Windows Patch Management Strategies

Patch management is an area of systems management that involves acquiring, testing, and installing multiple patches (code changes) to an administered computer system. Patch management tasks include: maintaining current knowledge of available patches, deciding what patches are appropriate for particular systems, ensuring that patches are installed properly, testing systems after installation, and documenting all associated procedures, such as specific configurations required. 

Software Update Services (SUS)

Microsoft SUS is a free patch management tool provided by Microsoft to help network administrators deploy security patches more easily. In simple terms, Microsoft SUS is a version of Windows Update that you can run on your network.

Today corporations have to frequently check the Windows Update site or the Microsoft Security Web site for patches. Then they have to manually download patches that have been made available since they last visited the site, test the patches, and then distribute the patches manually or by using their traditional software-distribution tools.

Instead of each workstation having to connect to the Internet to update Windows, each workstation connects to the Microsoft SUS Server instead and updates from there. Microsoft SUS Server alone requires access to the public Internet as it connects to Windows Update.

Systems Management Server (SMS)

Microsoft Systems Management Server (SMS) 2003 provides a feature-rich management and servicing solution. You can use SMS 2003 or System Center Configuration Manager 2007 (ConfigMgr) to manage networked Windows Embedded Standard-based devices alongside Windows desktop, Windows Server, and other Windows Mobile systems. SMS supplies an administration console that can be used on a Windows Server 2003 system to remotely perform management functions.

Embedded device developers can use SMS or ConfigMgr to manage the deployment of security updates to Windows Embedded Standard-based devices. Client and server components for SMS are not included in the Windows Embedded Studio component database and must be separately obtained.

Windows Server Update Services (WSUS)

Windows Server Update Services (WSUS) enables information technology administrators to deploy the latest Microsoft product updates. You can use WSUS to fully manage the distribution of updates that are released through Microsoft Update to computers on your network.

A WSUS server provides features that you can use to manage and distribute updates through a management console. A WSUS server can also be the update source for other WSUS servers within the organization. The WSUS server that acts as an update source is called an upstream server. In a WSUS implementation, at least one WSUS server on your network must be able to connect to Microsoft Update to get available update information. As an administrator, you can determine - based on network security and configuration - how many other WSUS servers connect directly to Microsoft Update. 

Microsoft Baseline Security Analyzer (MBSA)

The MBSA can help you stay on top of regular network auditing tasks by scanning both local and remote Microsoft systems for common security misconfigurations. It can also identify missing security updates and service packs available through the various Microsoft Update technologies, helping to ensure all machines are patched correctly. It can run vulnerability assessment checks for the following software:

• Client versions of Windows, including Windows 7
• Windows Server, including Windows Server 2008
• SQL Server
• Internet Information Server (IIS)
• Internet Explorer
• Microsoft Office

Microsoft Security Assessment Tool (MSAT)

The Microsoft Security Assessment Tool (MSAT) is a free tool designed to help organizations like yours assess weaknesses in your current IT security environment, reveal a prioritized list of issues, and help provide specific guidance to minimize those risks. MSAT is an easy, cost-effective way to begin strengthening the security of your computing environment and your business.

Begin the process by taking a snapshot of your current security state, and then use MSAT to continuously monitor your infrastructure’s ability to respond to security threats.

At Microsoft, the security of our customers’ networks, business servers, end-user computers, mobile devices, and data assets are a top priority. We are committed to providing security tools like MSAT to help you improve the security state of your business.


https://www.microsoft.com/en-us/download/details.aspx?id=12273
https://msdn.microsoft.com/en-us/library/bb521519(v=winembedded.51).aspx 

https://www.petri.com/sus
https://www.infosec.gov.hk/english/technical/files/patch.pdf
https://msdn.microsoft.com/en-us/library/ff647981.aspx
https://technet.microsoft.com/en-us/library/cc512589.aspx
http://www.windowsecurity.com/uplarticle/Patch_Management/ASG_Patch_Mgmt-Ch2-Best_Practices.pdf
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus