1

I am wondering on how you update your servers. I have a 2008r2 setup with 5vm’s, i enabled windows updates and it slowed the server down until i rebooted the device. Do you normally allow your server to reboot automatically. Also how are you managing client updates? Thanks

2 Spice ups
2

We do everything via WSUS so updates get downloaded and pushed out centrally, it also makes it easy to manage exactly which updates get installed, for example I don’t install .NET on servers that don’t need it and I don’t install the Windows Malicious Software tool anywhere as our AV looks after that sort of thing.

Client updates get pushed out to IT first, and then a few days later to everyone providing no problems are noted. I do all the servers once per month normally, about a week or so after patch tuesday to allow time for any problems to get spotted by others.

3

We use WSUS also. Works great.

4

WSUS Server! I only allow the server to download updates not install automatically. That way I can schedule at our convenience. WSUS might not be worth setting up with just 6 servers though. If you are going to install client updates as well, I say give it a shot.

Hope that helps

5

HI,

I use WSUS to control updates throughout my client sites. Any important PC updates are set to push out straight away. I have my servers in a different policy and manually install (usually 2-3 weeks after release so I can learn from others mistakes).

WSUS can be deployed by policy, needs 15-25gb of free space and takes about 1-2 hours to implement and then 15-60 minutes admin a month.

1 Spice up
6

I fight my boss for some downtime on the servers and then apply manually. I make sure they’re downloaded first (either via WSUS or manually) so that I minimize the downtime. You should have a maintenance window of some sort scheduled to happen at least once a month if they’re windows (maybe less frequently if they’re unix). It’s never easy, and they never seem to want you to take access to their data away. If you point out that if you can’t do your maintenance at least every once in a while they may lose it altogether that usually helps. I have a few set up for automatic updates once a week (Sunday mornings at 3 am) with a scheduled reboot to follow (at 6 am). On any ESX type hosts I almost think that would have to be a manual process to patch as you’d have to make sure all the VMs were safely powered off first. At least, that’s been my experience.

7

hardik1073,

Personally I wouldn’t have the servers restart automatically. As Nick-C stated earlier, I too update the servers about once a month with restarts during non-production hours.

As for WSUS, great tool to push out those updates. If you plan to utilize it, be sure to check out options - Products and Classifications to “trim out the fat” of products you are not using. There is also an “Automatic Approvals” option where you can be selective on what types of updates to push automatically (e.g. critical updates).

cheers

8

We also use WSUS. But VM host servers are treated differently. We have these servers setup to download update but to NOT install them. Part of our protocol is to shutdown all client VMs before the host is updated. You will need to reboot after the update anyway so why not gracefully shutdown the clients, apply the update to the host server and then reboot.

The VM clients (servers) follow the same rule as the VM hosts for mission critical applications. We want to ensure the servers reboot and come up normally. This is more of a manual process, but we are sure there are no problems that could impact our SLAs.

9

Cheers! So you typically restart your servers once a month after the updates are completed correct?

Did you dedicate a server for WSUS only? From what i understand it has to be installed on a non domain server, is this correct?

10

In my case, yes we restart once a month after the updates are install. We use a dedicated (virtual) machine for wsus. I wouldn’t put it on a DC just because if wsus filled up the disk or consumed too much cpu your DC service availability may be jeopardized.

11

hardik1073 wrote:

Cheers! So you typically restart your servers once a month after the updates are completed correct?

Did you dedicate a server for WSUS only? From what i understand it has to be installed on a non domain server, is this correct?

You can install WSUS on pretty much any server in your domain, I run 2 domains and have one running in a VM alongside our AV Admin Console and the other runs on a domain controller (works fine but you need to setup the DC before WSUS otherwise when you run DCPROMO it can mess up some of the IIS permissions).

12

WSUS as well. Download but not install on most. I hope on once or twice a month and install/restart.

13

Same here