Configuring Windows 7 (Training Kit) - Part 64 ppt

n Never Check For Updates Not recommended Windows Update does not check for updates, but updates can still be checked for and installed manually.. FIgUre 12-4 Changing how Windows can in

n Optional Updates Optional updates provide items such as driver updates and

language packs Figure 12-3 shows the Russian Language Pack, which is an optional

update for Windows 7

FIgUre 12-3 Optional language pack update

How Windows Update deals with this update depends on how you have configured update

settings You can manually configure how Windows Update deals with updates by clicking

the Change Settings item This opens the Change Settings dialog box, shown in Figure 12-4

Through this dialog box, you can configure how Windows 7 deals with important updates, the

frequency at which updates are checked, whether recommended updates are treated in the

same fashion as important updates, and whether users without administrative privileges are

able to install updates on the computer Only users with administrative privileges are able to

change Windows Update settings The options that you can configure with this dialog box are

as follows:

n Install Updates automatically (recommended) Windows Update installs updates

automatically at the time specified This is the default setting for Windows Update

n Download Updates But Let Me Choose Whether to Install them Updates are

downloaded to the computer, and the user is notified that the updates are available for

installation

n Check For Updates But Let Me Choose Whether to Download and Install them The

user is notified that updates are available for download and install

n Never Check For Updates (Not recommended) Windows Update does not check for

updates, but updates can still be checked for and installed manually

n give Me recommended Updates the Same Way I receive Important Updates This

means that Recommended Updates are treated in the same manner as Important

Updates Optional updates still need to be installed manually

n allow all Users to Install Updates On this Computer This option is enabled by

default If you disable this option, only user accounts that are members of the local

Administrators group can install updates

FIgUre 12-4 Changing how Windows can install updates

The View Update History control panel, shown in Figure 12-5, allows you to view a list of all updates that have been successfully or unsuccessfully installed on a computer, as well as the date they were installed and their importance classification Clicking on an update within the View Update History control panel allows you to find out more information about the update This information provides a summary of the update and also provides a link to a Knowledge Base article that also provides detailed information about the update Knowledge Base articles also provide information about any potential problems that an update might cause If you install an update on a client running Windows 7 and start experiencing problems, you should consult the Knowledge Base article related to the update to determine if these problems have been documented and if there are any workarounds to deal with the issues related to the update Knowing the Knowledge Base ID of an update is also important if you want to delete the update The Knowledge Base ID is a six-digit number, often preceded by the letters KB, such as KB123456

When reviewing updates that are available for installation, you can also right-click an update and select Hide Update Choosing to hide an update effectively declines the update This means that the update does not install and that Windows Update does not present that particular update for installation through Windows Update in the future Only users with Administrative privileges are able to hide updates Declining an update does not mean that the update cannot be installed at a later stage Through the Restore Hidden Updates item

in the Windows Update control panel, you are able to restore updates that were hidden in the past Restoring a hidden update means that the update will be available the next time an update check occurs The Restore Hidden Updates control panel is shown in Figure 12-6

FIgUre 12-5 Viewing update history

FIgUre 12-6 Restoring hidden updates

It is possible to uninstall an update that has already been installed A user who is a member

of the local Administrators group can uninstall an update This is done through the Programs

and Features control panel You can also access this panel by clicking the Installed Updates

item in the Windows Update control panel Unlike the View Update History dialog box, you are

presented only with the Knowledge Base identifier of the update This means that you must

know the Knowledge Base identifier of an update to uninstall it As you learned earlier, you

can determine the Knowledge Base identifier of a particular update by using the View Update

History control panel and double-clicking the update This displays an update information dialog box from which you can determine the Knowledge Base ID, as shown in Figure 12-7

FIgUre 12-7 Update information

When you uninstall an update, it does not appear in the list of hidden updates, but it does become available again if you check for new updates It is important to remember to hide any update after you uninstall it For example, you might install an update only to find that

it causes a conflict with some custom software deployed in your organization You choose to uninstall the update to restore the functionality of the custom software You can then use the Hide Update function to hide the update until the software vendor is able to develop a fix that makes the custom software compatible with the update This will ensure that other users who have the ability to install updates do not inadvertently install the update until the custom software fix is available Figure 12-8 shows the Installed Updates control panel, from which you can uninstall an update

