How do you install all windows updates after a workstation rebuild?

[morganw]

I'm looking for a way to have windows updates get slipstreamed or auto installed so that when I rebuild a workstation and it gets to the logon screen it's fully patched and up-to-date. I'm trying to secure some funds to purchase SpecOps Deploy 4.0 (leverages WDS), but if not i'll probably remain on Fog. I would have WSUS setup as well.

 

The way I see if i've got a few options:

 

• Capture an image that already has had Windows Update manually run - the problem here is i doubt i'm going to end up with one image, more likely it will be 3 or more. I don't want to have to keep refreshing images and potentially damaging the images just to install a couple of updates.
   
  
• Manually setup each individual update and deploy it like an application - similar to how our current CC3 system operates, this appeals to me as management is more central but updates would be delayed and I would have to assume that all MS updates would be friendly to the process.
   
  
• Find a way / buy a program to mount the WIM images and inject the updates - I've been told this is potentially a future development for Deploy 4.0, but I haven't found anything else that would do it.
   
  
• Buy a program called WuInstall Pro - This is actually really cheap for education, $250 for unlimited client use. It's a command line utility that can apparenty install all Windows updates, accepting the EULAs as you go. This could be scripted into the build somewhere and appears to be exactly what I need.
  

 

Anyone know of any other way to guarantee that a newly built workstation is up to date? I don't mind the standard WSUS to keep them up to date, but I don't want anything being used half patched.

[kmount]

If you don't want to maintain an image how about maintaining an installation CD? You could use nlite to bundle the vast majority of updates into the installation (and drivers if you wished) then leaving WSUS to fix them up afterwards.

 

I find this approach works particularly well; we made a point of updating the CD every month or two with the latest updates available and as time goes on you build a pretty good baseline.

[morganw]

Thanks, some of the images may not be base images though, they might have applications in as well. So going from the install media to refresh images adds a lot of reinstall work.

[RSoP_Robbers]

It would mean a little more manual work or use of the Concatenate feature in Excel but if you went onto the Microsoft Catalog (The web based directory version of Windows Update), you could download all of the updates that you want to a network share.

 

Although it may not work for all, you can extract each of the .exe update files into the expanded packages. From there, you could run the updates that you want for each of the machines in a script, (perhaps run from your sysprep config or Group Policy - depending which you have access to) along with command line switches to accept the EULA.

 

Again, not all updates allow the acceptance of the EULA.

 

I do also think that some of the newer updates actually allow silent install in the compressed form.

 

I'm currently doing the same at the moment so I'll share some ideas or samples if you like.

[morganw]

Thank you. Is there a general rule as to the updates which require user interaction? I'm thinking i'd only need the security / bug fix type of updates to go on, not anything to install new applications like IE8.

 

Do the updates usually share common switches for silent installation or do you have to do your homework everytime?

 

I found a list on the WPKG site but i'm not sure how up to date it is...

Category:Silent installers for Windows Hotfixes - WPKG | Open Source Software Deployment and Distribution

[RSoP_Robbers]

Most of the hotfixes tend to have the same wrapper.

 

I think the page that you supplied is out of date however, the program in that page looks rather handy!

 

In our scenario, if a workstation is down in a classroom, we try to re-image it as soon as possible to reduce the effect on teachy and learny. The one problem with this obviously is "busy fingers".

 

We have a couple of batch scripts that have a little bit of detection in the event that the script has already run etc and also in the event that a student presses the reset button.

 

It appears that program has a better grasp of that scenario but also has a mahoosive screen telling people to keep their fingers in their pockets, relaxing and watch the blinking lights.

 

I think I'm going to take another look at things tomorrow now. I shall keep reporting back!

[kmount]

Thanks, some of the images may not be base images though, they might have applications in as well. So going from the install media to refresh images adds a lot of reinstall work.

 

I don't understand your reply?

 

If you use nlite this will affect new installations only, or are you looking for a solution that will go on regardless of "how" the PC ended up with windows on or if its an existing built station etc?

 

In that case, consider the Logistix update packs.

 

Windows XP

[Skinny]

Do you know about this site?? I've never used it before (going to tho) but reading the RIS sticky it seems a few people on here swear by it.

[DrCheese]

I usually don't find this an issue, Our images are anything from 1 to 12 months old at any given time and they just get picked up by WSUS pretty quickly, so within a day or so they are backup to the current baseline.

 

With Vista/7 imaging you can even force an update check against WSUS during the install process.

[kmount]

Do you know about this site?? I've never used it before (going to tho) but reading the RIS sticky it seems a few people on here swear by it.

 

Yep, I push those into nlite

[morganw]

I thought than nLite would only be for manual installs or RIS, I would either end up with WDS managed through Deploy 4.0, or normal syspreped images. Or can the use nLite on a WIM image?

 

Thanks for the pointer to the Logistix packs, are they kept up to date?

[kmount]

Thanks for the pointer to the Logistix packs, are they kept up to date?

 

Yes, maintained by a chap on these fine forums.

