Wondering how to keep student laptops updated with WSUS and Mcafee Antivirus

[jaimeklein]

Hi everyone,

We have about 100 laptops which we have just set up to connect to WSUS and Mcafee EPO 4.0. After a lot of rebooting and logging in to these machines manually they are all connecting fine and getting Windows updates and DAT files are all almost 100% updated.

We have set group policy to download updates and schedule them for installation at 3am each night. This is fine for desktops because they are usually left switched on most of the time but not suitable for laptops. The problem here is that the students take the laptop from the trolley, use it, them either log off, shutdown or just close the laptop and return it to the trolley. So it's very hit and miss as to what state these laptops are in for them to receive updates. All the laptops are wireless. We could possibly set up a policy to install the updates immediately but that would mean the possibility of random reboots in the middle of students using the laptops which also isn't an acceptable solution.

We obviously don't want to go around taking out 100+ laptops from their trolleys and manually updating. We are looking at getting more laptop trolleys soon, so the problem is only going to be magnified.

Has anyone successfully rolled out a notebook program at their school and is using WSUS for Windows updates and EPO 4 or similar? Our laptops are all up to date right now, but I can't see students waiting for updates to install before returning them to the trolley and they are never switched on at 3am in the morning, so what would be the best way to keep them up to date?

We've had a good look around this forum and on the web but cannot find anything that mentions this kind of problem,

Any thoughts and advice would be very much appreciated,

Thank you very much!

Jaime Klein

[SYNACK]

Do your trollys have built in network ports for mass deployments, if they do you could use a wake on lan (WOL) packet method to remotly boot all the laptops at 2:30 and then they would be on to run the scheduled updates.

[jaimeklein]

Thanks for the reply.

Unfortunately at no point are these laptops ever pluged into our wired network. They are 100% wireless. The laptop trolleys don't have network ports either unfortunately, just power points. I don't beleive there's a WOL solution for wireless yet? Correct me if I'm wrong!

Thanks

Jaime Klein

[broc]

We have 300+ laptops so I understand your concerns. A while back we had a major issue trying to deploy XP SP3 as it needed an A/C power supply connected to a laptop before it would install! We had to book trolleys out one by one after school to get it sorted.

I sometimes release minor fixes, patches etc one by one through WSUS and stick a deadline of 'now' on them, a lot of them manage to find their way onto the systems but you can get problems even with this where the download is incomplete or the install fails part way through because the system was powered off by the user (or battery goes flat) so we get a lot of machines showing install errors.

There are some commands & scripts around on the WWW that you can run on the client to 'force' WSUS updates. PSEXEC or similar is handy for running a command on a remote system while it's turned on. This can be useful in triggering a WSUS refresh but it is quite labour intensive.

Our laptops catch up with most updates in two ways:

1) when they are brought in for repair, we make sure they are up to date before releasing them
2) we power them up during holiday time on a rolling program based upon what WSUS reports and deal with the errors as we find them.

[Arthur]

Although you can install Windows updates via WSUS, how do people deal with installing applications or third-party updates on laptops? Does anyone use System Center Config Manager to do this in the background while users are logged on?

[mavhc]

You can tell windows to install updates in the background but not reboot. I install new apps via GPO on startup, just try to only add 1 a day so it doesn't pile up

[jaimeklein]

Thanks for the replies :-)

I think my question has pretty much been answered in that there is no way to successfully keep the laptops updated during the term without a lot of manual labour on our behalf. We could update them manually during the holidays as broc suggested or schedule them to install in the background and not reboot. However, I'd imagine the latter option would cause issues when the laptops need a reboot and other updates become "backed up" because of the pending restart.

Thanks for the input, I guess I'll just have to wait till we get Windows 7 in schools that supports Wake On Wireless Lan!

Thanks,

Jaime Klein

[broc]

One thing I have mused over, but never tried....

Many laptops BIOS support 'wake on time'. So, in theory you could set your laptops up to wake up at say 2am once a week, let them connect to a wireless network (assuming they can get a signal while locked away) force a WSUS refresh and pick up updates that way? I guess you might then need to run a script a few hours later to turn them off.....

[Cools]

I have Mcafee Antivirus update once a day at logon and do updates once a term by FOGing them in 1 hit.
there's not lot of manual labour on my behalf.
just laziness....

[powdarrmonkey]

I guess you might then need to run a script a few hours later to turn them off.....

Shutdownertron would do that for you.