Summary

The Microsoft-recommended four-phase patch management process, documented in Microsoft Solutions for Management 2.5, describes a process that can be applied to organizations of all sizes. The four phases, Assess, Identify, Evaluate & Plan, and Deploy, contain prescriptive steps that the organization should follow to ensure successful updates to the configuration of the production environment.

The vulnerability rating for every alert received by an organization’s patch management team should be examined for guidance on the level of attention that the software update should receive. The team should look at mitigating factors and factors inherent to their production priority and assign a release priority to the update. The update then needs to be tested and accepted and a release plan developed before deployment can begin. After an update has been successfully applied to systems in the production environment, the organization needs to update the secure baseline configurations for its IT assets and use them when deploying new systems.

SMS 2003 can be extended with the Security Update Inventory Tool and the Microsoft Office Inventory Tool for Updates, both part of the Software Update Scanning Tools download available from Microsoft. The extensions allow SMS to scan clients for recommended security and Office updates from Microsoft and report centrally which updates have been installed and which updates should be installed. The Distribute Software Updates Wizard allows the SMS administrator to quickly build packages containing software updates and advertise them to SMS clients.

Each organization should expect and plan for emergency situations in which a software update has to be deployed in an expedited fashion, or a previously deployed update needs to be rolled back. In both situations, the patch management team should follow through with its patch management process to guarantee the integrity of the production environment.

Scripting an installation is a significant requirement for most organizations that want their package distribution or software updates to be “hands-off” to the user. Chapter 14, “Microsoft Systems Management Server Installer,” introduces a utility that can assist you in creating a fully scripted and unattended installation package for SMS to distribute—the SMS Installer.