Updates for Other Microsoft Products

The default Windows Update settings retrieve updates only for the Windows operating system

and included applications You can upgrade Windows Update so that updates for all Microsoft

software, including Microsoft Office, can be detected and installed through Windows Update

To do this, click the Find Out More item next to Get Updates For Other Microsoft Products

This opens a Web page that hosts an update allowing you to extend the functionality of

Windows Update Installing this update adds a section to the Change Settings control panel,

shown in Figure 12-9, that allows Windows Update to provide update for other Microsoft

products It is also possible for Windows Update to deliver updates that are available from an

alternate update source like WSUS You will learn about WSUS later in this chapter

FIgUre 12-9 Updates for other Microsoft products

Configuring Windows Update to Use a Proxy Server

Occasionally, on networks that have specific firewall and proxy configurations, Windows

Update clients are unable to contact the Microsoft Update servers on the Internet There are

several ways to deal with this problem The first is to deploy a WSUS server on the local area

network (LAN) and have the clients download updates from the WSUS server When setting up

the WSUS server, you can configure it to use the proxy Alternatively, it is possible to configure

a client running Windows 7 manually so that Windows Update can communicate with the

Microsoft Update servers through the proxy Although you can configure Internet Explorer to

use a proxy through Internet Options, Windows Update cannot use these settings directly You can configure clients running Windows 7 to determine proxy settings in two ways:

n Use Web proxy auto Detect (WpaD) This feature allows computer services to locate

an available proxy by querying a Dynamic Host Configuration Protocol (DHCP) option

or checking a Domain Name System (DNS) record

n Use the Netsh.exe command-line tool Although Windows Update does not use the Internet Options settings directly, you can use the Netsh exe command-line tool to import the proxy settings configured for Internet Explorer To accomplish this goal, use the following command from an elevated command prompt:

netsh winhttp import proxy source=ie

More Info WeB prOXY aUtO DeteCt

For more information on configuring Web Proxy Auto Detect on DNS and DHCP servers,

consult the following document on Microsoft TechNet: http://technet.microsoft.com/en-us/

library/cc713344.aspx.

Installing Windows 7 Update Files Manually

In some cases, such as when you are dealing with stand-alone computers that are not

connected to a network, it is necessary to install update files directly You can download Windows 7 update files directly from Microsoft’s Web site You can find these updates related

to each update’s security bulletin Update files have the msu extension If you want to script the installation of a number of MSU files, you can use the Wusa exe utility When chaining the

installation of updates, you should use the /norestart parameter after each update except the

last one that you want to install For example, you might have a script that installs three updates with the commands:

Wusa.exe d:\windows6.1-kb123456-x64.msu /quiet /norestart

Wusa.exe d:\windows6.1-kb123457-x64.msu /quiet /norestart

Wusa.exe d:\windows6.1-kb123458-x64.msu /quiet

More Info WINDOWS UpDate StaND-aLONe INStaLLer

For more information about the Windows Update Stand-alone installer (Wusa.exe), consult

the following article: http://support.microsoft.com/kb/934307.

quick Check

n Which Windows Update–related tasks can a user with standard privileges complete? quick Check answer

n A user with standard privileges is able to install updates A user with standard privileges is unable to hide or uninstall updates A user with standard privileges cannot change update settings.

Action Center

Action Center, shown in Figure 12-10, provides a central reporting area for problems related

to security and maintenance Action Center notifications appear in taskbar balloons that

remind users that they should address certain issues related to their computer Action Center

can provide security and maintenance warning messages on the following subjects:

n Windows Update

n Internet security settings

n Network firewall

n Spyware and related protection

n User Account Control (UAC)

n Virus Protection

n Windows Backup

n Windows Troubleshooting

FIgUre 12-10 Action Center

Action Center relies upon the Security Center service being active If this service is not

active, the Action Center does not function Other networking services, such as Network

Access Protection (NAP), which is used to keep computers that do not have updates installed

from connecting to either local corporate networks or virtual private networks (VPNs)

also rely on the Security Center service being active A user with administrative privileges can configure Action Center to customize which message types are displayed, as shown in Figure 12-11 You can reach this dialog box by clicking the Change Action Center settings item

in the Action Center Control panel You will learn more about Action Center in Chapter 13, “Monitoring and Performance ”

FIgUre 12-11 Action Center settings

Understanding Windows Server Update Services

Windows Update retrieves updates from the Microsoft Update servers on the Internet Although this configuration works well for small deployments, when there are more than

10 computers running Windows 7 in a single location, you can make significant bandwidth savings by deploying a centralized software update solution like Windows Server Update Services (WSUS), System Center Essentials, or System Center Configuration Manager (SCCM)

2007 These products function as a local Microsoft Update server Rather than each client downloading the same update over an organization’s Internet connection, the local update server can download an update once to the LAN, and then each client can retrieve the update off the local update server Because System Center Essentials and SCCM software update deployments build off WSUS, this lesson concentrates primarily on WSUS Clients running Windows 7 require that the WSUS server be running WSUS 3 0 with Service Pack 1 or later

More Info SCCM 2007

To learn more about SCCM 2007, navigate to the following Web site: http://www.microsoft

.com/systemcenter/configurationmanager/en/us/default.aspx.

WSUS allows administrators to deploy updates according to a schedule that best meets

the needs of the organization A drawback of relying on Microsoft Update is that updates are

released according to Microsoft’s schedule, which does not give an organization time to test

that an update is fully compatible with their client computers if Windows Update has been

configured to install any detected updates When an organization uses WSUS, it can test an

update on a small group of computers before deploying it to all computers in the organization

Figure 12-12 shows the WSUS server console on a computer running Windows Server 2008

FIgUre 12-12 WSUS server console

In many WSUS deployments, an administrator takes control of updates centrally This means

that the decision as to which updates to install and when to install them occurs centrally rather

than on each client computer Administrators can enforce these decisions through update

policies You will learn about configuring update policies later in this lesson

WSUS allows administrators to organize client computers into groups Groups allow for the

staggered deployment of updates This means that you can deploy updates on some computers

but not on others You create groups on the WSUS server After the groups are created on

the WSUS server, you can configure a client to join a group by configuring the Enable Client

Side Targeting policy, which you will learn about later in this lesson, or by manually assigning

computers to groups using the WSUS console, as shown in Figure 12-13

FIgUre 12-13 WSUS computer groups

WSUS also allows administrators centrally to roll back the installation of an update across all computers in the organization For example, if an update causes a problem in an organization that relies only on Microsoft Update, administrators have to uninstall and then hide the update on each computer in the organization manually If an update causes a problem in an organization that uses WSUS, the update administrator can roll back the update from WSUS, which removes that update from all client computers in the organization It is not necessary to hide a rolled back update because the WSUS server makes approved updates available only

to Windows Update clients

More Info WSUS

To learn more about WSUS, consult the Windows Server Update Services TechCenter at the

following Microsoft TechNet address: http://technet.microsoft.com/en-us/wsus/default.aspx.

Windows Update Policies

Although you can configure some settings, such as when the computer will check for updates and how the computer will deal with updates using the Windows Update Control Panel, you configure most Windows Update settings by configuring Group Policy The Computer Configuration\Administrative Templates\Windows Components\Windows Update Group Policy node contains 16 policies, as shown in Figure 12-14

You can configure Windows Update using these policies as follows:

n Do Not Display “Install Updates and Shut Down” Option In Shut Down Windows Dialog Box This policy allows you to configure whether the Shut Down menu displays the Install Updates And Shut Down option The default setting has this option available

n Do Not adjust Default Option to “Install Updates and Shut Down” in Shut Down Windows Dialog Box When this policy setting is enabled, the user’s last shutdown choice is the default shutdown option When this policy setting is disabled or is not