, and it deploys updates not just of the OS but also for other Microsoft applications.

      Sure he could switch to Linux. But if he had the skills or desire to build and maintain Linux workstations, he probably would have already thought of that. And even with Linux, you still have to have a method to distribute and install patches to the OS and applications, so you haven't actually solved the root problem.

    2. Re:What software do they use for researching? by bergeron76 · · Score: 0, Troll

      Sure he could switch to Linux... And even with Linux, you still have to have a method to distribute and install patches to the OS and applications, so you haven't actually solved the root problem.

      He wouldn't need a method to install patches/applications. His core applications would "just work" and he wouldn't have to worry about patching/upgrading every day. Using a Linux OS his core system would be fundamentally secure. He could apply updates if desired, but they wouldn't be mandatory to maintain a secure system.

      Either I missed your point, or you just didn't make one.

      --
      Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
    3. Re:What software do they use for researching? by ocbwilg · · Score: 1

      He wouldn't need a method to install patches/applications. His core applications would "just work" and he wouldn't have to worry about patching/upgrading every day. Using a Linux OS his core system would be fundamentally secure. He could apply updates if desired, but they wouldn't be mandatory to maintain a secure system.

      I see that you post has been appropriately modded as a Troll, but I think I'll take the bait anyway. Either you are unfamiliar with Linux, or you are blinded by religious fervor, because Linux and Linux-based applications that are commonly included in distributions DO have security holes that need patched. Such security holes are part of all software, because software is written by humans who make mistakes.

      I don't know if you actually monitor any security mailing lists or web sites, but I see quite a few alerts and advisories about Linux and Linux-based applications. Granted, there is no industry-wide "Linux patch Tuesday" like there is with Windows, and I'm not going to get into which OS has more security patches, but the security holes are still out there. And anyone who thinks that switching from Windows to another operating system (Linux, OSX, or whatever) removes the need to install security patches is only fooling themselves, and probably running an incredibly insecure non-windows machine as well.

  21. Re:If all most of them are doing is surfing the ne by BrokenHalo · · Score: 2, Interesting
    Some people use the library computers to do work, which means users expect to read/write MS Word documents. Some of these users don't know how to use anything other than Microsoft Word and would completely panic when forced to use the "forign" OpenOffice.org

    They're just not that different. If the user is incapacitated by such a small difference in the layout of menus or toolbars, then he's got more problems than any sysadmin is qualified to deal with.

    The grandparent poster is right; there's nothing that legitimate library users do that can't be adequately handled by any reasonably current Linux distro. The myth that Linux can't interact with Windows was blown out of the water years ago, and continuing to repeat it simply generates more heat than light.

  22. Re:If all most of them are doing is surfing the ne by tomhudson · · Score: 1

    Most of the library computers I've heard of are locked down so people can't just "bring their own data" so as to prevent problems with malware.

    BTW: I guess you missed the reference to "pubic access" aka surfing for pr0n on the net :-)

  23. In my lab by nickheart · · Score: 2, Insightful

    i use norton ghost. This is the best thing ever. you simply install windows, activate, install all updates/ drivers, create a pristine ghost image, and let the bugs (in your case public users) loose on it! It's not an expensive investment for your employer, or even you so that you can have some sanity back. That's my suggestion.
    -nick

  24. Microsoft Shared Computer Toolkit by zollman · · Score: 3, Informative

    It won't help you with your updates problem, but to cut down on the number of reinstalls, take a look at the Microsoft Shared Computer Toolkit:

    http://www.microsoft.com/windowsxp/sharedaccess/de fault.mspx

    Like DeepFreeze (mentioned earlier in thread) it blocks any changes made to your systems from committing to disk (they get rolled back at logout or the next reboot) unless the administrator specifically allows them. Also: Free. And designed for libraries and schools specifically.

  25. Slightly related... install a web proxy by Anonymous Coward · · Score: 0

    This would help a bit with your patch issue, but helps with all web traffic.

    If you have a box to spare, install a web proxy (I like squid myself) and configure it with a large (multi-gig) disk cache. This would speed up everybody's web browsing & downloads, since people tend to visit the same sites (cnn, hotmail, espn, etc) often. It also acts as a chokepoint (all web browsing has to go through the proxy) where you can apply security rules & filters if you wanted.

  26. All your answers are here... by symbolset · · Score: 2, Interesting

    This used to frustrate me too. I wrote a longish jounal article with enough detail to do what you want. It's here: http://ask.slashdot.org/~symbolset/journal/134087

    --
    Help stamp out iliturcy.
  27. Linux + VMWare by ToxikFetus · · Score: 1

    What about running the boxes as Linux native and providing Windows support via some virtualization software (i.e. VMWare). It's not like these people are gaming, so performance shouldn't be too much of an issue. As long as windows is confined to its little sandbox, the only reinstall needed is a simple rollback to the original Windows image.

