WSUS and staff laptops

[thimon]

Hi guys.

 

I'm new to WSUS and have been tasked with using it to push updates to staff laptops. The thread at http://www.edugeek.net/forums/how-do-you-do/168747-laptop-trolleys-wsus-uplinks-help.html seems to mainly talk about laptops that stay in school and are kept in trolleys. We've already got it setup to push updates to our IT rooms. The situation here is each member of staff has their own laptop that they use all day and take them home with them. What's the best way in this situation to push and install the updates without interrupting their workload?

 

Thank you all in advance!

[Barcrest]

If the laptops are vanilla windows then personally I would just leave them set up with windows update so they can update anywhere with a internet connection.

[pete]

1) Have a schedule for when updates are released

2) Publish this information

3) Release updates according to that schedule (unless there's a 0-day flash vuln, for example)

4) Ignore the whining from people who didn't read the copious notices and failed to plan around it

 

for example

 

Our "Patch Day" is Thursday. Updates are released at midday and set to not install (unless the person initiates it) until 4pm and even then they can delay it by choosing "shut down without installing updates". We rarely force installs with deadlines for laptops.

We rarely deviate from this schedule unless it would a) affect public exams or b) 0-day vuln.

 

Thursday was chosen because any problems missed in testing would be detected on the Friday and could be fixed over the weekend.

Midday was chosen to ensure everything's had a chance to download patches before it's taken home/powered off.

4pm was chosen because it's after the main school day but before the auto-shutdowns kick in.

Edited June 15, 2016 by robk
Changed unfortunate typo...

[LeMarchand]

even then they can delay it by choosing "sh*t down without installing updates"

 

A somewhat unfortunate typo!

[Cazale]

In schools where teachers take laptops home, I've started removing them from the domain completely! Many of the ones that were setup before my time could only get windows update when in school and even then only get Sophos updates in school. The only time I'd ever see them where when people suddenly developed a virus because they hadn't had a Sophos update for >1 year, or when they had brought it into school for the first time in yonks and suddenly the passwords didn't match (a big issue at one school that used Safeguard unlocked by the user's domain password!)

 

So yeah, now I just set them up as standalone laptops, put a custom (non-expiring) laptop domain account into their credentials so they can access shares, put the school wifi password on and stick PC Anywhere on it so I can access it if they have a problem (like I said, at least half of them are never used in school again! Across multiple schools!). Nothing updates through the domain at all.

 

It's definitely reduced the number of laptop support requests I get.

[3s-gtech]

If you run Windows and Office with KMS, you'll be sure to get them coming in, roughly every 6 months or so (otherwise they deactivate). Great for keeping tabs on them. I would set them up to use regular Windows Update online, but bear in mind the hassle that can be caused by dodgy updates getting through and junk like Silverlight nagging to install.

[robsonma]

do you have your own website?

If so you can point a name ie, updates.schoolwebsite.sch.uk to your external ip address then route that to your IIS Server then as long as they have internet it will pick up the WSUS.