Patching SIMS against conficker

[m1ddy]

Morning,

 

Our LEA has always advised us never to install any updates of any kind on our SIMS server. We have always taken this with a pinch of salt and left the server be. It is running vanilla 2003 SP2. Now, with the conficker threat looming its starting to make me quite edgy. I have just got confirmation from them in writing that they still do not want any critical / security updates installed of any kind. Not even 958644 (MS conficker patch). Am I worrying about nothing or are they being naive idiots?

 

Hmmmmph

[AyatollahPies]

Sounds like your LEA are all wearing Tin-Foil hats and suffering from a bout of Paranoia.

 

The only thing I'd hold back on is the latest Service Pack for SQL Express.

 

Edit: I'm sure Phil Neal can advise further.

[m1ddy]

The reason they don't want us to install any updates is because it might interfere with the SIMS environment. If we do install any updates at all, it will invalidate our support contract with them. Doh!

 

Rock + hardplace

[AyatollahPies]

The reason they don't want us to install any updates is because it might interfere with the SIMS environment. If we do install any updates at all, it will invalidate our support contract with them. Doh!

 

Rock + hardplace

 

I'd run that by Phil Neal and tell him who your LEA is, as I don't think your being given very good advice m1ddy.

 

They are right in that it can affect the SIMS environment, but so can leaving a server unpatched.

[maniac]

I would have thought because of the type of information stored upon it, the SIMS server was the one that you would want as up-to-date as possible. Ours is patched relatively up-to-date. I don't think it's got the latest stuff on but it's not far off, and we have no problems at all.

 

Mike.

[AyatollahPies]

As far as I know, the only 2 things you may find issue with, are XP SP3 and SQL Express SP3.

[apeo]

The reason they don't want us to install any updates is because it might interfere with the SIMS environment. If we do install any updates at all, it will invalidate our support contract with them. Doh!

 

Rock + hardplace

 

Really dont see how they could say that given that its your server and your OS (I might be wrong). They are they to support an application arent they? I can see there being a problem with patches to SQL but patches to 2003?

 

Surely the most they can say is that they recommend against it? I mean AFAIK Capita doesnt say any such thing and its their MIS so how can the LEA?

Edited March 25, 2009 by apeo

[pete]

So which LEA is getting a busy April Fools Day?

[Sylv3r]

Our SIMS server is fully patched up and I will continue to do so. I can't believe your LA is suggesting it shouldn't be - I'm not sure how a windows update would interfere with SIMS.

[synaesthesia]

Obviously any change in Windows, updates included can have some effect on the software installed therein, however if it does, the most likely thing at fault is said 3rd party software.

Most of our schools, to the best of my knowledge, are told not to install any updates themselves but to get their visiting technician to do so - at least that way should something go wrong, someone is on site to either solve it or to get it solved by someone in the know.

 

Sims is a fickle beast at the best of times and it doesn't take much to upset it :| But, looking at it from a priority point of view - what would you rather have, some slight/large issues with SIMS, even if you can't use it at all, or a network wide open to any passing cyber-vandals or data thieves, putting your entire school straight into special measures without warning.

[Heebeejeebee]

I don't think I've ever had an MS update disrupt SIMS but I've had plenty of Capita ones that did.

 

HBJB

[powdarrmonkey]

The reason they don't want us to install any updates is because it might interfere with the SIMS environment. If we do install any updates at all, it will invalidate our support contract with them. Doh!

 

Rock + hardplace

 

So, you're paying for what exactly? I'd expect a support contractor to be pro-actively monitoring and updating my kit; perhaps you should be looking elsewhere.

[FN-GM]

Our sims server is fully patched and always has been. Never has it caused any problems with sims.

[Jamman960]

The only server based parts of sims are the SQL database and the document server, both of which shouldn't be affected much by windows updates on the servers although there is always a risk of updates causing outages but that could happen with any server/workstation. I hope they keep sims up to date.

[bgarston]

Our SIMS server is fully patched up and I will continue to do so. I can't believe your LA is suggesting it shouldn't be - I'm not sure how a windows update would interfere with SIMS.

 

 

What....!!?? :-| Our sims server is fully patched too and never caused me any problems with Sims. I really can't understand any LA worth their salt advising anyone not to patch your systems (unless there is a known issue with a patch). Not patching systems will certainly cause you many more issues in the fullness of time!

 

In light of this ill thought out advice maybe you should look elsewhere for your Sims support - I dont think your obliged to pay for LA Sims support?

 

Cheers Ben

[synaesthesia]

certainly agree, I'd really suggest getting this investigated a bit further with your LA, as security is completely paramount.

 

I've had a couple of people get confused between their administrative and curriculum networks before now, and have obviously been told not to apply any MS patches to CC3/CC4 networks. Maybe your rep at the LA is getting their head in a muddle!

[m1ddy]

Just spoke to Capita. They suggest all security / critical updates are applied but none of the service packs. How do you think I should proceed with this?

[pete]

Just spoke to Capita. They suggest all security / critical updates are applied but none of the service packs. How do you think I should proceed with this?

 

Feed this info back to your support team, express your concerns about not patching. Speak to their supervisor. Ask if they have liability insurance.

 

I can't think of a good reason why they'd say "don't patch" - if they're testing windows patches against a series of test SIMS servers (as they should be), I can understand them maybe saying "don't install patch X until we've tested it", but "never patch" points towards incompetence, misunderstanding or confusing it with Oracle.

Edited March 26, 2009 by pete