Migrate WSUS Server from Server 2008/R2 to Server 2012/R2

The following procedure apply if you have an existing WSUS server installed on a Windows 2008 R2 OS with SQL Express and you wish to migrate to Windows Server 2012 R2 WSUS server and a separate backend database server.

Step1: Backup SQL DB of Old WSUS Server

Log on to existing WSUS server. Open SQL Management Studio>Connect to DB>Right Click SUSDB>backup full database.

clip_image002

Step2: Export metadata from old WSUS Server

The WSUS Setup program copies WSUSutil.exe to the file system of the WSUS server during installation. You must be a member of the local Administrators group and WSUS Administrator Group on the WSUS server to export or import metadata. Both operations can only be run from the WSUS server itself and during the import or export process, the Update Service is shut down.

Open command prompt as an administrator>go to C:\program Files\Update Services\Tools

Issue wsusutil.exe export c:\export.cab c:\export.log command

Move the export package you just created to the new Microsoft WSUS Server.

 

If you have .netFramework v.2 or v.4 but not configured in IIS Application. Then most likely above command will fail giving you some grief. Here is a solution for this.

Verify that WSUS is configured to use the .NET4 libraries in IIS>Application Pool

clip_image004

Create a file named wsusutil.exe.config in C:\Program Files\Update Services\Tools

Edit the file and add the following:

<configuration><startup><supportedRuntime version=”v4.0.30319″ /></startup></configuration>

If issue persists, please try to unapprove KB3020369 in WSUS Console then try again.

Re-run the wsusutil command but instead of making a CAB file make a .xml.gz file and all should be well.

clip_image006

clip_image008

Further reading 1

Further reading 2

 

Step3: Build New WSUS Server

Virtualize a new Windows Server 2012 R2 Server. Setup static IP, Join the server to domain. Install .NetFramework 4 in new server.Do not Configure WSUS at this stage. Go to Step4.

 

Step4: Restore SQL DB in New SQL Server (Remote and/or Local )

Log on to SQL Server. Open SQL Management Studio>Create a Database named SUSDB

Restore old SUSDB to new SUSDB with override option.

Assign sysadmin, setupadmin role to the person who will install WSUS role in new WSUS server.

clip_image013

image

clip_image018

clip_image020

Step5: Install WSUS Role & Run Initial Configuration Wizard.

Installation of WSUS

 Log on to the server on which you plan to install the WSUS server role by using an account that is a member of the Local Administrators group.

 In Server Manager, click Manage, and then click Add Roles and Features.

 On the Before you begin page, click Next.

 In the Select installation type page, confirm that Role-based or feature-based installation option is selected and click Next.

 On the Select destination server page, choose where the server is located (from a server pool or from a virtual hard disk). After you select the location, choose the server on which you want to install the WSUS server role, and then click Next.

 On the Select server roles page, select Windows Server Update Services. Add features that are required for Windows Server Update Services opens. Click Add Features, and then click Next.

 On the Select features page. Retain the default selections, and then click Next.

 On the Windows Server Update Services page, click Next.

 On the Select Role Services page, Select Windows Server Update Services and Database, and then click Next.

 On the Content location selection page, type a valid location to store the updates. For example, type E:\WSUS as the valid location.

 Click Next. The Web Server Role (IIS) page opens. Review the information, and then click Next. In Select the role services to install for Web Server (IIS), retain the defaults, and then click Next.

 On the Confirm installation selections page, review the selected options, and then click Install. The WSUS installation wizard runs. This might take several minutes to complete.

 Once WSUS installation is complete, in the summary window on the Installation progress page, click Launch Post-Installation tasks. The text changes, requesting: Please wait while your server is configured. When the task has finished, the text changes to: Configuration successfully completed. Click Close.

 In Server Manager, verify if a notification appears to inform you that a restart is required. This can vary according to the installed server role. If it requires a restart make sure to restart the server to complete the installation.

 

Post Configuration

Open Server Manager>Add/Remove program. It will provide you with previous installation Wizard. Launch Post Configuration Wizard.

