Distributing Windows Updates with Ghost AI - Problems

[TimSharpe]

I rolled out Windows 2000 using Ghost 7.5 and Sysprep to about 400 workstations early this summer. I used a single image. I have successfully distributed changes to the workstations over the past 6 months using AI (Ghost Auto Install). Now I want to distribute Windows security updates using AI and I am having a problem. I started with a clean image and I ran the snapshot, then I ran Windows Update from IE 5.5 (I deselected Windows 2000 SP3 and IE6) and installed a total of 21 updates. When the updates were complete I said no to the reboot and ran the compare part of snapshot to capture the changes and built a reboot into the package. When I apply this package to another clean fresh image to test I get the following error upon re-booting "The procedure entry point LsaOpenPolicySce could not be located in the dynamic link library ADVAPI32.DLL". I have tried rebuilding the package many times (I've been at this for over a week) with no luck. If I reboot before I run the compare portion of snapshot I get a different error when applying the package to a clean install, "Cannot find Winmgmt.cfg" on installation disk". Has anyone had any luck distributing windows security updates to 2000 clients via AI or another product? I would like to selectively distribute these updates without requiring user intervention and I certainly do not want to visit each workstation individually. Thanks in advance for any suggestions.

 

[b5passat]

The least of your problems are right there in your small test environment. You are making an assumption that NO additional software has been installed on these deployed machines over the 6 months of usage. The documentation specifically states that AI should not be used except to deploy packages onto clean identical machines.

Now with that disclaimer out of the way...

When doing our 6 month PC purchase this year, we had about 1,000 machines total purchased. Some machines had CDRW drives, digitizing tablets, tape backup units, etc. I ran into some software packages that I created that I could not get to run with the AI packager. I'd use the SMS packager and the package would work just fine. Likewise there were some where the SMS packager would not work and we used AI. The user's could only make the software installation selection at first bootup however, so the packages were being deployed to a clean machine.

You could do the same thing if you have SMS deployed in your agency. You may want to consider a SUS server as well. We are in the process of implementing this. Check out:

http://www.microsoft.com/windows2000/windowsupdate/sus/default.asp

Matt