• Illustration: Patch Management Terminology Changes
• Illustration: Microsoft Update User Interface

Updates to two free Microsoft patch management tools unify patching of OSs and applications. Microsoft Update, a more comprehensive version of the Windows Update Web site, patches many Microsoft applications in addition to patching Windows. Windows Server Update Services (WSUS), a free Windows Server—based tool, gives organizations a centralized way to authorize and distribute OS and application software supplied by Microsoft Update to systems running Windows 2000 or higher. In addition to patching Windows, both tools can patch SQL Server 2000, Exchange 2003, and Office 2003, with more Microsoft applications to be added over time.

(Ed. note: While in beta, both tools were described in greater detail in "Free Software Update Technology to Cover All Products" on page 12 of the Feb. 2005 Update. However, some terminology has changed in the released versions. For the current terminology, see the illustration "Patch Management Terminology Changes".)

Microsoft Update

Microsoft Update is a more comprehensive version of Windows Update, Microsoft's Web-based tool for managing patches, security rollups, and service packs. Like Windows Update, Microsoft Update is accessible interactively from a Web browser or automatically from the Automatic Update agent on Windows 2000 and newer versions of Windows client and server. The Automatic Update agent enables applicable patches to be downloaded in the background and even installed at a scheduled time without user interaction.

Microsoft Update provides a superset of Windows Update functionality. Most notably, while Windows Update offered updates only for Windows, Microsoft Update can also patch SQL Server 2000, Exchange 2003, and Office 2003, and Microsoft promises that at some time in the future it will become the main source for patches and service packs for practically all Microsoft products. Microsoft Update depends on Windows Installer 3.1 to install non-OS patches (in the beta version, Windows Installer 3.0 was needed.) The site will automatically download and install the latest version of the Windows Installer if it isn't already present on the user's system. (For an illustration of how the new user interface supports patching of applications, see "Microsoft Update User Interface".)

Microsoft Update also uses a new scanning technology to identify installed Microsoft software components that require patching. This technology will be shared by upcoming updates to Systems Management Server (SMS) and the Microsoft Baseline Security Analyzer. Having a common scan engine for all Microsoft software will eliminate discrepancies between results obtained from the different tools and will eliminate Microsoft's cost of supporting multiple patch catalogs and scanning technologies.

Microsoft is maintaining its existing Windows Update and Office Update Web sites so that users of systems with versions of Windows older than Windows 2000 SP3 and users of Office earlier than Office 2003 can continue to obtain Windows and Office patches. In addition, Microsoft will continue to host other Web sites, such as the Microsoft Download Center, that allow users or administrators to obtain other software, such as feature packs or resource kits.

Windows Server Update Services

WSUS is a replacement for Software Update Services (SUS), a free Windows Server—based tool that gives organizations a means to centrally control and distribute critical OS patches, security rollups, and service packs to Windows systems. Named Windows Update Services (WUS) while in beta, the new server product downloads software files and patch catalog data from Microsoft Update for all products that service supports. Once an administrator approves applicable patches for installation, Group Policy settings control whether the Automatic Update agents on each PC get the update files from the WSUS server or directly from a Microsoft site. In addition to supporting more Microsoft products, WSUS improves on SUS in many other ways, such as better patch targeting and status reporting.

As was the case with SUS, SMS 2003 does everything that the free WSUS product will do and much more, so organizations that use SMS 2003 will typically not need WSUS.

Resources

To begin using Microsoft Update, go to update.microsoft.com/microsoftupdate/v6.

Additional WSUS information and links to the download site are available at www.microsoft.com/windowsserversystem/updateservices.