By Peter Pawlak [bio]
Posted: Nov. 18, 2002

The following is the full text of an article published by Directions on Microsoft, an independent research firm focused exclusively on Microsoft strategy & technology. Each month we make one or more key articles available to non-subscribers.

Two new feature packs are now available for Systems Management Server (SMS) 2.0 that make it substantially easier for organizations with SMS to deploy security patches and perform certain administrative tasks. Both include a new Web-based reporting system that makes it easier for administrators to distribute reports on distribution status and hardware and software inventory. SMS allows organizations to electronically inventory their Windows desktops and servers, deploy software to those computers, make configuration changes across groups of computers, remotely manage computers, and track software licenses across their networks.

The two feature packs—the Software Update Services Feature Pack and the Administration Feature Pack—share certain common components so that either can be installed without the other. (During the beta period, the two were combined into a single product called the SMS 2.0 Value Pack.)

Software Update Improvements

The Software Update Services Feature Pack makes it substantially easier for SMS 2.0 organizations to deploy Windows and Office patches.

Although SMS provides all the raw capabilities needed to determine which computers lack up-to-date patches and then install the patches where missing, in reality this has been a complex and difficult procedure. For each patch, an SMS administrator had to manually determine which files or Registry entries identified the existence of the patch on a computer, build a software inventory query to identify which machines were missing the patch, download the patch from Microsoft, build and test an SMS installation package, and then configure SMS to distribute the package to the computers needing it. At the rate Microsoft issues patches, this process proved to be unfeasible.

Separately, in summer 2002, Microsoft introduced the Software Update Service (SUS) to ease critical Windows patch management on corporate Windows 2000 and Windows XP computers. (See "Software Update Service to Ease Patch Distribution" on page 3 of the May 2002 Update.) Although SUS is a much more limited tool and is not intended to replace SMS, SUS had one major advantage: it is integrated with Microsoft’s Windows Update Web sites and with the new client-side Automatic Update (AU) agents in a way that makes it extremely easy for an administrator to specify which patches to install. SUS takes care of downloading the patches to a server, and the AU agent installs only those patches that are applicable to the client system.

The Software Update Service Feature Pack for SMS 2.0 is designed to make SMS-based patch distribution almost as easy as with SUS, while still harnessing the significantly greater capabilities of SMS. The feature pack contains a Distribute Software Updates Wizard and supporting tools that are installed on the SMS system. The wizard guides SMS administrators through a process that

• Downloads the current patch information from Microsoft
• Analyzes SMS clients to see which ones need which patches
• Downloads the needed patches from a Microsoft Windows Update site and builds the SMS installation packages from them, including chaining together multiple patches when appropriate to eliminate the number of reboots
• Allows the administrator to review and change the list of target computers
• Distributes and installs the patches using the SMS infrastructure and client-side agents
• Reports back and summarizes the status of the patch deployment.

Although not as simple as SUS, SMS-based patch deployment provides the following capabilities not available with SUS:

• It can deploy Microsoft Office patches in addition to Windows patches.
• Patch targeting is much more granular—administrators can test patch deployment on individual computers, stage patch deployment among groups of machines, and treat servers differently from workstations.
• Installation scheduling is much more flexible—administrators can control how (e.g., mandatory or optional) and when each patch is installed.
• It creates reports on the status of patch installation, making it much easier to identify problems and the computers affected by them.
• It can use WAN bandwidth much more sparingly by pushing patch packages out to distribution servers at remote offices, so that computers at those sites are not all downloading the same patch files across the WAN links.
• It provides a central rollback mechanism so that if a patch creates problems, SMS can force a rollback to a previous healthy state.
• It can install patches on Windows NT 4.0 and Windows 9x computers. (SUS is limited to Windows 2000 and XP.)

Other Administrative Utilities

The Administration Feature Pack includes some new utilities that make configuration and maintenance of an SMS 2.0 system easier, such as the ability for administrators to copy settings from one site to another or to manage the many security accounts needed by SMS.

The Administration Feature Pack also includes a utility needed by certain types of installation packages that require a reboot in the middle of the process and which must perform further actions requiring administrative rights following the reboot.

Web Reporting

Both feature packs include a new Web Reporting Tool and a set of prebuilt reports that essentially replace SMS 2.0’s reporting system. The tool makes it possible for anyone with the appropriate permissions to view current SMS inventory and status information from a Web browser, and also makes it much easier to build new reports or customize report templates. It also provides some new report types, including one, the Enterprise Agreement (EA) license True-Up Report, that provides a simple means to determine how the number of installed applications or desktop PCs compare with those covered by the organization’s EA.

The new reporting system should make report distribution simpler than the current one, which is based on Crystal Reports. Users of the reports will not require a separate Crystal Info Viewer application to view reports, and administrators who produce reports will not have to generate static reports and distribute them through e-mail or file shares as they did with Crystal.

Resources

For more information on the feature packs and download links, see www.microsoft.com/smserver/evaluation/overview/featurepacks.

For additional best-practice white papers on patch management with SMS, see www.microsoft.com/solutions/msm/techinfo/solutiondocs.

For additional background on SMS 2.0, see "SMS 2.0 Ships" on page 3 of the Mar. 1999 Update.