    1. Re:Linux + VMWare by LWATCDR · · Score: 1

      If you want to go that route take a look at qemu and kqemu.
      I just got Vista installed under qemu and running in a window on my Linux desktop.
      Don't know if it a solution but it is interesting.

      --
      See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
  28. Funny you ask this today. by Utopia · · Score: 2, Insightful

    I was slipstreaming post XP SP2 to the Windows SP2 installation.

    There are plenty of references about slipstreaming.


  29. Quick free reimaging. by Anonymous Coward · · Score: 0

    I've been playing with this a bit for a family-support issue (you know how they are). Basically my plan as tested successfully works like this. Install Windows on a box. Get it set up perfectly. In my case also install Linux on the box (SUSE Linux Enterprise Desktop 10 works the best with this new hardware...found all the drivers somehow so yea!). After all of that installing/perfecting I left enough space on the hard drive (or had a second drive, or in your case you could have an external drive that would work via a Knoppix disc via USB/Firewire/whatever) to store the Windows partition in its entirety. I used to need to have the same amount of space as the Windows partition uncompressed plus a bit extra but with a bit of help from bzip2 I have managed to copy the entire partition, bit-by-bit, to the extra partition as a file (partition is just ext2 but could be anything...I prefer having it non-recognizable by Windows just in case somebody gets smart and mounts that mysterious fat32 partition out there).

    The commands I use follow:

    Backup:

    dd if=/dev/hda1 | bzip2 -c > /media/hdb1/hda1.iso.bz2

    Restore:

    bzcat /media/hdb1/hda1.iso.bz2 | dd of=/dev/hda1

    This simply takes essentially a "ghost" of the hard drive and saves it to a file (bit-by-bit) and then later restores it. Adding in bzip2 makes the file compressed. Without compression all of that free space you may have on the Windows partition is treated as used space (0-bits are still bits and we're backing them ALL up).

    All I use to do this is a second hard drive or partition for the backup (sufficient size, ext2 filesystem type) and a Knoppix 5 CD. When I boot Knoppix I just use 'linux 2' because I don't need networking or a GUI to run those two commands. I think I may also have specifically told /media/hdb1 to mount but Knoppix creates the mount point for you.

    This is simple, cheap, and could be scripted if you reworked the Knoppix disc.

    Good luck.

  30. Re:If all most of them are doing is surfing the ne by spagetti_code · · Score: 2, Insightful

    Yeah... good one.

    Let me put your proposal in other terms:

    Me: "My car is running rough."
    You: "Buy another car!"

    How about we make useful proposals to this guy before swapping out
    all his technology.

  31. Why reformat and reinstall at all? by The+MAZZTer · · Score: 1

    My college computer labs use DeepFreeze to restore the HDs to a preset condition on every boot, wiping out installed software, etc. You should consider looking into it, it works fine for them. Only way around it is to not boot from the HD, but from a LiveCD or something (and this can hopefully be stopped through BIOS settings... one of my friends worked around it with a CD and partitioned and dual booted Slackware as an experiment, heh heh heh).

    If you choose to research this, also be sure to research cracking tools, I hear some exist, at least for outdated versions. If DeepFreeze has any sort of trial version, try to install it and see if you can make it uncrackable, if you can, since you're one of the most technically skilled people to try and do it, you might have found something useful in DeepFreeze. :)

    There are probably other software packages too but I'm not too fond of crippling computers so I don't really know too much more about the subject. :)

    1. Re:Why reformat and reinstall at all? by wbren · · Score: 1

      DeepFreeze is quite effective, and I have seen in used in several university computer labs with great success. The only way I found to "crack" it was to guess the password the IT department had set. It allows you to change anything on the computer, but when you reboot it's all clean.

      --
      -William Brendel
  32. I've got a great solution by guruevi · · Score: 1

    It's called Ubuntu. It's real easy, and internally, I share my package directory through NFS. apt-get update && apt-get upgrade and all packages are already there.

    --
    Custom electronics and digital signage for your business: www.evcircuits.com
    1. Re:I've got a great solution by managementboy · · Score: 1

      funny, I was thinking of writing the same comment, but repace Ubuntu with openSuSE... and smart update && smart upgrade.

      Anyone know how to get the sound working in VMware and Windows 98 (don`t tell me google, as I tried it), the device found has no driver that fits... and the SoundBlaster 16 driver does not work :-(

      no Wine is no use, as these are learning CDroms my wife needs for medicine and they require a real Windows 98.

      Thanks SlashSupport!

  33. Re:Windows Update? who uses THAT anymore?? by heinousjay · · Score: 2, Insightful

    It's sad when I trust a completely random website more than my OS vendor.

    Start masturbating, I'm going to feed your troll:

    If you don't have legitimate copies, Microsoft isn't your vendor. You get to sleep in the bed you made.

