Systems Management Server 2.0 (SMS) Software Update Services (SUS) Feature Pack - any users?

[Farley2k]

I am getting sick to trying to run around to every machine and make sure that users have done all the correct patches so I am seriously thinking about setting one of these up. Does anyone around here use this? Is it good, bad, ugly? Easy?

Thanks for any insight.

 

[yruffostsif]

SUS is pretty straight forward, works well for free. Follow the deployment white paper and you should have an easy time. Link

SMS is very complicated and is for the experienced administrators only. And once you go SMS, it's very difficult to get rid of.

 

[Farley2k]

Great! Thanks. It does look straight forward but almost everything does at the begining!

 

[spyordie007]

SUS looks straight forward because it is fairly simple, SMS on the other hand...

 

[bigshooter]

I use the SUS feature pack with SMS 2.0. It took a while to get everything working correctly mainly because Microsoft does not offer an instant gratification button. You have to make sure you get s_scan advertisement to run, and then get the hardware inventory component to run, then get the sync tool to run, then deploy the package with all the updates. I still haven't got it to detect ALL of the needed updates, but it finds most of the ones the machiens are missing.

A much better, although more expensive tool, is the Shavlik update tool that uses HFNetchk. You can push out SP's and security updates. I started using it on my servers to help keep track of who was missing what, but since we have an existing SMS environment, I popped the feature pack on for the clients to get updated. Hopefully I can straighten out the remaining issues and get all the machiens up to date. Make sure you install SMS 2.0 SP5 before using SUS though, it's supposed to decrease the amount of time the hardware inventory update takes (as well as some other things).

 

[SaigonK]

SMS is craqp...no doubt about it. There are other packages out there for less money that do a better job than that bloated junk.

SUS is another story, it works great, but you still need to touch every system to insert the specific registry changes to tell the WUC where to go to for it's patches.
I have been working on it for a few days or so and the log files for the client and server leave allot to be desired.

If anyone has any real info, that would be great! It looks like it is working, but then the log file doesnt tell me squat.

 

[RyanLM]

Actually, as far as SUS goes you can set a Group policy on which SUS Server to connect to, and 2k boxes can download the xp update client pushed by a policy. You dont have to go to each box.

 

[SaigonK]

IF you have a domain that is. 🙂

 

[Relayer]

The registry key you add is confusing me for some reason...

 

[SoulAssassin]

Originally posted by: Relayer
The registry key you add is confusing me for some reason...

I hear that. Why M$ didn't make it a simple 'put the SUS server name here' option under Automatic Updates I don't know.

 

[spyordie007]

Originally posted by: SoulAssassin

Originally posted by: Relayer
The registry key you add is confusing me for some reason...

I hear that. Why M$ didn't make it a simple 'put the SUS server name here' option under Automatic Updates I don't know.

That's why you can set it up using a group policy.

Point-point, clicky-clicky and it's setup across your entire network...

Or if you arent running Active Directory it would also be easy enough to pass around a registry file and import it on the machines you want to use the SUS server on.

-Spy

 

[Colebert]

so why would you need SMS if you have a full bird Active Directory setup you can just push MSI/MSP/ZAP files across to your clients?

 

[mikecel79]

Originally posted by: Colebert
so why would you need SMS if you have a full bird Active Directory setup you can just push MSI/MSP/ZAP files across to your clients?

Because SMS can do much more than just push applications and patches to your PCs. It does inventory, software metering, remote control, reports, logging, etc. It's a very powerful tool.

 

[mikecel79]

Or if you arent running Active Directory it would also be easy enough to pass around a registry file and import it on the machines you want to use the SUS server on.

There's a few other options. If you are on an NT4 domain you can add the ADM file to your system Policy and push it out to the whole domain.

Another option is to write a script to push out the registry change remotely. I have a vbscript for this that you list the machines in a text file and it will run through the list and make the change on all of them. We used this when we deployed SUS because we only had an NT domain and wanted different settings for servers, clients, etc. If anyone is interested in the script you can e-mail me for it.