 On the Welcome page, click Next.

 On the Installation Mode Selection page, select the Full server installation including Administration Console check box, and then click Next.

 Read the terms of the license agreement carefully. Click I accept the terms of the License agreement, and then click Next.

On the Select Update Source page, you can specify where client computers get updates. If you select the Store updates locally check box, updates are stored on WSUS, and you can select a location (E:\WSUS) in the file system where updates should be stored. If you do not store updates locally, client computers connect to Microsoft Update to get approved updates.

Make your selection, and then click Next.

On the Database Options page, you select the software used to manage the WSUS database. Type <serverName>\<instanceName>, where serverName is the name of the server and instanceName is the name of the SQL instance. Simply type remote or local SQL Server Name and then click Next.

On the Web Site Selection page, you specify the Web site that WSUS will use to point client computers to WSUS. If you wish to use the default IIS Web site on port 80, select the first option. If you already have a Web site on port 80, you can create an alternate site on port 8530 by selecting the second option. Make your selection, and then click Next.

 On the Ready to Install Windows Server Update Services page, review your choices, and then click Next.

 The final page of the installation wizard will tell you whether or not the WSUS 3.0 installation was completed successfully. The final page of the installation wizard will tell you whether or not the WSUS 3.0 installation was completed successfully. After you click Finish the configuration wizard will be launched.

 

Step6: Match the Advanced Options on the old WSUS Server & the new WSUS Server

Ensure that the advanced synchronization options for express installation files and languages on the old server match the settings on the new server by following the steps below:

  1. In the WSUS console of the old WSUS server, click the Options tab, and then click Advanced in the Update Files and Languages section.
  2. In the Advanced Synchronization Settings dialog box, check the status of the settings for Download express installation files and Languages options.
  3. In the WSUS console of the new server, click the Options tab, and then click Advanced in the Update Files and Languages section.
  4. In the Advanced Synchronization Settings dialog box, make sure the settings for Download express installation files and Languages options match the selections on the old server.

Step7: Copy Updates from File System of the old WSUS Server to the new WSUS server

To back up updates from file system of old WSUS server to a file, follow these steps:

  1. On your old WSUS server, click Start, and then click Run.
  2. In the Run dialog box, type ntbackup. The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard or click the link to work in Advanced Mode and use the following steps.
  3. Click the Backup tab, and then specify the folder where updates are stored on the old WSUS server. By default, WSUS stores updates at WSUSInstallationDrive:\WSUS\WSUSContent\.
  4. In Backup media or file name, type a path and file name for the backup (.bkf) file.
  5. Click Start Backup. The Backup Job Information dialog box appears.
  6. Click Advanced. Under Backup Type, click Incremental.
  7. From the Backup Job Information dialog box, click Start Backup to start the backup operation.
  8. Once completed, move the backup file you just created to the new WSUS server.

To restore updates from a file to the file system of the new server, follow these steps:

  1. On your new WSUS server, click Start, and then click Run.
  2. In the Run dialog box, type ntbackup. The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard or click the link to work in Advanced Mode and use the following steps.
  3. Click the Restore and Manage Media tab, and select the backup file you created on the old WSUS server. If the file does not appear, right-click File, and then click Catalog File to add the location of the file.
  4. In Restore files to, click Alternate location. This option preserves the folder structure of the updates; all folders and subfolders will appear in the folder you designate. You must maintain the directory structure for all folders under \WSUSContent.
  5. Under Alternate location, specify the folder where updates are stored on the new WSUS server. By default, WSUS stores updates at WSUSInstallationDrive:\WSUS\WSUSContent\. Updates must appear in the folder on the new WSUS server designated to hold updates; this is typically done during installation.
  6. Click Start Restore. When the Confirm Restore dialog box appears, click OK to start the restore operation.

Alternative option would be use FastCopy Software. Copy and paste WSUS content from old server to new server.

Step8: Copy Metadata from the Database on the old WSUS Server to the new WSUS Server

To import metadata into the database of the new Microsoft Windows Server Update Services Server, follow these steps:.

Copy export.xml.gz or export.cab file from old server to new server using copy/Paste or FastCopy software.

Note: It can take from 3 to 4 hours for the database to validate content that has just been imported.

At a command prompt on the new WSUS server, navigate to the directory that contains WSUSutil.exe. Type the following: wsusutil.exe import packagename logfile (For example: wsusutil.exe import export.cab import.log or wsusutil.exe import export.xml.gz export.log)

Step9: Point your Clients to the new WSUS Server

Next you need to change the Group policy and make it point top the new server.  To redirect Automatic Updates to a WSUS server, follow these steps:

  1. In Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update.
  2. In the details pane, click Specify Intranet Microsoft update service location.
  3. Set the intranet update service for detecting updates box and in the Set the intranet statistics server box. With the new server details and port For example, type http(s)://newservername :Port in both boxes.

Step10: Invoke GPUpdate

Open PowerShell command prompt as an administrator in any computer. Run Invoke-GPUpdate Servername to synchronise server with new WSUS Server.

Migrate WSUS to Windows Server 2012 R2

Prerequisites

  • Collect source and destination server name, IP address, Database Name, Instance Name, service account for Database instance.
  • Download Microsoft SQL Server Management Studio and install on source and destination SQL Server.
  • Make sure destination server is joined to the domain and time is synced
  • Do not run initial configuration wizard in Destination Server.
  • As best practice, do not migrate WSUS into a Domain Controller.
  • Obtain appropriate permission in source server, destination server and SQL server to initiate and complete migration tasks

Migrate local users and groups

1. Right-click in the Taskbar, click Properties, highlight Toolbars, and then click Address.

2. Type lusrmgr.msc, and then press ENTER.

3. In in the console tree of the Local Users and Groups MMC snap-in, double-click Users.

4. Manually create a list of the local users.

5. In the console tree of the Local Users and Groups MMC snap-in, double-click Groups.

6. Manually add the users from the source server to the WSUS Administrators and WSUS Reporters groups.

Back up the WSUS database on the source server

1. After you connect to the appropriate instance of the database in Object Explorer, click the server name to expand the server tree.

2. Expand Databases, and select the SUSDB database.

3. Right-click the database, point to Tasks, and then click Back Up. The Back Up Database dialog box appears.

4. In the Database list, verify the database name.

5. In the Backup type list, select Full.

6. Select Only Backup. only backup is a SQL Server backup that is independent of the sequence of conventional SQL Server backups.

7. For Backup component, click Database.

8. Accept the default backup set name that is suggested in the Name text box, or enter a different name for the backup set.

9. Follow the prompt to complete backup.

Restore the WSUS database backup on the destination server

1. After you connect to the appropriate instance of the database in Object Explorer, click the server name to expand the server tree.

2. Expand Databases, and select the SUSDB database.

3. Right-click the database, point to Tasks, and then click Restore. The Restore Database dialog box appears.

4. On the General page, use the Source section to specify the Source.

5. In the Destination section, the Database box is automatically populated with the name of the database to be restored.

6. In the Backup sets to restore grid, select the backups to restore. This grid displays the backups available for the specified location. By default, a recovery plan is suggested.

7. Follow the prompt to complete Restore. Click OK

Install WSUS Server on the destination server

Before you begin installing WSUS server into the destination server you must install Microsoft .NET Framework, Background Intelligent Transfer Service (BITS) 2.0 and Microsoft Internet Information Services (IIS) on the destination server. Follow the procedure to install WSUS into destination server and point to the new Database.

1. Open Server Manager, Click Add Roles and Features, Select WSUS and install WSUS role.

2. On the Welcome page, click Next.

3. Read the terms of the license agreement carefully, click I accept the terms of the License Agreement, and then click Next.

4. On the Select Update Source page, you can specify where client computers get updates. If you select Store updates locally, updates are stored on WSUS and you can select a location in the file system to store updates. If you do not store updates locally, client computers connect to Microsoft Update to get approved updates.

5. Make your selection, and then click Next.

6. On the Database Options page, click Use an existing database server, and select the instance name from the drop-down list.

7. Make your selection, and then click Next.

8. On the Web Site Selection page, you specify the Web site that WSUS will use. Note two important URLS: the URL to point client computers to WSUS and the URL for the WSUS console where you configure WSUS.

9. Make your selection, and then click Next.

10. On the Mirror Update Settings page, you specify the management role for this WSUS server. If you want a central management topology, enter the name of the upstream WSUS server. If this is the first WSUS server on your network or you want a distributed management topology, skip this screen.

11. Make your selection, and then click Next.

12. On the Ready to Install Windows Server Update Services page, click Next.

Change the WSUS server identity

Performing this step guarantees that WSUS-managed clients are not affected during the migration process. If the source server and the destination server run with the same identity, and a change is made to one of the servers, the communication between the client and server will fail.

1. On the destination server, open an elevated Windows PowerShell prompt and run the following script:

$updateServer = get-wsusserver

$config = $updateServer.GetConfiguration()

$config.ServerId = [System.Guid]::NewGuid()

$config.Save()

2. As soon as the server identity is changed, run the following command to generate a new encryption key:

WSUSUTIL.exe Postinstall

Point the WSUS clients to the new destination server

1. Open the Local Group Policy Editor, and in Specify intranet Microsoft update service policy, change the URL to reflect the new WSUS server.

2. Update the Group Policy settings that are used to point WSUS clients to the WSUS server by entering the FQDN of the new WSUS server. After you have updated the Group Policy settings, WSUS clients will synchronize with the new WSUS server.

3. To force the clients to detect the new destination server, open a command prompt, and run wuauclt.exe /resetauthorization /detectnow and GPUpdate /Force.

Verify the destination server configuration

  1. In Server Manager, click Tools, and then click Windows Server Update Services.
  2. In the WSUS Administration Console, expand Computers, and verify that all the Computer Groups that existed on the source server are displayed.
  3. Expand Synchronizations. In the Actions pane, click Synchronize now. After the synchronization is complete, (this may take several minutes), confirm that Succeeded is displayed in the Results column.

Reconfigure Group Policy

Open WSUS Group Policy, Edit Group Policy and Change WSUS Server.

Verify client computer functionality

After the detection is finished, open Windows Explorer and check the %WinDir%WindowsUpdate.log to verify that the forced detection was successful.

Windows Server 2012: WSUS Client Not Yet Sync

Issue: Client Not Yet Sync WSUS error

Resolution:

Step1:  Download KB2720211 x64 and apply on WSUS server using the following steps in command prompt with administrative privilege:

  • iisreset/stop
  • net stop wsusservice
  • WSUS-KB2720211-x64.exe /q C:MySetup.log
  • iisreset
  • net start wsusservice

Step2: Open elevated command prompt, type the following. Detailed available on KB958046

net stop wuauserv
cd %systemroot%SoftwareDistribution
ren Download Download.old
net start wuauserv

Step3: Detect and authorize client to WSUS Server. Run the following in elevated command prompt.

wuauclt /resetauthorization /detectnow

gpupdate /force

Before you authorize, make sure WSUS GPO is applied to the clients with following GPO Configuration:

Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows Update

  • Configure Automatic Update—–Enabled
  • Specify intranet Microsoft update service location…… Enabled
  • Enable Client side target……Enabled.

Resolved: WSUS Post Deployment Failed on Windows Server 2012

Error:

2013-11-21 09:43:36  Config file did not contain a value “ContentDirectory”
2013-11-21 09:43:36  Microsoft.UpdateServices.Administration.CommandException: A required configuration value was not found in the system. This is usually caused by installing WSUS through PowerShell and not specifying a configuration file. Review the article Managing WSUS Using PowerShell at TechNet Library (http://go.microsoft.com/fwlink/?LinkId=235499) for more information on the recommended steps to perform WSUS installation using PowerShell.
   at Microsoft.UpdateServices.Administration.PostInstall.GetConfigValue(String filename, String item)

Issue: This is a known issue on Windows Server 2012. Microsoft WSUS team posted an work around to resolve the issue.