    --
    Slashdot - where whining about luck is the new way to make the world you want.
  34. Re:If all most of them are doing is surfing the ne by tomhudson · · Score: 2, Interesting

    Hah! Another bad car analogy.

    If your current car has an engine that doesn't run properly, requires a lot of maintenance, and periodic expenditures for a new, buggier engine every few years to that same manufacturer, and someone else is offering you a free new engine, with free upgrades, and the chance to try it, again at no risk, you're going to try it.

    In this case, ther are plenty of live DVD/CDs that give people a chance to kick the tires, so instead of having to throw out the whole "car", you can just replace the engine, free of charge. Because that's what most libraries are looking at over the next 3 years - upgrading both hardware and software (they won't be able to buy XP even if they want it, and Vista won't run on their current hardware), or switching to linux/bsd/whatever.

    XP is the end of the line for Microsoft. Vista is alreasy shaping up to be both a support nightmare (too many versions, too many rewrites, too much hardware required for a decent "user experience", too many features cut, too many intentional holes in the "new security model", too much maintenance, too much money when compared to the competition). Remember, linux live DVDs are already good enugh for libraries and schools and anyone else who wants to surf the web, and they're only going to get better.

  35. In my opinion, delaying SP3 is VERY abusive. by Futurepower(R) · · Score: 4, Insightful

    In my opinion, delaying SP3 is VERY abusive.

    1. Re:In my opinion, delaying SP3 is VERY abusive. by Anonymous Coward · · Score: 0

      I don't really think so. It's trivial to roll your own install CDs with all the current patches, and the longer they delay the release of SP3 for XP, the longer they will support XP.

  36. DeepFreeze or VMware Player? by Mostly+a+lurker · · Score: 1
    The method I have been using is a barebones Linux host running VMware Player with a single Windows/XP VM (with restore to a snapshot after each user session). Of course, this does incur some overhead, but it is convenient using a standard Windows configuration on all kinds of different hardware.

    How much overhead does DeepFreeze imply? What are the opinions of those you who have used both solutions?

    Note that the new version of Xen is also interesting. They claim very low overhead, though it is not clear if this applies to older hardware also or only the new Intel chips that have builtin VM support.

    1. Re:DeepFreeze or VMware Player? by smvp6459 · · Score: 1

      The website for anyone who is interested: http://www.faronics.com/index.asp

      I haven't used it since version 4, but the overhead for DeepFreeze was not at all noticeable. I know there was some small amount of overhead since there were at least two processes associated with the program, however a human couldn't tell any difference between a machine with DeepFreeze versus a machine without it. And these weren't souped up machines...they ran Windows 2000 with an 800mgz Athlon and 256MB of RAM. There's no way they could have run Win2K on VMWare running on X running on a stripped down version of Linux at anywhere near the same speed as native Win2K with DeepFreeze. It's pure speculation since I'm not around them anymore, but I'd guess 50% overhead but someone is welcome to contradict me. In addition, back in the day VMWare licenses would have been cost prohibitive but that's obviously changeing. And with cheap memory and fancy dual and quad core processors, the system overhead cost of using VMWare on top of Linux would be a much smaller portion of the system's resources.

  37. Also see this guide for more detailed instructions by students · · Score: 2, Informative

    Unattended Windows

    This has worked very well for me, excepting that I can't get the latest version of F-Prot antivirus to install automatically. I suspect F-Prot has deliberately broken this feature.

  38. Followed by an equally bad one by toadlife · · Score: 1

    "If your current car has an engine that doesn't run properly, requires a lot of maintenance, and periodic expenditures for a new, buggier engine every few years to that same manufacturer, and someone else is offering you a free new engine, with free upgrades, and the chance to try it, again at no risk, you're going to try it."

    With the caveat that you have to install the engine yourself and there is absolutely no support - unless of course you want to count support as asking your buddy at work who likes to work on cars to help you, and waiting a few days before he has the time.

    "XP is the end of the line for Microsoft. Vista is alreasy shaping up to be both a support nightmare (too many versions, too many rewrites, too much hardware required for a decent "user experience", too many features cut, too many intentional holes in the "new security model", too much maintenance, too much money when compared to the competition). Remember, linux live DVDs are already good enugh for libraries and schools and anyone else who wants to surf the web, and they're only going to get better."

    *yawn* People like you were saying the same things when XP came out. What happened?

    --
    I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    1. Re:Followed by an equally bad one by tomhudson · · Score: 1

      With the caveat that you have to install the engine yourself and there is absolutely no support - unless of course you want to count support as asking your buddy at work who likes to work on cars to help you, and waiting a few days before he has the time.

      Most people who don't get Windows pre-installed have to install it themselves. Also, there is absolutely no support from most resellers after 90 days, and what crap support you get is limited to "oh, you have too many viruses - we'll have to charge you for reformatting and reinstalling."

