Here is bits and pieces of a document I have... it does reference images in the doc, but it's all the steps in the DSUW which can be accessed by right clicking software updates in the SMS console. Once you have the package created, simply advertise to your clients.
Make sure you have the scan tool sync program setup on your server and the scan tool expedited program advertised to run once a day. This will tell you which machines need what update.
Each month new patches are released from Microsoft as new vulnerabilities are fixed. You need to determine which ones to select for your SMS clients. Open the SMS console and look at the Software Update section. Notice the servers that are showing up in the Requesting column. Your responsibility is to keep the requesting column at zero and the compliant column as high as possible.
· Write down the QNumber(s) you wish to deploy as you may need them in the Distribute Software Update Wizard (DSUW).
Creating the Security Update Package:
· The DSUW is the only method available to create a package for security updates. The DSUW can be accessed by right clicking the Software Updates section in the SMS 2003 console. Choose All Tasks / Distribute Software Updates.
The DSUW appears, click next.
· Select the update type as the default should be Microsoft Updates. If you do not have Microsoft Updates, you do not have the ITMU installed. See Fig. 2.2
Select New and click next
· Give the package a name. Try to give the package a unique name and specify Servers or Workstations in the name somewhere. This is a trick that’s handy when you are looking at your packages in SMS to quickly identify who the target should be. See Fig. 2.4
· Add the name of your organization in the window. See Fig 2.5
· If you desire to have a balloon notification on the resource receiving the updates, click on the import button and choose a .rtf file. You can create any .rtf file in WordPad with the text you want in the balloon window. See Fig. 2.6
· Next you will select the inventory scan tool to use. By default, the Microsoft Update Tool is the selected Program name. Changing that to expedited will kick the results up to the SMS server immediately after the scan runs. See Fig. 2.7
· Sort the Requesting column and find the QNumber(s) you wish to select as updates for you package. If you select an update that requires another, a popup notification will be displayed. You do have the option not to select the recommended update. See Fig. 2.8
Provide a Package Source Directory. This is going to be your location to download your update(s) from Microsoft. The default location points to a local partition on the server. That location can be used, but I would suggest you use a UNC path to a server share as the download location. Example: \\ServerName\Packages$\MSUpdates\Q1ServerUpdates Choose the option (default) to download the updates automatically.
Once the download is complete a window is displayed which shows the patches downloaded. There should be a “Yes” for all in the left hand column. If not, go into the properties of that update and download from there.
· Select your Distribution Point(s) where you want to deploy the package. See Fig. 2.11
· The next 3 screens determine the execution behavior of the package on the target resource. Fig 2.12 – 2.14 show the screens and the defaults were taken. Proper testing of the different configurations will determine the settings. There is no right way and no wrong way to configure this. The settings simply determine how the package executes.
You now have the option to create an advertisement to the target collection. I suggest not creating the advertisement here as you don’t have any real configuration options available at this time.
The DSUW is now complete. Click finish to save the package
Once the package has been created, you have to create the advertisement to your target collection. If the configurations you selected in steps 2.12 – 2.14 do not behave the way you want, do NOT change the command line in the package program nor anything else in the program itself. Run the DSUW again and open the update package you just created and modify the screens.
Status Reports:
· Now that your advertisement is setup and the updates are deploying to your collection, we need to know what the success rate is. In the SMS console, expand Reporting and select Reports. Sort the Category column and locate the Software Update Category reports. There are several reports that will help you determine the status of your patch deployment process. However, for just viewing the status of the advertisement you created, see the next step. See Fig. 3.1
To view the status of the patch deployment advertisement, open the report named All Advertisements for a Specific Package. Select the package name for the updates you are deploying to SMS resources by clicking on the Values button. Click the display icon to open the report. Drill down into the advertisement name to see the status of the deployment process. Items in the top half of the screen simply tell you if the SMS client received the advertisement. The items on the bottom show the running status of the package itself. Look for failures and other red flags to make sure all systems have been properly patched.
Brian S. Tucker
The Blogcast Repository - MCSE, MCDBA & MCT