Yeah, no IIS on a DC. Also no magic updates on DC's. Do them slow and purposely and methodically. Last thing needed is to walk in one morning and find out your automatic patch system just loaded something that blue screens DC's to your entire domain and not being able to log on anywhere to do anything about it.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan Sent: Saturday, September 20, 2003 2:39 PM To: [EMAIL PROTECTED] Raymond, Good question - I hope that I can provide a good answer. I would NOT suggest or recommend deploying SUS to a DC for one simple reason: It requires IIS, and for security purposes, I will not deploy IIS onto a domain controller - which clearly dismisses a DC from hosting SUS IMHO. Rick Kingslan MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.microsoft.com/windowsxp/expertzone -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Raymond McClinnis Sent: Saturday, September 20, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now I have a somewhat silly question on SUS... Would anyone recommend against installing it on a DC? And if so, I curious as to why (other that the obvious things, like it's a DC :) ) Thanks, Raymond McClinnis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Shaff Sent: Friday, September 19, 2003 12:54 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now You will have to setup two SUS servers. One in a dev environment and one on the corporate network. The dev SUS will get the updates directly from MSFT and then once approved, the other SUS will be able to pull those updates for the corporate clients. **************************************** Steve Shaff Active Directory / Exchange Administrator Corillian Corporation (W) 503.629.3538 (C) 503.807.4797 (F) 503.629.3674 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adams, Kenneth W (Ken) Sent: Friday, September 19, 2003 10:47 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now Yes. Kenneth W. (Ken) Adams, MCSA, MCSE -----Original Message----- From: Rod Trent [mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 12:28 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now Aren't we saying the same thing, then? Updates deployed to test environment, then approval, then deployment to production. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adams, Kenneth W (Ken) Sent: Friday, September 19, 2003 11:45 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now Not if your SUS server is used to supply the fixes to your test environment. Kenneth W. (Ken) Adams, MCSA, MCSE -----Original Message----- From: Rod Trent [mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 9:22 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now The approval in the change management process should be before the update is even deployed -- after testing against applications, services, infrastructure, rollback, etc. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adams, Kenneth W (Ken) Sent: Friday, September 19, 2003 8:30 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now It's also good if you have a Change Management process that requires a CM record be created and approved by a review board before the actual installation occurs. Ken A., MCSA, MCSE -----Original Message----- From: Rod Trent [mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 7:49 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now That's good if you have a minimal number of servers. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adams, Kenneth W (Ken) Sent: Friday, September 19, 2003 7:42 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] SUS does SPs now I'll be setting up SUS SP updates to servers, only I set my servers to download and notify, not to automatically install and boot. I keep control that way. Ken A., MCSA, MCSE -----Original Message----- From: Henderson Richard [mailto:[EMAIL PROTECTED] Sent: Friday, September 19, 2003 7:13 AM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] SUS does SPs now As it will only run on W2KSP2+ Clients SMS is still needed for NT4 Clients. But another question, how many here will setup SUS SP updates to Servers? i.e 100 servers all being rebooted at 3am Sunday morning ?? -----Original Message----- From: Graham Turner [mailto:[EMAIL PROTECTED] Sent: 19 September 2003 09:44 To: [EMAIL PROTECTED] Subject: Re: [ActiveDir] SUS does SPs now Have just picked up on this thread of SUS - looks a real winner would be glad for the views of the positioning of this product relative to SMS ?? GT ----- Original Message ----- From: "Free, Bob" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, September 18, 2003 11:44 PM Subject: RE: [ActiveDir] SUS does SPs now >a complete rollup with every patch released for a particular OS. There is actually a current WU beta along those lines... If history repeats, it may be available sooner than later -----Original Message----- From: Crenshaw, Jason [mailto:[EMAIL PROTECTED] Sent: Thursday, September 18, 2003 1:17 PM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] SUS does SPs now You should see a "roll-back/recall" in SUS 2.0. I didn't hear about the SP's being available in SUS until this morning when I saw that it was something that was available to be published, so something or someone must have pulled the trigger for this to happen. Being an Enterprise customer of Microsoft, they usually go way out of their way to ensure that we know about major upcoming changes before going live with them. I guess Microsoft is tired of getting slammed with deployment problems for SP's. For anyone not using SMS, UpdateExpert, or something else along those lines, deploying SP's enterprise wide can be a task within itself. It's too bad that Microsoft doesn't offer patches in a two prong manner. One being you can just install the one "hotfix" for a particular problem and the other would be a complete rollup with every patch released for a particular OS. Of course, it is easy to say that from a customer side. I don't have to write or manage any of the changes; I just have to work with what I am given. Jason List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ ************************************************************************ **** ******************************* This correspondence is confidential and is solely for the intended recipient(s). If you are not the intended recipient, you must not use, disclose, copy, distribute or retain this message or any part of it. If you are not the intended recipient please delete this correspondence from your system and notify the sender immediately. No warranty is given that this correspondence is free from any virus. In keeping with good computer practice, you should ensure that it is actually virus free. E-mail messages may be subject to delays, non-delivery and unauthorised alterations therefore, information expressed in this message is not given or endorsed by Sx3 unless otherwise notified by our duly authorised representative independent of this message. Sx3 is a trading name of Service and Systems Solutions Limited, a limited company registered in Northern Ireland under number NI 32979 whose registered office is at 120 Malone Road, Belfast, BT9 5HT. ************************************************************************ **** ******************************* List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
