I’ve been playing around with WSUS recently for use in Housing. Primarily, I’m testing it with student site computers as the targets for automated installs, though the reporting we get from the “download and wait to install” mode also works well on our servers.

A few things bother me though:

• There doesn’t seem to be a way to force the install of a patch as soon as the computer checks in. Our workstations are commonly reinstalled during the year, if I switch to WSUS as my patch management solution, it appears as though I need to keep patching my install point every month. Not a big deal, as long as the /integrate: option always works.
• WSUS needs the BITS 2.0/WinHTTP 5.1 update and Microsoft Installer 3.1 before it can do anything else. This isn’t a real big deal, either expect to wait 24 hours to install actual patches or stuff those into cmdlines.txt to run during unattended setup.
• Superceded update handling seems to be wonky, or something. I’v seen 1 case where an update for Windows 2000 is shown as “superceded” by an update for Windows 2003. Not likely. And all this update declining business is confusing too.

I guess, when all is said and done, WSUS is a better solution than our current homebuilt Winbatch file version checker feeding into a SQL database. And WSUS is free, so no complaining allowed!

Other updates to, hopefully, come for the labs this summer: Acrobat Reader 7, McAfee VirusScan 8.0i and all the newest versions of all the free stuff we run (GAIM, Firefox, putty, etc). I’m also investigating McAfee’s ePO server, but that may have to wait until fall to get done.