      Just grab an ubuntu live cd and stick it in the box. No installing, Ditto with Xandros. They both work fine on plain vanilla hardware - and if your hardware isn't plain vanilla, you'll probably have just as many problems with Windows than linux at this point. Oh, wait - that't not true - you won't have to worry about all those Windows viruses.

      *yawn* People like you were saying the same things when XP came out. What happened?

      Well, lets see - linux was harder to install than Windows then, whereas linux is now EASIER to install. That's a big difference.

      Also, office suites for linux weren't genrally available, whereas now they support official standards (ODF) that microsoft is having a hard time with.

      Then there's the whole virus issue - its a safe bet that Vista will be even more prone to malware, given the constant rejuggling its undergone. Microsoft has had to admit to the EC that even they don't really understand their own code any more. NOT a good thing ...

      Add to that the obvious money grab with the different versions of Vista, and no features that make it a "must-have", and Vista is going to be the beginning of the end ...

    2. Re:Followed by an equally bad one by toadlife · · Score: 1

      "Most people who don't get Windows pre-installed have to install it themselves."

      Well yeah, but what eprcentage of people don't get Windows pre-installed? 1%? I don't see your point.

      "Well, lets see - linux was harder to install than Windows then, whereas linux is now EASIER to install. That's a big difference."

      I don't know about that. I remember trying Mandrake back wround the time XP was released and it was extremely easy to install. The problem then was that the applications sucked compared to their Windows equivalents, and of course there was the issue of games. I use FreeBSD as a desktop today, and the situtation with apps is still pretty much the same. *nix desktop apps have gotten better, but apps on the Windows side have too, so there really isn't a compelling reason for average folks to not use Windows. And there is still the issue of games.

      "...its a safe bet that Vista will be even more prone to malware, given the constant rejuggling its undergone."

      That certainly is an opinion. Regardless of how the malware situation is affected by Vista, you are making the big (and common) mistake of assuming that people have security at the top of their list when evaluating an OS or application. For the vasy majoroty of the people, functionality is number one, probably followed by ease of use, cost and then maybe security. An obscure desktop OS like linux has the security and cost angles nailed down, but in the big picture they end up not mattering to 90 out of 100 people. Look at Internet Explorer for example. IE is the most exploited app in the history of computing, yet many people's reason for sticking with it is that "some websites don't work with other browsers". Other's don't even know what a browser is, let alone an operating sytsem.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    3. Re:Followed by an equally bad one by tomhudson · · Score: 2, Insightful

      Well yeah, but what eprcentage of people don't get Windows pre-installed? 1%? I don't see your point.

      The buying market has matured; everyone I know buys from small white-box builders; they don't "get Windows for free".

      The problem then was that the applications sucked compared to their Windows equivalents

      ... whereas nowadays the common applications are "good enough" under linux for most people. Alternatively, they continue to use an older version of, say, Office, because it still does the job for them.

      there was the issue of games.

      Most people don't use their machine primarily for games. For them, even after Microsoft stops selling XP in 2 years, they won't care. The few times they'll want to play a game they'll continue to use their old, outdated, "obsolete" copy.

      you are making the big (and common) mistake of assuming that people have security at the top of their list when evaluating an OS or application

      Other's don't even know what a browser is, let alone an operating sytsem.

      They're a small minority nowadays.

      Back when a computer cost $4,000.00, DOS was $50.00, a very small "added cost" - 1.25%. Fast forward to when a decent computer was $2000, Windows was $75.00, 3.75% - again, a very small "added cost", but creeping up. When Windows 95 came out, a decent computer was still a couple of grand, but now the OS had crept up to $100 - 5%. Still not enough "added pain" to make a real difference. 5 years ago, a decent computer was $1500, and XP Pro was an additional $150 - now 10% of the cost.

      Today, you can slap together a computer that would eat the lunch of anything made 5 years ago for $500.00. XP is an additional 30%. Trow in the cost of a copy of Office, and you can buy a second computer instead. Go retail pricing and its even worse.

      Microsoft has only 2 real profit centers - Windows and Office. Both products are long in the tooth, and it doesn't look like the next version of either is going to be offering any "must have" features. By the time Microsoft tries to force everyone to, by no longer offering XP (January, 2009), linux will be a lot further along than it is now. That's why Vista isthe beginning of the end as far as Windows is concerned. The competition continues to constantly improve, while Microsoft won't be offering much, if anything, new.

      They know this. Hence their recent forays into WGA - to be able to remotely deactivate Windows when its no longer supported. Since they won't be supporting it in 2 years, they'll no longer be giving out activation codes if you have to re-install because of a hardware failure, a virus, or other reason. Of course, there are already ways of getting the latest updates without having to install WGA, and of permanently shutting off registration on naked installs; people who have to legitimately re-install are going to use them, and then say "F.U." to ever buying from Microsoft again.

