Bryan's Blog : Systems Management Server

SMS 2003 R2 Brings Custom Application Updating to Systems Management Server

bryanke — Thu, 13 Jul 2006 00:06:00 GMT

I am very pleased to announce the release of Systems Management Server 2003 R2. It has been a real thrill to work on a new set of features for the SMS 2003 product. In my opinion, R2 includes one of the most exiting new innovations in systems management, namely, custom update management. Custom update management refers to the ability for any commercial software vendor to develop software update catalogs for the applications they produce. These catalogs are then made available to customers for downloading in their environment. In addition, organizational teams who manage updating in-house line of business applications can create software update catalogs to enable patch management, not just for commercially available software applications, but any software application where updates apply. This new and exciting technology has made it possible for Microsoft partners like Adobe, Citrix, and 1E to develop and release software update catalogs for the applications that they produce. Technology adoption partners and other customers have been able to develop catalogs for servicing in-house applications as well. This ultimately enables customers to detect and deploy security updates and critical hotfixes to non-Microsoft applications, keeping their environments more secure than ever. I am very pleased to have such strong partners building catalogs so early in the emergence of this new software update functionality.

One of the most compelling aspects of the custom updating technology is the schema that is used to define the updates. This schema, known as corporate publishing XML, is rich with metadata that can be used to define almost any software update. Schema elements include title, description, and other properties. Applicability and installed rules include File, Registry, MSI, and WMI checks in any combination. Installation properties are defined by filename, download URL, command-line parameters and more. This schema is not just envisioned to support custom update management in R2, but many new management products at Microsoft, including Systems Center Configuration Manager 2007 when it releases.

Tools that ship with R2 make it easy to discover, download, and create custom update catalogs that synchronize directly with the SMS 2003 software update management infrastructure.

The SMS 2003 R2 evaluation copy can be obtained here. R2 is available to active Software Assurance (SA) customers at no charge and will be part of the August volume licensing kit. Non-SA customers can purchase R2 licenses.

Please take the opportunity to send me comments/feedback on your experiences with SMS 2003 R2. I am more than happy to post articles on advanced custom update authoring topics, as well as provide samples through this blog.

Thanks,
Bryan

WSUSScan.cab Release Info - Nov. 11, 2005

bryanke — Tue, 08 Nov 2005 18:42:00 GMT

This is a general release information article relating to the availability of the WSUSScan.cab file, a subset of the Windows Update and Microsoft Update patch data that includes information about security updates, update rollups and service packs for Microsoft products. The WSUSScan.cab and its uses are described here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wua_sdk/wua/using_wua_to_scan_for_updates_offline.asp

From a Systems Management Server, the data contained within the WSUSScan.cab is used by the SMS Inventory Tool for Microsoft Updates in order to provide scanning and deployment information for the Software Update Management feature of SMS 2003 SP1. Typically patch data for Microsoft products is released the second Tuesday of the month at 10am. Once this content goes live, the WSUSScan.cab is generated. There is typically a delay in the delivery of this file due to the fact that it must be processed from live data and go through several steps before it can be posted to the Web. Typically these steps are:

CAB creation from live WU/MU content
General processing and evaluation of integrity of the file
Authenticode or Digital signing by a Microsoft certificate prior to public release

The above processes can take anywhere from 30-90 minutes.

For Tuesday, November 8, 2005, I will do my best to provide status on the CAB generation and availability for customers so that they can know when it is appropriate to synchronize or download the CAB for use in SMS. Please see below for latest status:

Pending release of live Microsoft Update content (scheduled for 10am)...
(10:00 AM PST) MU/WU content is live...WSUSScan.cab release is pending
(11:18 AM PST) WSUSScan.cab is still pending release, please stand by...
(11:29 AM PST) Catalog has made it through internal processes and should be released live shortly...
(12:18 PM PST) No word yet on the CAB although it has passed all internal reviews and should be posted any minute now...
(1:08 PM PST) Catalog release is live! CAB file digital signature time is November 08, 2005 10:31:03 AM...

SMS ITMU Deployment of MS05-048 (KB 907245)

bryanke — Mon, 17 Oct 2005 21:27:00 GMT

Some folks have asked me why they are not able to find KB 907245 in the Distribute Software Updates Wizard when approving the October security bulletins from Microsoft. This one is a bit tricky, because the master KB number for MS05-048 is 907045. However, the vulnerability actually affects two distinct Microsoft products: Windows and Exchange. The fix for each is listed under separate KB numbers. So if you are looking to approve and deploy the fix for Windows, search under KB 901017. If you are looking to approve and deploy the fix for Exchange 2000, search under 906780.