Solution: In the WSUS server, open PowerShell, type the following depending on which database you have:

For WID
%programfiles%update servicestoolswsusutil.exe postinstall CONTENT_DIR=C:Wsus

SQL Server databases
%programfiles%update servicestoolswsusutil.exe postinstall CONTENT_DIR=C:Wsus SQL_INSTANCE_NAME=<database server name>

Here content_dir is your real directory where you would like to install WSUS and pointed that directory during WSUS installation and rest are self explanatory. Once you do that you will see output in the logs available in C:UsersthermomixadminAppDataLocalTemp directory.

2013-11-21 09:56:46 Postinstall started

2013-11-21 09:56:46 Detected role services: Api, Database, UI, Services

2013-11-21 09:56:46 Start: LoadSettingsFromParameters

2013-11-21 09:56:46 Content local is: True

2013-11-21 09:56:46 Content directory is: E:WSUS

2013-11-21 09:56:46 SQL instname is: SQL Server Name

2013-11-21 09:56:49 Value is E:WSUS

2013-11-21 09:56:49 Fetching group SIDs…

2013-11-21 09:56:49 Fetching WsusAdministratorsSid from registry store

2013-11-21 09:56:49 Value is S-1-5-2

2013-11-21 10:17:41 Saving Subscription

2013-11-21 10:17:52 Creating default subscription succeeded.

2013-11-21 10:17:54 Populating Auto-Approval Rules.

2013-11-21 10:18:18 Populating Auto-Approval Rules Succeeded.

2013-11-21 10:18:23 StartServer completed successfully.

2013-11-21 10:18:23 Marking PostInstall done for UpdateServices-Services in the registry…

2013-11-21 10:18:23 Mark initialization done in database…

2013-11-21 10:18:25 End: Run

2013-11-21 10:18:25 Postinstall completed

Windows Server Patching Best Practices

This article provides actionable advice about how to manage patches to reduce downtime while still maintaining the security of software services through the proactive reduction of dependencies and the use of workaround solutions.

Patching Requirements

Windows Server patches, hotfixes and service pack is critical for compliance, service level agreement and security purposes. Keeping an operating systems and application up to date is the key to align your infrastructure with latest software. Patches and hotfixes also enable you to prevent any security breaches and malware infection.

Windows Patch Classification

The following are strongly recommended patches:

  1. Critical
  2. Security
  3. Definition Updates for malware
  4. Service packs

Windows Product Classification

It is highly recommended that you patch Windows Servers, Windows Clients, Office, Applications (Silverlight, .Net Framework, SQL, Exchange, SharePoint, FF TMG).

Patching Groups

Consultants should take time to test the patches in a non-production environment prior to being deployed to production. This will help to gauge the impact of such changes. Ideally you will have the following patching groups:

1. UAT (UAT1, UAT2, etc)

2. Test Environment (Test1, Test2, etc)

3. Development Environment (Dev1, Dev2 etc)

4. Production (Prod1, Prod2, etc)

If you have clustered environment like SQL, Exchange and SharePoint then create Prod1, prod2 group and place each node on each group.

Change Management

System administrators should maintain a log, written or electronic, of all changes to the operating environment, to include hardware, system security software, operating system, and applications. Prior to any changes being implemented on a system, the system administrator should receive approval of stakeholders.

Backup

Why am I discussing backup with patching best practice? In case of emergency you can rollback completely and restore a server to its original state if necessary. It is very important that servers be backed up on a regular basis. Depending on the use of the server, it may be adequate to backup the server once per week. A backup of a more critical environment may be needed daily, and possibly continuously. The backup program provided with Windows is capable of backing up to virtually any writable media, which can include network drives provided by a server in another physical location. This program is also capable of scheduling backups which can ensure backups occur on a regular interval.

Microsoft strongly recommends that you create the following backups before you install an update rollup, service pack and patch on Exchange and SQL:

  • A full backup of all databases on the server.
  • A full backup of transaction log and log backup
  • A system state backup of the server.
  • A snapshot of virtualized exchange server. Delete snapshot after successful patching and updating.