      We've already seen this happen once - the people who bought Millenium, then asked for a downgrade to Windows 98 because ME was crap, and were refused. How many of these people, who never pirated anything before, are running a pirated copy of XP nowadays because they feel Microsoft shafted them?

      Its going to be the same with the end of XP. Microsofts' activation scheme is going to force them to "turn to the dark side" ... and we all know that "once you go black, you never go back".

      I agree, most people look at things like this:

      1. ease of use (people are lazy)
      2. cost
      3. ... insert any number of other factors ...
      4. somewhere much lower - security

      Ease of use means that they aren't going to upgrade to something that means they have to relearn everything - and XP to Vista is not going to score points in that department. Since they're going to have to re

  39. AutoIt is excellent. by Futurepower(R) · · Score: 1

    AutoIt is excellent. Make sure you get the excellent IDE, also.

    For keyboard macros, use AutoHotkey, a fork from an earlier version of AutoIt.

    Both FREE.

    1. Re:AutoIt is excellent. by rowama · · Score: 1

      Uh oh. Something new to play with. I had not heard of AutoHotkey. Since it is a fork of AutoKey, you can bet I'm going to spend some time with it as it will likely be worth the time.

      Thanks for the tip.

      BTW: I didn't mention one feature of AutoIT we have been enjoying of late. With the geewiz factor, we have been impressing co-workers and bosses. The ability to change the speed at which things happens allows us to show them a slowly automated version of some complex task they were accustommed to doing. The think it's great. Then we max the speed and show 'em again. Blows 'em away every time. We now have roughly 80% of the non-tech people within two buildings of our office, asking us to implement solutions for them.

  40. And? by toadlife · · Score: 1

    Yes, I know how GPO templates work, but the submitter doesn't exectly sound like a seasoned IT pro. I would think the GUI way of doing it would be welcomed for some one who is probably not accustomed to using regedit and/or the reg command.

    --
    I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
  41. Re:If all most of them are doing is surfing the ne by Sigma+7 · · Score: 1
    If the user is incapacitated by such a small difference in the layout of menus or toolbars, then he's got more problems than any sysadmin is qualified to deal with.


    Users are incapacitated by The Bleeding Obvious. Given the amount of people that are likely to be confused by things that are obvious, you can be sure that there will be more people confused by something that does not have the same look and feel.

    The myth that Linux can't interact with Windows was blown out of the water years ago, and continuing to repeat it simply generates more heat than light.


    Whether or not Linux can or cannot interact with Windows is a seperate issue. I am talking about whether or not it mimicks the GUI of Windows.

    In windows, users can instantly reach the floppy by going to A:\. Under Linux, you go to the /mnt/floppy mount-point, or by using a GUI shortcut to reach the floppy instead. When a user finds that typing a:\ does not work, that user would be slowed down a bit when he searches for that floppy shortcut - or would contact the help desk if no shortcut is immediatly visible.

    I am aware that mtools attempts to add transparancy between Linux and Windows floppy disk usage. However, this doesn't appear to provide transparent access by itself. Unless you have a distribution that supports automounting floppy disks or otherwise install an automounter yourself, you will have to deal with support requests that pertain to basic operating system usage.
  42. Use Linux! by Snipes420 · · Score: 1

    We use Clark Connect to proxy the internet at our small shop.
    It manages to cache almost all windows updates so you get them fast and save your bandwidth.

    --
    What goes around comes around, kid.
  43. Custom script.. by NeuralAbyss · · Score: 1

    If you can't get WSUS to work (which is the best option around for free..), try this little script:

    http://i3.tucuxi.org/articles/2005/hotfixes-wsh

    It's something I hacked up when I couldn't get SUS (predecessor to WSUS) to work, and seems to do the job.. only thing is, users need to have local admin if this is to run as a logon script.

  44. what to do what to do... by solid_liq · · Score: 1

    Get a copy of Ghost for when you need to install/reinsall an OS. Just setup a machine with all the updates and software you want all the machines to have, then you can install a replica of that machine onto any of the other machines via the network in one fell swoop. The machines just need to have a BIOS that allows them to boot from the network in order for you to be able to do this without using any disks whatsoever. Most machines seem to have that capability nowadays. It takes almost none of your time to do this, and requires no internet bandwidth.

    For saving on bandwidth for updating existing machines, others have already answered that question.

    As for your low bandwidth issue. If it's just acceptable, but not really quick to surf webpages, then you might find a proxy server beneficial. If you have an old machine lying around (like a P3-500 or so), that should be more than sufficient to run a proxy server. Just put Ubuntu Server, Damn Small Linux, or whatever your preferred Linux distro is on the machine and configure a Squid proxy server. It won't cost you anything, but can speed up surfing very noticeably. You can also install an adblocking filter for Squid to further save on bandwidth consumption, very considerably in fact. That may require some political hassles, however.

