|
|
Hi,
I've been using WSUS 3.0 now for couple of weeks, and I've to say that it's
a great upgrade from WSUS 2.0. Appearence is much simplier and effective.
Only thing I'm really missing from it is a few important details at Updates
Report for WSUS/Update Detailed Status Report. If you check single update
Detailed report, it does not include the date when update was published nor
if it's superseding/superseded by some update. It's a bit annoying when you
hunt down the chain of superseded updates. So the only way to determine this
detail is to go main window (Updates->All Updates) where manually search for
that update, as if you choose for "Search" function it opens the update as in
"Update Detailed Status Report" where as I said before there is no info
regarding those two details.
|
|
"Erno P." <Erno P.[ at ]discussions.microsoft.com> wrote in message
news:5A50FFD3-DB24-4705-855D-EA91BC0FA915[ at ]microsoft.com...
[Quoted Text] > Hi,
>
> I've been using WSUS 3.0 now for couple of weeks, and I've to say that
> it's
> a great upgrade from WSUS 2.0. Appearence is much simplier and effective.
>
> Only thing I'm really missing from it is a few important details at
> Updates
> Report for WSUS/Update Detailed Status Report. If you check single update
> Detailed report, it does not include the date when update was published
> nor
> if it's superseding/superseded by some update.
The Publication Date (to WSUS3), as well as the Arrival Date, are available
as user-customized columns in the updates listing. Right click on the column
header to get a list of additional columns you can enable (or disable).
Information about supercession is contained in the update details screen --
where it's always been -- as well as by use of an (updated) icon contained
in a column called Supercedence, which will indicate updates that supercede
others, updates that are superceded, updates that are both superceded and
superceding, as well as those updates that are neither.
--
Lawrence Garvin, M.S., MCTS, MCP
Independent WSUS Evangelist
MVP-Software Distribution (2005-2007)
https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, almost everything else is at
http://wsusinfo.onsitechsolutions.com
.....
|
|
"Lawrence Garvin (MVP)" wrote:
[Quoted Text] > "Erno P." <Erno P.[ at ]discussions.microsoft.com> wrote in message > news:5A50FFD3-DB24-4705-855D-EA91BC0FA915[ at ]microsoft.com... > > Hi, > > > > I've been using WSUS 3.0 now for couple of weeks, and I've to say that > > it's > > a great upgrade from WSUS 2.0. Appearence is much simplier and effective. > > > > Only thing I'm really missing from it is a few important details at > > Updates > > Report for WSUS/Update Detailed Status Report. If you check single update > > Detailed report, it does not include the date when update was published > > nor > > if it's superseding/superseded by some update. > > The Publication Date (to WSUS3), as well as the Arrival Date, are available > as user-customized columns in the updates listing. Right click on the column > header to get a list of additional columns you can enable (or disable). > > Information about supercession is contained in the update details screen -- > where it's always been -- as well as by use of an (updated) icon contained > in a column called Supercedence, which will indicate updates that supercede > others, updates that are superceded, updates that are both superceded and > superceding, as well as those updates that are neither. > > -- > Lawrence Garvin, M.S., MCTS, MCP > Independent WSUS Evangelist > MVP-Software Distribution (2005-2007) > https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E> > Everything you need for WSUS is at > http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx> > And, almost everything else is at > http://wsusinfo.onsitechsolutions.com> ..... > > > > Yes I know that these information can be found in updates listing. My point was that this same info is missing in Status report.
Here is an example when this problem appears. Computer that hasn't reported
for a while reports to WSUS. Let's say it's missing 15 updates. As so when I
check list of its missing updates (through Computers->select computer->its
Status report->in Detailed view->2nd page where WSUS lists updates that
computer do have or do not have) I see that it's needing KBxxxx update. But
then I notice that update KBxxxx is "Not approved", but still this computer
shows it's needing it. Now I want to check reason why it's not approved. One
reason could be that some other update supersedes it. Now I'm in point where
Superseding information at Status report would have been appropriate. Ok
still it's pretty easy. I take the KB number what this computer is
requesting, and then I go to Updates section and manually search the update
(manually because Search function only open the same Status report page that
doesn't include needed info). Then I find it and there yes I see that some
update supersedes it, but now if I choose the link for superseding update it
once again opens the status report that's missing important info about
possibility of another supersede. So once again I have to manual search this
new update to be sure that a) it's not superseded b) if not at least it's
approved so c) I can finally close the chain and relax, because I know that
one of those 15 updates includes the update that supersedes the "not
approved" one.
Hopefully this doesn't sound too complicated :)
|
|
"Erno P." <ErnoP[ at ]discussions.microsoft.com> wrote in message
news:29F43145-F196-4C7A-9C2E-42A2E4ADFAC7[ at ]microsoft.com...
[Quoted Text] > Here is an example when this problem appears. Computer that hasn't
> reported
> for a while reports to WSUS. Let's say it's missing 15 updates. As so when
> I
> check list of its missing updates (through Computers->select computer->its
> Status report->in Detailed view->2nd page where WSUS lists updates that
> computer do have or do not have) I see that it's needing KBxxxx update.