Windows Installer Requirement and the SMS 2003 Inventory Tool for Microsoft Updates

bryanke — Thu, 11 Aug 2005 20:14:00 GMT

I want to provide some clarification regarding the Windows Installer 3.1 requirement for the newly released SMS 2003 Inventory Tool for Microsoft Updates. This tool provides integration with the Windows Update Agent and the catalog of updates available on Windows Update and Microsoft Update to enterprise customers.

You may notice that the tool has a requirement on MSI 3.1. This is due to the fact that MSI 3.1 is considered a mandatory update in the Windows Update world. A mandatory update is basically a required update to get the full functionality for detecting and deploying MSP-based updates through the Windows Update Agent. Windows Server Update Services (WSUS) has a hard requirement on MSI 3.1. This means that no clients will be offered any updates until MSI 3.1 is installed on the client computer for WSUS clients and home computers using Automatic Updates. On my home machine, I delayed installing MSI 3.1 just out of pure laziness for several months. When I finally did, there were over a dozen updates applicable on my machine that I had not been aware of because the mandatory MSI 3.1 update had not been installed. WSUS clients will automatically get MSI 3.1 before any patches are applied. Home users are advised to install MSI 3.1 as part of the automatic updates process.

In the enterprise, with SMS and the new inventory tool, the story is slightly different. SMS does not force an update or upgrade to MSI 3.1. In fact, you will still be able to scan machines *successfully* even with MSI 2.0 on the managed client. I have to clarify what successfully means. This means that the scan will not fail. However, you will not receive update detection and deployment information for any MSI-based updates. This includes the CAB's MSP files that Microsoft Office uses to deploy updates to Office XP and Office 2003. You will get no errors, no warnings, no nothing. Updates will simply not be shown as applicable, because the MSI API's that the Windows Update Agent relies on simply are not there in older versions. It bears mentioning that in the future, many more products at Microsoft will be jumping on the Microsoft Update, affectionately known as MU, bandwagon. If these product teams use an MSI-based servicing model, you will also not receive an accurate applicability status for those updates. Bottom line: You might not know what you are missing in the future.

So let's talk MSI 3.0 vs. 3.1. If your clients are running MSI 3.0, you will actually see successful scan results for all clients. However, I strongly encourage you to upgrade to MSI 3.1. Several critical fixes were made that make this a valuable update and one that is well worth deploying.

One other thing to point out. The Windows Installer 3.1 download center page documents the latest version as 3.1.4000.2435. However, if you run msiexec from the command line, the listed version is 3.01.4000.1823. This is perfectly fine and the correct version you should be seeing. The msi.dll version is the actual version that is reflected on the download center page.

So, with my official Microsoft hat on, I say update to the required, mandatory, important and highly useful MSI 3.1. If you call product support and request assistance with MSI 2.0 or 3.0 or otherwise need a hotfix, you will be asked to first update to MSI 3.1. So that is the official support for MSI. But go ahead, read between the lines, and make your own informed decision that is right for you regarding the upgrade to MSI 3.1.

Feel free to send comments or e-mail me.

SMS 2003 Inventory Tool for Microsoft Updates Beta

bryanke — Mon, 11 Jul 2005 00:30:00 GMT

Hello all. I want to encourage users of Systems Management Server 2003 to try out the Beta version of the new SMS security updates scan tool based on Windows Server Update Services technology. You can evaluate the Beta by visiting the following web site:

http://www.microsoft.com/smserver/downloads/2003/tools/inventory.asp

New Role at Microsoft!

bryanke — Sat, 08 Jan 2005 18:22:00 GMT

Hello All!

I've been a way for a while and haven't posted since the Fall, but it is the new year and I have a good excuse for my absence. I have transitioned to a new role at Microsoft as a Program Manager on the Systems Management Server team. The disappointing news is that I will no longer be in a position to post regarding SQL Server Reporting Services, which I know a number of people enjoyed reading. I will keep all the Reporting Services articles here at the site for those who are interested. Over the years, I have become a faithful user and fan of the reporting technology and am finding many uses for it at my new job. But onward and upward to my new position.

Systems Management Server is a powerful, complex, and feature-rich product. Admittedly, SMS may not be as sexy as Reporting Services on the outside, but it is an awesome product and a great product team. That coupled with the type of work and responsibilities I have in SMS, makes this a really good move for me. I haven't yet decided what will become of my blog. As I dig deeper into SMS as a technology and become more of an expert, I anticipate using this blog for SMS-related material. The product has so much to offer, that I am sure I will not find it difficult to write about a variety of SMS subjects. But until I find my bearings, I'm not sure how often I will be posting in the immediate future.

If you have comments regarding my blog or the Reporting Services articles, feel free to continue to post those and I will route your questions on the appropriate Reporting Services contact.

See you and happy blogging!