  45. Several Solutions by Pathway · · Score: 2, Informative

    1) Install a proxy server. You probably have a router of some kind. Perhaps it's a linux box. What you could use to save your bandwidth is use some of your server's HD space to download the common items (like patches from Windows Updates). Since the proxy _can_ be transparrent, there is nothing to configure on the other computers. There are many ways to do this. My suggestion: Squid. In particular, I have used the implementation in ClarkConnect. It's easy to setup, and there is a free version. If you want the pay version, it's extremely inexpensive. http://www.clarkconnect.com/

    2) Use nLite. nLite is a utility that makes custom Windows install CDs/DVDs. With the program, you can make an updated CD that installs SP2, all the updates, and even drivers. It even has the option to make the install "unattended", requireing no input by you. This might not be an option since you apparently don't have the Volume License version of of XP. None the less, highly recommended for those who have to re-install often. http://www.nliteos.com/

    3) Consider some way to harden the researcher's experiance. Don't want to install Linux on your search stations? Use VMWare Player and the Browser Appliance! By doing this, you effectivly remove any possiblity of Viruses, Spyware or otherwise unwanted downloads. And the best part is... if you don't like/can't use the browser appliance to do what you need... go back to windows. http://www.vmware.com/products/player/

    Hope these suggestions help.

    --Pathway

  46. Autopatcher by takobell · · Score: 1

    There are many solutions to this problem, one of them being AutoPatcher. They provide many more updates (including hotfixes) than the standard windows update does as well.

  47. Re:Make one box a web cache server. by limegreen · · Score: 1

    To save bandwidth all round, install a caching proxy like squid. As well as speeding up access to popular websites, if one configures it to save objects up to 200MB in size it will remember all the OS patches.

  48. Re:Also see this guide for more detailed instructi by corychristison · · Score: 1

    Some of my customers have recently reported issues with F-prot and MSN Messenger [and Live Messenger] where if they are both running the entire system becomes very sluggish... Have you experienced this at all? My quickest work-around has been to install AVG Free for now.

  49. On Topic: by Futurepower(R) · · Score: 1

    On Slashdot, only people not interested in commenting on the discussion can rate comments. So, many times readers visit stories in which they have no interest so that they can moderate.

    The first link in the parent comment is not "Offtopic". It's an alternative way to update your Windows computers, which is exactly the subject of the discussion.

  50. WSUS is good but Auto Patcher may be better ... by natmsincome.com · · Score: 1

    Windows Update Service is cool but if you've only got 20 computers and don'e have a server setup already it may be a bit of an overkill.

    Personally I've been using a tool called AutoPatcher http://www.autopatcher.com/ which includes all the updates and a number of other standard companents, like flash, java etc.

    If you have seen it yet then check it out. It soulds like it will be exactly what you are looking for.

  51. Why are you asking us? by Anonymous Coward · · Score: 0

    No, seriously. The thing that gets trumpeted as an advantage of commercial software over open-source software is that you get proper support. And here you are, a paying customer of Microsoft's, resorting to asking Slashdot instead of the organisation that should be helping you solve your problems, Microsoft. It's their product, it's their deficiency, how come you aren't asking them?

  52. Re:If all most of them are doing is surfing the ne by westlake · · Score: 1
    Library computers are not necessarly browser kiosks

    This can be particularly true in a small town. Word and Publisher see a lot of use here. It doesn't hurt that the easily navigated MS Office site delivers one-stop shopping for tutorials, templates and clip art.

  53. Shavlik! by KStieers · · Score: 1

    Get Shavlik HFNetChkPro. Its free for a year for 50 machines. Scans for all of the MS products, plus Adobe, Winzip, and others...

    Shavlik wrote the MS Baseline Security Analyser, the product is solid. www.shavlik.com

    No, I don't work for them...

  54. security updates available from MS by Mishotaki · · Score: 1

    Microsoft offers his security updates by iso files in their website... so once a month, you downoad the file, burn it on cd as a saved project... and you use it on all your computers...

    simple, safe (as much as a microsoft service could be) and pretty much foolproof

    http://support.microsoft.com/kb/913086

  55. Server? Too expensive. by WhiteWolf666 · · Score: 1

    He's talking about 20 light use machines.

    For incremental updates, staggering automatic downloads a 2 through 6 am should work.

    For service packs, download to cd. He already does that.
    The real problem is the reinstalling, and frankly, you shouldn't need to.......

    Locked down permission, draconian install policies, or switch to Linux. You should not need to reinstall unless you experience hard failure, and in that event reinstall, turn on automatic updates, and let the thing start sucking on your dsl at 6 pm on a sunday, or whenever you go home.

