Automatic Updates - on/off ?

[xedgex]

I work in an environment that always had Automatic Updates ON on all it's Servers as well as Workstations. Lately management has decided that it's better for Auto Updates on only Servers to be set to off to decrease issues with updates.

Not that we've had any problems with these. The IT plan is to now apply updates quarterly.

I think this is a bad idea, I wanted to get feedback from other sysadmins out there, but leaving a server with a security flaw for months is just bad IMO.

Feedback appreciated, thanks!

 

[Topkapi]

Why not deploy WSUS then you can carefully control what updates are released to your network. This would have the benefits of allowing critical/security patches but delaying others until any testing deemed necessary has been done.

 

[jhaith]

What is your current network setup? Applying updates quarterly is ridiculous. Topkapi has the right idea of going with WSUS. You should look at rolling updates out in waves (dev/test/prod) if management is concerned with possible issues with the updates. You could also do waves by specifiying different update schedules for different groups using GPO if WSUS isn't an option. In my opinion MS updates don't seem to cause the problems they used to, and if there is a problem it's easy to roll back the update.

-jhaith

 

[58sniper]

I'll add that with WSUS, you can set different behavior for different machines. So, you may want updates to apply automatically to workstations, but only download to servers. Much less bandwidth being used over your Internet connection, plus, you can control what gets installed on the machines.

Pat Richard
Microsoft Exchange MVP