> But
> then I notice that update KBxxxx is "Not approved", but still this
> computer
> shows it's needing it. Now I want to check reason why it's not approved.
There's only one reason why it's not approved: Because nobody marked it as
approved. If the update is needed, then either you're going to approve the
update (e.g. a Security Update), or maybe you're not (e.g. Internet Explorer
7). Click on the "Not Approved" hyperlink, open the Approval dialog box, and
confirm that the appropriate groups have the correct approval status. Click
on OK. Click on Close. Done.
> One reason could be that some other update supersedes it. Now I'm in point
> where
> Superseding information at Status report would have been appropriate. Ok
> still it's pretty easy. I take the KB number what this computer is
> requesting, and then I go to Updates section and manually search the
> update
> (manually because Search function only open the same Status report page
> that
> doesn't include needed info). Then I find it and there yes I see that some
> update supersedes it, but now if I choose the link for superseding update
> it
> once again opens the status report that's missing important info about
> possibility of another supersede. So once again I have to manual search
> this
> new update to be sure that a) it's not superseded b) if not at least it's
> approved so c) I can finally close the chain and relax, because I know
> that
> one of those 15 updates includes the update that supersedes the "not
> approved" one.
>
> Hopefully this doesn't sound too complicated :)
Nope.. it doesn't, but I think you've made it a *lot* more complicated than
it needs to be.
Consider this "best practice" when initially setting up a WSUS3 server.
[1] Select the "All Updates" list. Enable the "Supercession" column. Sort on
the "Supercession" column. DECLINE all superceded updates, except those you
specifically still need enabled. (For example, I'm not yet rolling out
Windows Server 2003 Service Pack 2 to all of my servers, so I did not
decline all superceded updates, because some of them are superceded only by
Win2003SP2.) Now, the above "...could be that some other update supercedes
it" is no longer a question, because only the *latest* updates are in your
not-declined list.
[2] Sort the remaining list by status. Those that are 100% Installed/Not
Applicable, you can either leave at "Not Approved" (you might need them
someday -- for example when a new machine is deployed) or you can "Decline"
them (if you'll never install them no matter what). Those that are "Needed",
select 'em and mark them "Approved".
Note: To make the above process even simpler, perform your initial WSUS
synchronization in stages. Also, build Custom Update Views as needed, so
that you can work with filtered lists of updates.
For example, work with your special purpose or special platform machines
first. I configured synchronization for only Critical and Security Updates.
I configured synchronization for only the product group "Small Business
Server". Made a custom Update View for "SBS2003" updates. Approved the ones
I needed, Declined the ones I didn't, and made sure the SBS2003 system was
up to date.
Then, I added SQL Server updates. Made a custom Update View for "SQL
Updates". Approved the ones I needed, Declined the ones I didn't, and made
sure my database server(s) were up to date.
Then I added Exchange 2003 updates. Made a custom Update View for "Exchange
Updates". Approved the ones I needed, Declined the ones I didn't, and make
sure my Exchange server was up to date. I also created an auto-approval rule
for Exchange IMF updates.
Then I added the rest of the Windows Server 2003 critical and security
updates. Made a custom Update View for "Windows 2003 Updates". Declined the
ones I didn't need; approved the ones I did need, including those that were
superceded by Windows Server 2003 Service Pack 2 (which, as noted, I'm not
installing to my legacy machines -- I'm going through a server rebuild
cycle -- which I usually due when an OS service pack is released).
Then, I added Windows XP updates, made a custom Update View for "Windows XP
Updates", and did the same thing for my desktop systems.
Finally, I added "Service Packs" to the synchronization list, made a custom
Update View for "Service Packs", and approved the ones I needed for my
"UnderConstruction" group so that Win2003SP2 will be applied to all of my
*new* Windows 2003 servers.
I also built two additional custom update views "Approved CritSec Updates"
and "Approved Other Updates". These two views show the status of only the
updates that I have =approved=, so I can see at a glance whether all of my
=approved= updates have been installed, or not.
NOW.... let's visit your scenario above. Computer that hasn't reported for a
while finally does so. It has 15 updates reported as "Needed". First thing:
You've already approved any other updates that were needed, so if this
computer has updates that are "Needed", they must be in the batch that was
previously "100% Installed/Not Applicable". They can't be in the superceded
batch because you've already declined them, so they'll never show up in a
"Needed" list. At that point, who cares *why* it's Not Approved -- the
simple fact is: It needs to be! Mark the update as approved for the group
containing the newly reporting computer.
--
Lawrence Garvin, M.S., MCTS, MCP
Independent WSUS Evangelist
MVP-Software Distribution (2005-2007)
https://mvp.support.microsoft.com/profile=30E00990-8F1D-4774-BD62-D095EB07B36E
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, almost everything else is at
http://wsusinfo.onsitechsolutions.com
.....
|
|
|