    --
    WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
  56. Re:If all most of them are doing is surfing the ne by Anonymous Coward · · Score: 0
    XP is the end of the line for Microsoft. Vista is alreasy shaping up to be both a support nightmare (too many versions, too many rewrites, too much hardware required for a decent "user experience", too many features cut, too many intentional holes in the "new security model", too much maintenance, too much money when compared to the competition). Remember, linux live DVDs are already good enugh for libraries and schools and anyone else who wants to surf the web, and they're only going to get better.


    Oh horseshit. Vista has had enough features stripped that it's probably going to end up being a modified Win2k3 kernel running with the "Aero Glass" interface. And you know what? People are going to buy it. In North America Microsoft is not going to have a problem for MS. There was no damned reason to go from Win2k to WinXP, but many did.

    Don't get me wrong, I'm a Linux/FreeBSD enthusiast, and when it comes to fielding an OS with commercial support it's all about Solaris with me. But I'm also a realist. MS aren't stupid, and yes, they've made some missteps.. but they're not going away. Companies like DEC who didn't evolve fast enough got munched, but Microsoft is scary: they evolve their business model fast enough that it's basically like a metastasizing malignant tumor. Right now we're flying right into the "subscription" phase.

    If linux starts to pose a real threat the lawsuits will come from Microsoft's IP department. Shit.. they've probably got a patent on the "for" loop. This won't be SCO suing, this will be Darth Fucking Vader kicking down the door.

    I'd be happy if open source operating systems ever hit 5% on the desktop market, but with things like DRM in play it's not going to happen over the next few years unless we get crap like this under control.
  57. A different approach by Wolfrider · · Score: 1

    --Yep. For small-medium networks, use Squid. Allow me to recommend my Squid VM Appliance, located here:

    http://www.vmware.com/community/thread.jspa?messag eID=359128

    --1.5GB growable disk, preconfigured to store objects up to 20MB in size, and Free software to boot. Only uses ~100MB RAM in the guest. Point all browsers at the proxy (10.0.244.4:3128), do a Win Update on _one_ machine, and the other machines will DL the updates from the proxy.

    --Vmware Player is free, and can be downloaded here:

    http://www.vmware.com/download/player/

    --
    .
    == WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
  58. Simple enough ... by Anonymous Coward · · Score: 0

    Use Linux or *BSD.

  59. Re:If all most of them are doing is surfing the ne by tomhudson · · Score: 1

    There was no damned reason to go from Win2k to WinXP, but many did.

    Most people didn't go from Win2k to WinXP; they either went from Win9x, or its their first computer.

    ... or maybe you've forgotten all the ads for new business machines with WinXP that also offered "downgrade rights" to Win2k, because businesses didn't want to switch?

    Heck, I know some people who are still running Win98 - they've recently gotten a new box (it has XP on it) and they want me to install linux on it. Why? Because its just as easy to use as XP, has more features, and doesn't need a virus scanner, whereas Vista will always be broken compared to a real system. Its already over 4 years late, and the competition hasn't been standing still.

  60. Re:If all most of them are doing is surfing the ne by BrokenHalo · · Score: 1

    ...In windows, users can instantly reach the floppy by going to A:\. Under Linux, you go to the /mnt/floppy mount-point, or by using a GUI shortcut to reach the floppy instead. When a user finds that typing a:\ does not work, that user would be slowed down a bit when he searches for that floppy shortcut...

    Well, to be a bit brutal about it, if he is slowed down by a few nanoseconds, who cares? If Apple can get away with calling their floppy drives anything other than "A:/" without being branded as user-unfriendly, why shouldn't Linux?

    As the majority of Linux distros these days come with hal/dbus (i.e automount plus some extras) included, the interface is now almost identical to that used by OS X.

  61. mm, explore the windows update site more by Goeland86 · · Score: 1

    There is a way to download the .exe for SP2, and then burn that to a disk.
    Search for SP2 on multiple computers, or something along those lines. And when SP3 comes out, do the same thing.
    I remember I had to do that for a friend whose laptop was in german, and the campus wouldn't let her get on the web without SP2 installed... I downloaded it, burned it, and installed it from the CD without so much as scoffing from either MS or Windows.
    I do suppose you have CD-Rs lying around?

    --
    ---- I am certain of only one thing : I know nothing else.
  62. If you run... by dizzy+tunez · · Score: 1

    Windows Server of some kind, you could try out something called WSUS. That makes the server in your domain the windows update server. Call it a Windows Update mirror.

    --
    "If you loved me, you`d all kill yourselves today"
    Spider Jerusalem
  63. It's a pity you can't use... by leonbrooks · · Score: 1

    ...either URPMI or APT for updates, both of which are trivial and powerful to use compared with Microsoft's chaotic collactions, and have been for many years.

    Such use would also make the dynamic customisation of updates much simpler and faster (and more possible at all). People who are much less control-dominated thab MS faced and solved these kinds of issues well and long ago.

