WUS Expands Patching Portfolio

With its public beta under way, WUS shows off more of its fine-tuned features.

• By Don Jones
• March 01, 2005

I've been a big fan of Windows Update Services (WUS) all along, and Beta 2 confirms my belief that Microsoft is doing the right thing when it comes to patch management. The last time I checked it out, it was in the early beta stage, yet it already showed a lot of promise. Now it's feature-complete, more polished and refined. A public beta is underway to ensure that WUS is stable and as bug-free as possible.

Remember that WUS is simply the new name for Software Update Services (SUS). WUS will update much more than just Windows, however. It will include updates for Office, Exchange, SQL Server, ISA Server and eventually the entire Windows Server System lineup. This broad support comes from version 5 of the Windows Update Web site—which has been renamed as simply Microsoft Update (the new URL is http://update.microsoft.com).

Buffing the Edges
There's nothing really new in WUS Beta 2, but Microsoft has significantly fine-tuned and solidified several aspects of the product. For example, WUS will now offer delta updates. Imagine that update one comes out and modifies three files. Update two comes out and touches those same three files, but only one of them is different from update one. If you've already installed update one, you can get just the difference, or delta, between one and two, which results in a shorter download. This places a bit more overhead on the WUS server, which has to download not only update two, but also the delta. But it will ultimately save a lot of effort for clients, especially those operating over a WAN link.

The major features of WUS haven' t changed, although they work more smoothly in some cases. For example, WUS can scan your client computers and prepare a report of missing updates. Companies that have to deal with compliance issues will truly appreciate this level of reporting depth. WUS also has a restart aggregation feature that bundles updates that require a restart into a single application. This reduces the number of times you have to restart clients and servers. Microsoft' s intent with this feature is to reduce the likelihood of restart-required updates being installed without performing the restart. This can leave Windows in an odd, semi-stable state.

Another cool thing WUS lets you do is target updates to specific computers, which helps you do things like create a test group. You can base your targeting on groups that you define on the WUS server itself. In an Active Directory environment, you can also target organizational units (OUs).

Windows Update Services Version reviewed: Beta 2 Current status: Beta 2 Expected release: First half of 2005

Hard Numbers
Until now, there haven't been any hard numbers available regarding WUS' scalability, mainly because it was still so early in its development cycle. Now we know more.

First of all, the system requirements for WUS are positively paltry. It doesn't require a domain controller, or even an AD domain. It will run on pretty much anything that runs Windows 2000 or Windows 2003. Nearly everyone will have some little server that can do the job. Even on a small server, WUS can support more than 15,000 clients, so scalability is clearly not a factor.

WUS does require SQL Server as its back-end, but that doesn't mean you need to rush out and buy a SQL Server license. It will work just fine with the Microsoft SQL Server Desktop Engine (MSDE), which runs on Win2000 and can support up to a 2GB database. In WUS terms, that's about five to six years of use.

The news is even better running on Win2003, because it supports a WinMSDE engine with no database size limit. Of course, if you have access to a full SQL Server license and want to use it, go right ahead. You'll be able to take advantage of SQL Reporting Services and better administration tools.

Beta Man's Routine Disclaimer: The software described here is incomplete and still under development; expect it to change before its final release—and hope it changes for the better.

Security by Signature
WUS is built around a fairly robust security model. On the theory that you don't care who receives updates, WUS doesn't attempt any kind of client authentication. It does, however, let you distribute updates over an encrypted channel using HTTPS.

The biggest fear in a product like WUS is that updates may be modified or corrupted in transit. WUS combats this by only downloading updates that have a Microsoft digital signature. Those updates are made available to clients only if the signature matches the update, meaning the update hasn't been altered. The updates also have to match a checksum included in the update description. This ensures that WUS gets the updates it's expecting.

Scripting Access
WUS is so much more than its predecessor SUS, it's hard to believe Microsoft is still giving it away for free. (Not that I'm complaining, mind you.) For example, WUS includes a complete application programming interface that makes it accessible to third-party software developers and administrators writing scripts. The client-side of WUS is exposed through the Component Object Model (COM), an application model that is easily accessible to scripting languages like VBScript.

The server side is exposed through Microsoft' s managed .NET Framework. It's less scriptable for now, but easier for third-party software developers to integrate.

The very term third-party integration may send shivers up your spine. Does that mean you can use WUS to update more than just Microsoft products?

Not exactly; you must understand that all updates pushed out through WUS ultimately come from the Microsoft Update Web site. You're unlikely to find Microsoft shipping updates for other people's products. What third-party developers can do is leverage WUS technology to create a parallel update-distribution system, provide management tools for WUS or integrate WUS management into other products.

Wanted: Betas for Review Beta Man is always on the lookout for quality products to review. If you know of a software product that is currently or soon to be in beta, contact Beta Man at [email protected]. Vendors are welcome, but please act early—the meticulous Beta Man needs plenty of lead time.

Clients, Compatibility and Coexistence
The new WUS client exists only in WinXP SP1 and Win2003 SP1. Other clients are likely to already have the Automatic Updates client, so the new client would be the first thing WUS pushes out to them. The practical upshot is that you can install WUS and have it running immediately. It will take care of updating whatever needs updating.

WUS will carry updates for nearly every version of Windows that is still supported, including Win2000, WinXP, Win2003, Small Business Server and even the 64-bit versions of Windows (both Itanium and x64). WUS will also coexist with SUS if you need it to, which lets you roll out WUS as gradually as you like.

WUS is shaping up to be a solid addition to any enterprise. It complements Microsoft Systems Management Server and can work in nearly any Windows environment—Win2000, Win2003, AD or non-AD, whatever you have. It' s easy to install, easy to deploy and easy to operate. Most importantly, it makes the daunting task of patch management relatively easy, and that' s good news for everybody.