 

He posts a monthly update pack which is incredibly useful for those rebuilds (or bring up to levels).

 

Not sure about nlite/wim, not something I've done. Sorry.

[morganw]

Are there any updates that actually need to run through the proper update services or are they effectively just downloaded and executed anyway? Also if I was looking at just the post SP3 updates will there be any dependency issues or is the order irrelevant as long as the stuff like Windows Installer is up to date first?

[mb2k01]

Hi Morgan,

 

We are pretty much the same scenario described by DrCheese above. If we're talking a couple of machines in a misc room then we'll re-image and leave WSUS to do its business. (If we've gone a step further and physically brought the PC to our office or know the image is quite out of date, we'll force the updates)

 

If we're talking a whole room re-image (which we tend to plan ahead and revolve over half terms) then we'll actually create a new base image to keep our image library up to date.

[morganw]

Thanks Mark, I think it might come down to speed and reliabilty in the end. If running through all the updates after the imaging stage is working well then I think it's worth it to guarantee that all the updates are on every workstation without any normal WSUS scheduling. I'll see if I can get a trial version of WUInstall Pro to see how reliable it is.

[Michael]

Capture an image that already has had Windows Update manually run - the problem here is i doubt i'm going to end up with one image, more likely it will be 3 or more. I don't want to have to keep refreshing images and potentially damaging the images just to install a couple of updates.

 

If you're basing these images on XP, what I would recommend is create a new image per machine. In your case three different machines which isn't a lot (you're lucky).

 

Install XP SP3, then install the Logistix Post XP SP3 Pack. Run Windows Update and install any additional applications you want part of the image.

 

Setup WSUS 3.0 which will then install any additional Post XP SP3 Updates as and when they're released in future. This is how I always do things and it works reliably

[RSoP_Robbers]

I usually don't find this an issue, Our images are anything from 1 to 12 months old at any given time and they just get picked up by WSUS pretty quickly, so within a day or so they are backup to the current baseline.

 

That's the only problem that we have.

 

We've moved from two separate IT departments into a single and since having a brand new set of images last summer, a lot of changes took place (oh joy!) which require a lot of specific updates and hotfixes for certain packages and programs to work which obviously were not included in the images.

 

We'd have to wait a couple of days for WSUS to distro the updates or move the computer to a different OU to disable the auto install at a specific time setting to install when I say so, to then log in, install the updates over several reboots to then move it back. By which time, it would have been quicker to log on and run Windows Update several times.....

 

We have a lot of projects that we want to get up and running so at the moment, we are redesigning the deployment system as well as analysing what is required for the next set of images. This for us is an interim solution.

[Arthur]

Do the updates usually share common switches for silent installation or do you have to do your homework everytime?

Microsoft's hotfixes all tend to use the same switches for automating the installation. e.g. /passive /norestart.

 

If you have a folder full of hotfixes which you have downloaded and want to integrate them into a Windows XP install disc for example you could use a batch file like the one below.

 

@Echo Off
Echo.
Echo Slipstreaming Windows XP Post-SP3 Updates
Echo Please wait...
FOR %%f IN (*.exe) DO "%%f" /Integrate:C:\XPCD
Echo.
Echo Slipstreaming Completed!
Echo.
Pause>NUL

 

I used to use RyanVMs Update Packs a lot in the past, but it looks like his site is dead now, since his Post-SP3 update pack hasn't been updated in over a year! HFSlip was quite good too, but the original author seems to have lost interest.

Edited January 31, 2010 by Arthur

[morganw]

If you're basing these images on XP, what I would recommend is create a new image per machine. In your case three different machines which isn't a lot (you're lucky).

 

I've got about 15 types of hardware and i'm half way through tyring to make a universal sysprep image, I've got at one problem laptop model, and I haven't got to the AMD machines yet. So at the moment I'm just assuming three images...

[Arthur]

I've got about 15 types of hardware and i'm half way through tyring to make a universal sysprep image

I'm currently doing the same myself with the help of this guide. I may just be able to pull it off by using MySysPrep.

 

Slightly off-topic, but has anyone read the nLite EULA? I just noticed the following in it...

 

1. nLite is freeware and can be freely used for any personal non-commercial purposes, subject to the following restrictions.

 

5. nLite is free for personal use only, you cannot use it for any company or business purposes at this time.

[mac_shinobi]

Just found this via google

 

Auto Patcher

 

Windows Update On A Disk | Daily Cup of Tech

[srochford]

assuming you're sysprepping your images then as part of the sysprep.inf file you can specify processes you want to run as the machine runs its mini-setup.

 

The MSDN website has a script Searching, Downloading, and Installing Updates (Windows) which will query either the MS updates site or your WSUS site if you have one (it just uses the default location for updates) and installs all critical updates.

 

If you run this then your machine is automagically up to date - you don't have to do anything and that always seems like a winning strategy :-)

[garrya100]

I agree with Steve.

 

I used to keep updating all my images to keep the patches up to date. Now I just have a set of standard images and my WSUS does the rest. Much less work. And of course WSUS is a free download.