    --
    Got time? Spend some of it coding or testing
    1. Re:It's a pity you can't use... by snuf23 · · Score: 1

      I've used RPM (which I hate - don't know if Mandriva has improved it) and APT (which I like) but only in single server instances. Is there a way to centrally control APT or RPM from a gui driven interface across a few hundred or so workstations? Also can you group those workstations into different sets and apply updates only to specific sets? I always prefer to roll updates to test stations/servers before commiting then on production machines.
      I'd also like to see reporting telling me what installed where and if there were any failures. Rollback to previous updates would be important as well.
      I'm not sure how to set this up with RPM or APT - maybe you can point me in the right direction. Is there an easy to use quick way to set this up? Say something that takes 10 minutes to get rolling on a server?

      --
      Sometimes my arms bend back.
  64. All options that I know about by enmane · · Score: 1

    1) RyansVM - google search it - works great with Nlite to create a slipstreamed CD
    2) AutoPatcher - google search it - aggregates all of the updates into a single downloadable file
    3) Windows Update - LOL, not a "real" option if you ask me
    4) Download all of the hotfixes and use Nlite to slipstream them
    5) MSUS as mentioned already
    that's all that I know of up to now.

  65. break problem into 3 parts by Vern+Dog · · Score: 1

    Part 1 bandwidth
    700k is not bad bandwidth, but set up a web proxy server and set cache to as may Gig as possible
    This will help your users web surfing experience

    Part 2 windows updates
    Get WSUS

    Part 3 os reloads or ghosting
    Check into a program from Altiris called deployment server (check to see if you can get educational pricing)
    With is program you can automate os images pushes and or pulls, to a hidden partition on local drive or to a network
    Depending on your network, this could be done daily or weekly

  66. Microsoft has no respect for our time. by Futurepower(R) · · Score: 1

    Millions of people are required to repeat something that should be done my Microsoft, once.

    Microsoft has no respect for our time.

  67. Troll? I think you've been sleeping... by Anonymous Coward · · Score: 0

    > If you don't have legitimate copies, Microsoft isn't your vendor. You get to sleep in the bed you made.

    You would be correct if you added two words to that. Those to words are "Microsoft isn't your vendor any more" ...

    Or haven't you paid any attention to all the folks with "illegitimate" copies of Windows who have receipts, documentation, certificates and other crap, but which Genuine [Dis]Advantage considers to be pirated?

  68. Re:Troll? I think you've been sleeping... by Anonymous Coward · · Score: 0

    I tend not to get too excited over the pathological case, particularly when replying to an admitted infinger.

  69. Re:Also see this guide for more detailed instructi by students · · Score: 1

    We haven't seen this, but I've never had a IM related support request, so that does not mean anything.

    Have you tried removing MSN? It is a security risk its self.

  70. destroying windows updates by crankshot999 · · Score: 1

    simple download all updates make a fire throw hdd in fire and you have succsessfully destroyed your windows updates! and you desroyed the curse on the harrdrive as well its called windows http://www.microsoft.com/windows

  71. A little bit of everything by WinBreak · · Score: 2, Interesting

    First off, I'd like to actually THANK everyone who replied. All of the information was very helpful. I'll be looking into WSUS to fulfill my needs. We currently have an in house server running good ol' Windows NT (no internet connection to it, so we're not worried about security exploits or anything). I thought about using that computer to try WSUS, but then I remembered an unused Windows 2000 Server lisence we have laying around since pulling a machine out of the loop! And with some money in the budget, I can put together a new machine that will serve this job perfect. 2nd, a reason I couldn't just do scheduled or 'automatic updates' with these computers is because I use a program called "Deep Freeze" from Faronics (see: http://faronics.com/index.asp). It basically keeps the computers in a specific state until you tell te software to "thaw" and then reboot. Then, you have to "freeze" the partition and reboot again once changes are finished. Automating some tasks can be a pain - but the benefits of this software in our work environment far outweigh any annoyances. Autopatcher sounds like it'll be nice for home use... sort of a single download and deploy method, rather than having to wait for Windows Update to do its long winded tasks. Thanks for the info, everyone, it's been great, and I'm sure you've all given ideas to many others in my same situation! Garrett C. a.k.a. NuAngel of WinBreak.

  72. get Autopatcher by DaMa9eD · · Score: 0
    --
    Have you been DaMa9eD today?
  73. Okay, another similar situation. by therufus · · Score: 0

    I work for a computer builder/retailer. Is there a way to download and deploy updates to a newly built PC without changing any settings on the new PC? I want to be able to download updates to a central server and just run a file on that server from a newly built PC and have my pre-downloaded updates installed. That way when the customer gets the unit home, they can just click the WU or let the AU work.

    --
    You moved your mouse. Please restart Windows for changes to take effect.