Virtualization affects how we plan, build, deploy, operate, and service workloads. Customers are creating large libraries of virtual machines containing various configurations. The patch-state of these virtual machines are not always known. Ensuring that offline virtual machines are properly patched and won’t become vulnerable the instant they come online is critical.

I am therefore very pleased to state that the Offline Virtual Machine Servicing Tool v2.1 has now been released!

Congratulations to the Solution Accelerator team for this release!

The Offline Virtual Machine Servicing Tool 2.1 has free, tested guidance and automated tools to help customers keep their virtualized machines updated, without introducing vulnerabilities into their IT infrastructure.

The tool combines the Windows Workflow programming model with the Windows PowerShell interface to automatically bring groups of virtual machines online, service them with the latest security updates, and return them to an offline state.

What’s New?

Release 2.1 is a direct response to customer and Microsoft field requests to support the R2 wave. Offline Virtual Machine Servicing Tool 2.1 now supports the following products:
· Hyper-V-R2
· VMM 2008 R2
· SCCM 2007 SP2
· WSUS 3.0 SP2
· OVMST 2.1 also supports updates to Windows 7 and Windows Server 2008 R2 virtual machines.

Download here; Offline Virtual Machine Servicing Tool  2.1
More info; http://technet.microsoft.com/en-us/library/cc501231.aspx

To easily assess the security state of machines in an environment, Microsoft offers the free Microsoft Baseline Security Analyzer (MBSA) scan tool. MBSA includes a graphical and command line interface that can perform local or remote scans of Microsoft Windows systems.

MBSA 2.1.1 builds on previous versions by adding support for Windows 7 and Windows Server 2008 R2. As with the previous MBSA 2.1 release, MBSA includes 64-bit installation, security update and vulnerability assessment (VA) checks, improved SQL Server 2005 checks, and support for the latest Windows Update Agent (WUA) and Microsoft Update technologies. More information on the capabilities of MBSA 2.1 and 2.1.1 is available on the MBSA Web site.

MBSA 2.1.1 runs on Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP and Windows 2000 systems and will scan for missing security updates, rollups and service packs using Microsoft Update technologies. MBSA will also scan for common security misconfigurations (also called Vulnerability Assessment checks) using a known list of less secure settings and configurations for all versions of Windows, Internet Information Server (IIS) 5.0, 6.0 and 6.1, SQL Server 2000 and 2005, Internet Explorer (IE) 5.01 and later, and Office 2000, 2002 and 2003 only.

To assess missing security updates, MBSA will only scan for missing security updates, update rollups and service packs available from Microsoft Update. MBSA will not scan or report missing non-security updates, tools or drivers.
Choose the appropriate download below for English (EN), German (DE), French (FR) and Japanese (JA) for x86 (32-bit) or x64 (64-bit) platforms.

Download details Microsoft Baseline Security Analyzer 2.1.1 (for IT Professionals)
Source: http://bink.nu/news/microsoft-baseline-security-analyzer-2-1-1.aspx

WSUS 3.0 SP2 delivers important customer-requested management, stability, and performance improvements. Some of the features and improvements include the following:

• Integration with Windows Server 2008 R2.
• Support for the BranchCache feature in Windows Server 2008 R2.
• Support for Windows 7 and Windows Server 2008 R2 clients.
• Compliance Report
• Windows Update Agent (WUA) offers a collection of performance enhancements, user experience improvements, and bug fixes software updates.

WSUS 3.0 SP2 can be installed alone, or as an upgrade of WSUS 3.0 SP1.
This package installs both the WSUS 3.0 SP2 Server, WSUS 3.0 SP2 Administration Console components and WUA client for down-level operating system. You must install the server components on a computer that is running on Windows Server 2003 SP2 or later versions. You may install the Administration Console on a remote computer that is running one of the supported operating systems, see below the Supported Operating Systems section.
WSUS 3.0 SP2 Server Installation on Windows Small Business Server 2003
If you are installing the WSUS 3.0 SP2 product on Windows Small Business Server 2003, follow the instructions in Installing Windows Server Update Services 3.0 on Windows Small Business Server 2003.

Download Here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=a206ae20-2695-436c-9578-3403a7d46e40#tm

Here’s a script that uses this information to run the cleanup wizard:  Cleanup-Wsus (rename to .ps1)

Here’s how to use powershell to “manually” synchronize your WSUS server, i.e. download the latest updates. Synchronize-Wsus (rename to .ps1)

Of course it is also a rollup of all fixes that have previously been released for Office 2007 products.  Additional information will be posted to the Office Sustaining Engineering blog

I am very pleased to announce that WSUS 3.0 SP2 Beta is available today, January 26 , via the Connect Site . All you have to do is sign in to your Connect account or sign up now in order to participate in the Beta program.

WSUS 3.0 SP2 Beta Overview

New Windows Server and Client Version Support

·       Integration with Windows Server® 2008 R2

·       Support for Windows 7® client

·       Support for the BranchCache feature on Windows Server® 2008 R2

WSUS Beta Feature Improvements and Fixes

Auto-Approval Rules

·       New functionality lets you specify the approval deadline date and time.

·       You can now apply a rule to all computers or to specific computer groups.

Update Files and Languages

·       This release provides improved handling of language selection on downstream servers. A new warning dialog appears when you download updates only for specified languages.

Cross-Version Compatibility

·       The user interface is compatible between Service Pack 1 and Service Pack 2 for WSUS 3.0 on both the client and the server.

Software Updates

·       Stability and reliability fixes for the WSUS server, such as support for IPV6 addresses greater than 40 characters.

·       The approval dialog now sorts computer groups alphabetically by group name.

·       Computer status report sorting icons are now functional in x64 environments.

·       Fixed setup issues with database servers running Microsoft® SQL Server® 2008.

Deploying WSUS clients

Preface:

Installing WSUS is a relative straightforward process, very well documented not only on the Microsoft Technet Library (see ref [1] ). The step that usually causes most confusion and problems is when you try to connect the clients to the server and start deploying updates. This

With this post I intend to clarify this process of detecting clients and deploying updates. Allong with this I also give you some troubleshooting tips that you can use during this process.

About the Windows Update Process

Windows uses the Windows Update Agent to check Microsoft Update for new updates that may be applied to the machine.

You can configure Automatic Updates using one of the following options (on Control Panel -> Automatic Updates):

1. Automatic (Recommended) – default
2. Download updates for me, but let me choose when to install them
3. Notify me but don’t automatically download or install them
4. Turn off automatic updates

The update agent will look for new updates on the Microsoft Update catalog available on the Internet.

Configuring Automatic Update with WSUS involves the following steps:

1. verifying operating system prerequisites for client computers
2. pointing the client computers to the WSUS server and then configure the automatic updates
3. making sure that the Windows Update Agent (WUA) software on the client machines is up to date
4. …and that it! But if you are in a hurry to see the WSUS fully running, read this step to

Step 1: Verify operating system prerequisites for client computers

Windows Vista

Windows Server 2008

Microsoft Windows Server 2003

Microsoft Windows XP Professional SP 2

Microsoft Windows 2000 Professional with Service Pack 4 (SP4), Windows 2000 Server with SP3 or SP4, or Windows 2000 Advanced Server with SP3 or SP4

Step 2: Point the client computers to the WSUS server and then configure automatic updates
How best to configure Automatic Updates and WSUS environment options depends upon your network environment. In an Active Directory environment, you would use Group Policy. In a non-Active Directory environment, you might use the Local Group Policy object or edit the registry directly.

Administrator-defined configuration options driven by Group Policy—whether set with Group Policy in an Active Directory environment or via the registry or Local Group Policy object—always take precedence over user-defined options. When you use administrative policies to configure Automatic Updates, the Automatic Updates user interface is disabled on the target computer.

To do this follow the steps described on ref [6]. In the end of this procedure, your clients have automatic updates configured and are using you WSUS server for that.

Step 3: Verify the WUA software version on client computers

You now need to ensure that WSUS client computers have a supported version of WUA. Otherwise they will not be able to connect successfully to your WSUS server.

WSUS uses IIS to update most client computers automatically to WSUS-compatible Automatic Updates software. WSUS Setup automatically creates a virtual directory named Selfupdate under the Web site running on port 80 of the WSUS server. This virtual directory, called the self-update tree, contains the WSUS-compatible Automatic Updates software. For more information on this see ref [7] .

So what do you have to do in this step? Most of the times, nothing
But I wanted to talk about this because this is a step that is important for you to know about, specially if you are planning to use another product over WSUS. This other product that uses WSUS may have requisites more restricted about the WUA version, and you may need to configure this to enforce that specific versions. For example, Forefront Client Security (FCS) is a product that uses WSUS and requires that the clients have WUA 2.0 (or latter) installed. If you find problems using FCS, this would be a good step for you to troubleshoot.

Step 4: Accelerating the process to see WSUS working ASAP

After you set up a client computer, it will take a few minutes before it appears on the Computers page in the WSUS console. For client computers configured with a domain-based Group Policy, it will take about 20 minutes after Group Policy refreshes (that is, applies any new policy settings to the client computer). By default, Group Policy refreshes in the background every 90 minutes, with a random offset of 0–30 minutes. If you want to refresh Group Policy sooner, you can go to a command prompt on the client computer and type:

gpupdate /force .

For client computers configured with the Local GPO, Group Policy is applied immediately, and the refresh will take about 20 minutes.

After Group Policy is applied, you can initiate detection manually. If you initiate detection manually, you do not have to wait 20 minutes for the client computer to contact WSUS:

wuauclt /detectnow

The wuauclt utility allows you some control over the functioning of the Windows Update Agent. It is updated as part of Windows Update.
The following are the command line options for wuauclt.

Option	Description
/a or /ResetAuthorization	Discards obsolete or corrupt information regarding WSUS server. Good for troubleshooting. Run this command followed by the /detectnow command to reset old registration and force a new one to be made with the WSUS server. Optionally you may also delete the client from the WSUS console, to ensure that all the obsolete or corrupt information is discarded before you make a new registration.
/r or /ReportNow	Sends all queued reporting events to the server asynchronously.
/detectnow	For clients that are already registered in WSUS: this command will force the updates detection, download and installation. For new clients: this command will force the client to register in WSUS server, and then to detect, download and install updates. If Automatic Updates is disabled, this option has no effect.

Useful Links:

[1] Windows Server Update Services 3.0 SP1 (http://technet.microsoft.com/en-us/library/cc708609.aspx)

[2] Updating Windows Update Agent (http://msdn.microsoft.com/en-us/library/aa387285.aspx)

[3] Clients not reporting into WSUS console (http://www.wsus.info/forums/index.php?showtopic=9312)

[4] WSUS Client FAQ (http://www.wsuswiki.com/WSUSClientFAQ)

[5] Configure IIS (http://technet.microsoft.com/en-us/library/cc720452.aspx)

[6] Step 5: Configure Automatic Updates (http://technet.microsoft.com/en-us/library/cc720532.aspx)
[7] Configure IIS (http://technet.microsoft.com/en-us/library/cc720452.aspx)

Troubleshooting WSUS clients

1. Go to %windir%\system32 right-click the file wuaueng.dll and check the version of the WUA.
2. Download the latest WUA from http://update.microsoft.com/redist/wuredist.cab
3. Right-click the downloaded CAB and verify if a Microsoft digital signature is present, to ensure you have an official version of the WUA.
4. Double-click the downloaded .cab file, it should contain a XML file. Open that file and check the clientversion.
5. If you find that you are running with an old version of WUA you should update it. Download the newer version from the URL configured in the XML file for your computer architecture.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\AccountDomainSid
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PingID
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientId

These should be unique on every machine, you can delete them forcing to get new values the next time they are needed. In order to do that, stop the "Windows Update" service, delete them, and start the service again. WARNING: changing the registry keys can lead to severe and irreversible damages on the machine, be very carefull if you decide to do it and, above all, do it at your own risk

2008-08-29 15:26:47.659 UTC Warning w3wp.27 DBConnection.OnReceivingInfoMessage Invalid event dropped. EventInstanceID=E026D48F-2258-49C8-BBAC-50BEEF186600, ComputerID=115659d1-9189-421b-a87e-763057ca4244. Invalid ComputerID.

WSUS 3.0 SP1 delivers new features that enable administrators to more easily manage and deploy updates across the organization. This package installs both the WSUS 3.0 Server and WSUS 3.0 Administration Console components, for all Windows Server 2003 SP1 supported languages. Additionally, the WSUS 3.0 SP1 client is included in all supported client platform languages. You must install the server components on a computer running Windows Server 2008 or Windows Server 2003 SP1 or later. You may install the Administration Console on a remote computer running Windows Vista, Windows Server 2008, Windows Server 2003 SP1, or Windows XP SP2.

WSUS 3.0 SP1 Server Installation on Windows Small Business Server 2003

If you are installing the WSUS 3.0 SP1 product on Windows Small Business Server 2003, follow the instructions in Installing Windows Server Update Services 3.0 on Windows Small Business Server 2003.

Download Here

·         Explicit approval. An administrator can explicitly approve an update for installation to a group of machines.

·         Auto-reapprove revisions. By default, when a new revision of an approved update is synchronized to the WSUS server we move the approval to the new revision. Normally this is what customers want, since new revisions never contain new binaries, just fixes to the metadata that describe how to automate the installation of the update. However we had one incident when a new revision of the Windows Desktop Search update changed the metadata so that the new revision was offered to *all* machines but the old revision was offered only to machines with older versions of Desktop Search installed, which caused it to be deployed more widely than expected for many customers (see http://blogs.technet.com/wsus/archive/2007/10/25/wds-revision-update-expanded-applicability-rules-auto-approve-revisions.aspx for details). Since then, we’ve added processes to ensure this type of change will not happen again. The administrator has direct control over this and can disable the option to auto-reapprove revisions.

o        Warning: turning off auto-reapprove revisions can create problems if the administrator has “definition updates” (signatures) in their synchronization options, because definition updates get created and expired fairly quickly and the expired ones won’t get auto-unapproved. As described in KB 938947, this can quickly lead to having too many updates approved which can cause problems for client-server communication. If auto-reapprove revisions is turned off, the administrator will need to manage revisions themselves; looking for older revisions that are approved and either unapproving them (if the new revision is marked “expired”) or move the approval to the new revision. We have provided a PowerShell sample script at http://www.microsoft.com/technet/scriptcenter/scripts/sus/server/susvms09.mspx that can be used to manage revisions.

·         Auto-approve WSUS updates. Some updates are marked as “infrastructure” updates, which means they are needed by WSUS or WUA for proper detection and scanning for many updates. These updates include MSI 3.1. WSUS creates approval rules to these by default, since they are necessary for the update system to work properly. The administrator has direct control over this and can disable the option to auto-approve WSUS updates. If disabled, WSUS will notify the admin in the home page (TODO list) that there are unapproved WSUS updates, which can lead to infrastructure problems (e.g., if MSI 3.1 is not installed on client machines, then many updates including Office Updates, can’t be properly detected).

·         Auto-approval rules. Administrators can create custom rules to auto-approve updates (e.g., auto-approve all security updates to all computers, or auto-approve all updates to a test target group). The administrator has direct control over this and there are no auto-approval rules enabled by default.

·         Initial client self-update. When a WSUS client’s Windows Update Agent (WUA) first synchronizes  against a WSUS server, it checks if the server has a newer version of the agent available in the servers “self-update” tree. If a newer version is available, the agent will self-update before completing the synchronization. Although Automatic Updates will check for self-update on every synchronization, the self update will only occur on the first synchronization unless the admin explicitly applies an update to the WSUS servers self-update tree (the next scenario).

o        Note: Newer versions of WUA on a particular operating system are backwards-compatible with the older versions of WSUS that support that operating system.  So after WUA self-updates to the latest version, the client can later be managed by an  older WSUS server if desired. The agent never “self-downgrades” (it will stay on the latest version of WUA when talking to an older server).

·         Subsequent client self-updates. The WSUS team may provide an update to the WSUS server itself that modifies the client self-update tree on the server. As of this writing, only two such update have been released; WSUS 2 SP1 (which modified the WSUS 2 self-update tree) and KB 936301 (which modified the WSUS 2 SP1 self-update tree). Such updates flow to the WSUS server as normal updates. If the admin approves such an update for install on the WSUS server, then the WSUS server self-update tree will be updated and subsequently all clients that synchronize against the server will self-update. The administrator has direct control over this since clients will only perform this subsequent self-update if the administrator approves an update to the self-update tree.

·         Update from Microsoft Update. End users on client machines can go to Windows Update or Microsoft Update and install updates (and WUA self-updates) directly. The administrator has direct control over this since they can configure the Windows Update Agent to disallow end-user access to Windows Update and Microsoft Update.

WSUS and AU have log files that allow customers to understand when and why a given update was installed on a machine:

·         The Windows Update Agent has a log file “%windir%\WindowsUpdate.log” with verbose logging on updates that have been installed.

·         WSUS 3.0 has a log file “%Program Files%\Update Services\LogFiles\changes.log” that contains a record of all recent approvals and who made them. If the approval was created automatically (e.g., auto-reapprove revision, auto-approval rule, or auto-approve WSUS updates), the user in the log will be “WSUS Service”.

“Thank you for joining the WSUS 3.0 Service Pack 1 Release Candidate Program and we welcome you to provide feedback on the Service Pack 1 through the channels listed below. By including you in our development process, we can ensure that our products meet the needs of our customers and are reliable.

WSUS 3.0 SP1 addresses a number of product fixes and includes the addition of support for forth coming Windows Server 2008 (code named Longhorn Server).  The release notes on this release can be downloaded along with the build which provides more details on the installation.”

Download Service Pack 1 and Documentation:
The downloads link on the left hand menu will take you to the download page for the following SP1 builds and documentation:
- WSUS 3.0 SP1 Beta x86 Build
- WSUS 3.0 SP1 Beta x64 Build
- WSUS 3.0 SP1 RC ReadMe
- WSUS 3.0 SP1 RC Pre Release License
- WSUS 3.0 Overview Document
- WSUS 3.0 Operations Guide
- WSUS 3.0 Step by Step Guide

Continue Here