Security Patch Deployment

[Scott]

Has anyone applied the Feature Pack Security Deployment (SPD) and used it yet? Is this a free addon? I cannot seem to find any documentation specific to it.

[Support_1]

You can find information on SPD here: http://www.netinstall.com/products/fpspd.htm

This and all future Feature Packs are available at no cost to any customer with a Support & Maintenance contract.

[robin850]

Has anyone applied the Feature Pack Security Deployment (SPD) and used it yet? Is this a free addon? I cannot seem to find any documentation specific to it.

i started playing with it recently. it was very easy to have it automatically create a bunch of packages just by going through the wizard. i haven't deployed the packages yet, but i intend to test it soon.

[Scott]

I have created a few security packages using the SPD and now I want to test them out. Is there a way to get the projects to show in the interactive installer? The documentation says the following.


The Don't show project in Interactive Installer entry under General Project Properties is not displayed.
The reason: By default, the value of this entry is defined as Yes for patch projects and cannot be changed.


This doesn't seem to be exactly right as I can go to the projects General Properties and the default for don't show in interactive installer is No. I also seem to have the option of changing it.

My problem is that the projects are not showing up in the interactive installer and I am getting the following error in my log file.


07:45:16 1 ---> Checking folder permissions for <database root> ({E530EDD0-ABFB-4B81-894F-EED8D6136A40})

07:45:16 1 ---> Checking folder permissions for <SUS> ({EBCC43B2-C5FC-42B9-8D20-C2B71F5E309F})

07:45:16 1 ---> Checking folder permissions for <SUS\Common> ({FCC293B4-BD90-4CBC-9140-A410E8902BAE})

07:45:16 1 ---> Checking folder permissions for <SUS\Internet Explorer 6.X> ({E8661482-3FD4-47A7-B0F7-C0D54F2FA7C8})
07:45:16 1 xniSUS: Checking permissions to start the hotfix installer: failed
07:45:16 1 xniSUS: Checking if the calling module the interactive patch installer: failed
07:45:16 1 Failed:

07:45:16 1 ---> Checking folder permissions for <SUS\Windows 2000> ({D1A43F50-4D24-4300-8381-1210FC6CA1A4})

07:45:16 1 Evaluating condition "CheckPlatform(cpWin2K)"
07:45:16 1 xniSUS: Checking permissions to start the hotfix installer: failed
07:45:16 1 xniSUS: Checking if the calling module the interactive patch installer: failed
07:45:16 1 Failed:
07:45:16 2 -> database read sucessfully


I do have permissions for the project and the scheduling is setup so I don't exactly know what the hotfix installer failed message means unless the security patches have to be installed automatically and cannot be done through the interactive installer. Any help would be appreciated.

[Support_1]

Scott,

The behavior you are seeing is as designed. Patches can not be installed throught the Interactive Installer regardless of what properties or permissions you set on the project. The problem is that what the online help is telling you and what is actually shown in the manager are different. This will be fixed with the next release of SPD.

Thanks

[robin850]

the new SPD feature is cool, once you get used to the idea of having to use automatic instead of interactive installs.

I deployed win2k sp4 to a dozen machines today, no issues.

I don't quite understand if FastInstall will work applying these sort of packages or not. Has anyone tried it?

[walter_a34]

is ist possible to prevent the pc from initiating a reboot after security path deployment - the popup (reboot yes/no) should not be displayed. the computer will be rebooted every nigth.

thanks

[SBR]

is ist possible to prevent the pc from initiating a reboot after security path deployment - the popup (reboot yes/no) should not be displayed. the computer will be rebooted every nigth.

thanks

Yes, with the SP2 from NetInstall. After install the SP2 you have a third option to prevent rebooting.

[jonwoloshyn]

Does the SPD option support the chaining of multiple patches? Or does it deploy a patch reboot and then deploy the next one.

[Frank Scholer]

Hello,

yes, chaining is supported and automatically done.
The only exception from this are patches, that must be installed separately from others (you know these from the windows update site that have an asterik, indicating that they must be installed isolated from others).

SPD will try to install as much patches as possible in a single step, then reboot and continue installing remaining fixes. This can lead to several restarts, though, depending how much and which patches have to be installed...

HTH, best regards
Frank

[jonwoloshyn]

Thank you Frank. That is good to know

[Crypt]

Related to this... if you make a package with let's say... everything that's available for the OS... is it intelligent enough to only install the needed patches? ... so... if I add a new hotfix and re-release the script, will it only install the addition if the others are installed?

Also, I haven't looked at it but I assume it installs with machine level logging and not user so it only runs once per machine?

[Support_1]

SPD creates a new NetInstall project for each MS hotfix so your scenario of adding to and existing project and then re-releasing does not fit with the design of SPD.

But be aware that SPD always only installs the patches it determines are needed by the machine.

[SBR]

Sorry,

but it's possible. You can creat a Template with the Hotfixes as optional components. So you must only set up the template for automatic install and not every SPD Project.
Choose only interactive installation when you import the patches.

Stefan

[Support_1]

sorry but it's possible. You can creat a Template with the Hotfixes as optional components. So you must only set up the template for automatic install and not every SPD Project.
Choose only interactive installation when you import the patches.

Yes you can always do this but you are still creating new projects for every new hotfix. That was my understanding of what Crypt didn't want to do.

[Crypt]

yeah, kinda. I don't mind having a project for every patch though. Related to the question, is the patch installation smart enough to know if the patch is already installed on the system and skip it if it is? ...or is this handled as normal by netinstall logging of installed projects?

[SBR]

yeah, kinda. I don't mind having a project for every patch though. Related to the question, is the patch installation smart enough to know if the patch is already installed on the system and skip it if it is? ...

Yes. It also check the machine patch level like microsoft.

[DouglasJW]

Scott,

The behavior you are seeing is as designed. Patches can not be installed throught the Interactive Installer regardless of what properties or permissions you set on the project. The problem is that what the online help is telling you and what is actually shown in the manager are different. This will be fixed with the next release of SPD.

Thanks


Has the update that allows interactive installation of Hotfixes been released?

[Scott]

Has the update that allows interactive installation of Hotfixes been released?

Not that I know of and I don't think they plan on making this available. Maybe someone official can tell us for sure.

[DouglasJW]

In the meantime, has anyone managed to deploy XP's Service Pack 2 yet. Specifically, in an unattended mode and with the firewall settings customized?

[robin850]

In the meantime, has anyone managed to deploy XP's Service Pack 2 yet. Specifically, in an unattended mode and with the firewall settings customized?

we will be doing this soon.

we plan to use a reg file to disable MS firewall, then apply SP2.

probably will prompt users to do the install, as it is so huge. may also precopy the SP2 files to the local drive prior to doing the prompting.

when i have completed testing i will let you know how it went.