How will SP2 be a forced update after March ?

[WT]

And so the rollout process is in its earliest stages here at work (and I do mean early) ...

Situation:
I work in a school district with 700 Win XP PCs. They were manually updated to SP1 a while back, but obviously SP2 would be better suited to roll out over our network. The network hit will be huge so we will need to do this after school hours as well, or on a very limited basis (possibly by department).


Particulars:
We run Novell 6 on our servers, but do not have Zenworks currently set up to roll out SP2. We will soon be testing that to see if it is a viable rollout strategy. Plus, the bugs and kinks will obviously need to be addressed. The PCs all have local security installed to keep end user installs from happening, so far with positive results, but of course this adds a significant layer of problems to an SP2 rollout. My guess is we will need to disable this or log in ourselves as Admin on each PC to disable the security application.

Further bad news:
I've read many horror stories of SP2 updates on PCs that were burdened with spyware/malware. Like I mentioned above, the security app does a good job on certain things, but I'm sure each PC has traces of spyware, but they are not completely swamped with it also.

End Result:
So my thinking is we should roll out a spyware cleaner to each PC (assuming for one, this is necessary, and also that it works well with Zenworks in an automatic mode requiring no user intervention). Then once they are clean, roll out SP2 on a department level.

My Questions:
In conclusion, what will Microsoft do if we do not manage to roll out 700+ SP2 installs by the end of March ? We have turned off Auto Updating on all client PCs so MS should not be able to force it upon us. Also, since each user is made a standard or power user by Novell, they will not be able to install it based on the understanding that Windows XP requires the Admin acount to be logged in to perform those updates. In man hours, we could spend the next 3 weeks loading SP2 manually and not be done by March, so I'm quickly trying to to find out the ramifications of not getting the update done on time. Any help would be greatly appreciated guys !

 

[daveshel]

You could use ZenWorks or the NAL to reverse the reg fix in phases by groups, depending on your OU structure. We are in a similar environment but with only 150 users, but we are quite concerned that we get it done before the reg fix expires because of bandwidth and user freakout considerations.

 

[spyordie007]

Microsoft wouldnt do anything.

I'm not sure what you mean about it being "forced" out. They have never done anything like this (nor would they have a way to do it).

Perhaps you're thinking about machines with the automatic update feature turned on and the registry key:
When SP2 was released Microsoft came out for a way to force SP1 clients to not pick up the update if they already had automatic updates enabled and pulling directly from the MS site (a registry entry). The purpose of this was to give you more time to deploy SP2 manually if you so desired. That temporary block will be ending in April:
http://www.microsoft.com/techn...maintain/sp2aumng.mspx

 

[spyordie007]

Why not do a small-scale deployment to some of the clients to see how well then would handle it?

 

[stash]

I replied to your thread over at Ars. Basically, I'm not sure where you heard that FUD, but if you have AU disabled, nothing is going to happen. And if you had AU enabled and didn't have the registry in place to block SP2, you would've gotten it already.

 

[WT]

spy, we are in the process of doing that probably next week. The problem right now is loading the appropriate Zenworks software onto each server to do the rollouts. Obviously, the first place to test is in an isolated environment on its own network, but we don't have enough spare PCs to really mirror the hardware that the teachers have.

StaSh, thanks for the confirmation on my FUD.... I was under that distinct impression as well, but you know how the IT departments go .. everyone on the administrative end wants it rolled out by the time MS 'demands' that its end users should have it. We have AU disabled simply because in its current iteration, no end users are admin equiv, consequently they cannot do a Windows Update.

Thanks for the helpful replies all !!

 

[spyordie007]

We have AU disabled simply because in its current iteration, no end users are admin equiv, consequently they cannot do a Windows Update.

You can push the WU client settings automatically with group policy; setting it to download and install the updates automatically (without user interaction) as well as a number of the parameters for the installer (like what to do if the machine is shut down during the install time or weither to automatically reboot if neccisary).

For that many clients you should also really be looking into a real patch management system; SUS/WUS would be a great place to start and dont require expensive licensing. It would also give you controll of what updates to give to the clients and at what time.

-Erik

 

[WT]

spy, SUS works great ... on a Windows network. We are strictly a Novell shop, and we have to update Zenworks on each server just to be able to get to the point where we can send the MSI to each client PC. Currently, we've found a workaround that allows us to add a script to the MSI and login remotely as admin equiv. In theory, it should work well, but with a huge 270+ meg patch to swallow, even a 100m switch will take some time to deploy to each department.

 

[stash]

SUS should work fine on a Novell network. You won't be able to push out the SUS settings to the clients with a GPO, but you can script it pretty easily.

 

[spyordie007]

In theory, it should work well, but with a huge 270+ meg patch to swallow, even a 100m switch will take some time to deploy to each department.

Another advantage to using SUS would be that this would become a non-issue.

Like Stash said you dont need Active Directory to use SUS, the registry settings for configuring the clients are on the SUS website and you could easily script a .reg merge on your Novell network that configures the clients.

Not that I'm trying to push SUS on you; it just that SUS works very well for this type of thing.