How to decide whether a window update should be installed or not?

I am a network administrator. I have downloaded all the windows updates to
our server harddisk. However, I don't know which updates i should install
while which updates I do not need to install. Is there any way to judge this?
For some reasonS, I do not want to use Microsoft Automatic Updates. Is there
any related document? Thanks in advance!

Penguin wrote:
> I am a network administrator. I have downloaded all the windows
> updates to our server harddisk. However, I don't know which updates i
> should install while which updates I do not need to install. Is there
> any way to judge this? For some reasonS, I do not want to use
> Microsoft Automatic Updates. Is there any related document? Thanks in
> advance!

I'm confused on a few things..

- Are these downloads for the servers or workstations?
(If for the workstations, quite the waste NOT using WSUS.)

- There's really two ways to make the decision on which patches to apply..
1) Apply the patch to your test system(s).. If everything is fine, apply
it to the critical systems.
2) Read up on what the patch fixes/replaces and determine if that would
adversely affect your system(s).

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

BTW, Stanley, I can NOT use WSUS here My manager does not allow me to use
it

Thanks,
Penguin

"Shenan Stanley" wrote:

> Penguin wrote:
> > I am a network administrator. I have downloaded all the windows
> > updates to our server harddisk. However, I don't know which updates i
> > should install while which updates I do not need to install. Is there
> > any way to judge this? For some reasonS, I do not want to use
> > Microsoft Automatic Updates. Is there any related document? Thanks in
> > advance!
>
> I'm confused on a few things..
>
> - Are these downloads for the servers or workstations?
> (If for the workstations, quite the waste NOT using WSUS.)
>
> - There's really two ways to make the decision on which patches to apply..
> 1) Apply the patch to your test system(s).. If everything is fine, apply
> it to the critical systems.
> 2) Read up on what the patch fixes/replaces and determine if that would
> adversely affect your system(s).
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Hi, Stanley:

Thanks for your reply. Actually, I was kinda interested with how the
Automatic Update detects whether a window update should be installed or not.
You know, when you run the automatic update, it automatically detects what
updates have been installed and what updates you should install. How does it
do that? Is there any related document?

Thanks,
Penguin

"Shenan Stanley" wrote:

> Penguin wrote:
> > I am a network administrator. I have downloaded all the windows
> > updates to our server harddisk. However, I don't know which updates i
> > should install while which updates I do not need to install. Is there
> > any way to judge this? For some reasonS, I do not want to use
> > Microsoft Automatic Updates. Is there any related document? Thanks in
> > advance!
>
> I'm confused on a few things..
>
> - Are these downloads for the servers or workstations?
> (If for the workstations, quite the waste NOT using WSUS.)
>
> - There's really two ways to make the decision on which patches to apply..
> 1) Apply the patch to your test system(s).. If everything is fine, apply
> it to the critical systems.
> 2) Read up on what the patch fixes/replaces and determine if that would
> adversely affect your system(s).
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Penguin wrote:

> Hi, Stanley:
>
> Thanks for your reply. Actually, I was kinda interested with how the
> Automatic Update detects whether a window update should be installed or not.
> You know, when you run the automatic update, it automatically detects what
> updates have been installed and what updates you should install. How does it
> do that? Is there any related document?
Hi,

Mainly it checks your system's file versions against a "database"
located at Microsoft".

If you want to get a list of needed security updates for a computer,
you can use MBSA for this:

http://www.microsoft.com/technet/sec.../mbsahome.mspx


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Hi, Torgeir Bakken:
Is there any chance I can do it programmatically? Since I am managing
around 60 computers. I do not want to use the toolkit you mentioned in your
message one by one manually. Instead, I am planning to do it
programmatically.

Thanks,
Penguin

"Torgeir Bakken (MVP)" wrote:

> Penguin wrote:
>
> > Hi, Stanley:
> >
> > Thanks for your reply. Actually, I was kinda interested with how the
> > Automatic Update detects whether a window update should be installed or not.
> > You know, when you run the automatic update, it automatically detects what
> > updates have been installed and what updates you should install. How does it
> > do that? Is there any related document?
> Hi,
>
> Mainly it checks your system's file versions against a "database"
> located at Microsoft".
>
> If you want to get a list of needed security updates for a computer,
> you can use MBSA for this:
>
> http://www.microsoft.com/technet/sec.../mbsahome.mspx
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx
>

Penguin wrote:

> Hi, Torgeir Bakken:
> Is there any chance I can do it programmatically? Since I am managing
> around 60 computers. I do not want to use the toolkit you mentioned in your
> message one by one manually. Instead, I am planning to do it
> programmatically.
>
Hi,

Mbsacli.exe (the command line interface for Microsoft Baseline
Security Analyzer) supports remote operation.

Here are some of the command line switches the v2.0 supports:

Scan named computer:
/target domain\computer

Scan named IP address:
/target IP

Scan named IP addresses range:
/r IP-IP

Scan named IP address or computer listed in the specified file:
/listfile file

Scan named domain:
/d domain


There is also a MBSA newsgroup available:

microsoft.public.security.baseline_analyzer


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx