Microsoft Patch Management

The end of patching the patch


Friday, August 08, 2003
One Small Step For Microsoft …
By Mary Jo Foley

And one giant leap toward simplifying patch management, when Microsoft Installer 3.0 goes to beta next month.



Microsoft is taking another step towards its goal of simplifying software-patch management across its product line.
Next month, the company will begin beta testing its Microsoft Installer 3.0 technology, according to beta information cited by various Windows enthusiast sites, including Steven Bink's Bink.nu.

ADVERTISEMENT[AD]



If Microsoft sticks to plans it articulated earlier this year, MSI 3.0 will become one of two software-installation programs backed by the Redmond software juggernaut. At present, Microsoft supports at least eight different installers across its various product lines.

Microsoft's current software-patch management strategy is a scattershot one, as many company officials themselves admit. More often than not, the latest patches and software updates break users' existing systems. And Microsoft's patches and service-pack updates tend to be hard to find, difficult to deploy and a pain to manage. The "Slammer" virus, which spread like wildfire as a result of unapplied SQL Server patches epitomizes why software patching needs an overhaul.


Microsoft currently offers customers of different sizes different ways to automate their patch-management procedures:


Consumers and small businesses can subscribe to the company's Windows Update feature in order to obtain user-initiated or automatically delivered software updates. (Microsoft offers a similar Office Update feature for SOHO Office customers.)

Mid-size businesses running Windows 2000 and/or Windows XP can partake of Microsoft's Software Update Services (SUS) offering.

Enterprise-size companies can obtain patches and updates by having them pushed to them, via Microsoft's Software Management Server (SMS) and SMS Software Update Services Feature Pack.
In the coming few months, Microsoft will be undertaking a massive revamp of its patching mechanisms across all of its product lines, company officials have said.

"We are developing a site-as yet unnamed-that will provide scripted patch delivery for all of our core products," Jeff Jones, senior director of Microsoft's Trustworthy Computing Initiative within the company's Security Business Unit, told Microsoft Watch earlier this year. The site is expected to be a central patch repository, a kind of "Corporate Update Service" for enterprise customers of all types of Microsoft products, company officials have hinted.

Around the same time Microsoft launches this all-purpose patch site, it also will deliver a major update to its SUS offering. SUS 2.0 will be expanded to handle patching for all products, not just for Windows as is currently the case, Jones said.

At the same time, Microsoft is building the Software Update Services Feature Pack into the base SMS 2003 product. This feature pack includes a security update inventory tool; Microsoft Office Inventory Tool for Updates; Distribute Software Updates Wizard; and a Web-Enabled Reporting Tool for Software Updates.

And there's more, Jones said. Microsoft is has refreshed its Security Bulletin Web site to allow users to select a particular product and service pack and have delivered to them all of the patches that apply to that combination of products in a quicker and more streamlined manner.

Microsoft also is working to get its Installer story in line, which should help in applying and running software patches and updates. Currently, Microsoft has myriad installers that handle application installation and customization quite differently. But the goal is to whittle this number down, Jones says.

"Over time, we want to insure uniformity in installation scripts and in behavior," Jones says. "Over the long term, we want to drive down to one or two installers and commit to them."

According to the MSI 3.0 beta-site information, the 3.0 release will support the removal of small and minor patches and updates. Microsoft is telling testers that patches installed with MSI 3.0 will "take substantially less time to apply as compared to previous versions." With 3.0, users will be able to patch without doing a full product reinstall, as the installation engine will be able to distinguish between product repair and product patching, according to the Microsoft site.

<< Back to home

 

I foresee troublesome times ahead! lol