Application Compatibility

Read release notes of each hotfixes you are going to apply so that you are compliant with the application installed on the server. Consult with application vendor before applying service pack to any server if the server is hosting specific business application. Consult with application engineer about the importance of server patching. Inform and educate application engineer as much as possible to avoid conflict of interest.

Documentation

Documentation released with the updates is usually in the form of web pages, attached Word documents and README.TXT files. These should be printed off and attached to change control procedures as supporting documentation.

Back out Plan

A back-out plan will allow the system and enterprise to return to their original state, prior to the failed implementation. It is important that these procedures are clear, and that contingency management has tested them, because in the worst case a faulty implementation can make it necessary to activate contingency options. Historically, service packs have allowed for uninstalling, so verify there is enough free hard disk space to create the uninstall folder. Create a back out plan electronically and attach with change management software.

User Notifications

You need to notify helpdesk staff and support agencies of the pending changes so they may be ready for arising issues or outages.

Consistency across Servers

Always install the same service packs or hotfixes to each SQL server node, Exchange DAG member and Domain Controller.

Routine Maintenance Window

A scheduled maintenance window must be agreed with business so that application outage and server reboot can maintain a respectable Service Level Agreement (SLA). If you have a large infrastructure with thousands of servers and many regions working round the clock then you must consider application dependencies. A patching schedule can be considered in between every Friday of every month at 6:00 P.M. Friday to 6:00 A.M Monday. Setup maintenance window in system center or deadline for WSUS to make sure patches are applied when you want instead of when patch is available. In this way you will have a complete control over change windows approved by change advisory board (CAB). Do not allow end users to update patches on their client machine according to their wishes and happiness! then user will never install any patch.

Patching Tools

I strongly recommend that you spend few $$$ to buy Microsoft System Center 2012 to manage and deploy Windows patches, service pack and hotfixes. However you can use Windows Server Update Services (WSUS) as poor man’s patching solutions.

Patching DMZ server can be accomplished using WSUS offline patching solutions available for free to download from http://download.wsusoffline.net/.

Automate, Automate and Automate!

Automated patch management using System Center could enable a single IT administrator to access a pre-populated patch policy. He then could execute the command and with the press of a single button, download the patches from Microsoft’s website, install them on a test machine and test for compatibility issues. Meanwhile, an automatic inventory check could search for systems with the affected software, wake them up, check their readiness and push the verified patches out to waiting machines. The patches would then be automatically installed on each system, and they’d reboot as necessary. The final step is an automated report on the status of the remediated devices.

Standardize Patch Management Processes

Standardized patch management processes could allow for daily assessment and remediation of client devices and weekly assessment and remediation for servers. Reports can then be generated to validate system status on a weekly or bi-weekly schedule. A systems monitoring task that used to take days now takes minutes, and patches are deployed more completely and consistently across the entire IT environment. A single IT administrator can proactively manage thousands of systems tasks in the same amount of time it took an entire team to do the tasks manually.

Reboot Windows Computer

Some application may require reboot of server before patching such as RSA Secure Console. However most of the server must be rebooted after patching. Do not suppress reboot after patching in any circumstances or you will have a messy environment and broken clusters.

X86 and X64 Windows Systems

The most prominent 32-bit application you’re likely to see on a 64-bit Windows system is Office. In this sort of situation System Center benefits most because you can adjust and make decision based on architecture and compliance as well. You can approve patches based on “Needed and Not Installed”. If a server or client need update it will install if not then it will not installed. It’s safe to do so.

Antivirus and Antispyware

Servers are vulnerable to many forms of attack. Implementation and standardization of security methods should be developed to allow early and rapid deployment on servers. It’s important that a Windows server be equipped with a latest centrally managed Antivirus program. Antivirus update must be scheduled with the same maintenance window to update antivirus with latest definition.

Audit Practices

Servers have a powerful auditing feature built in. Typically, server managers would want the auditing system to capture logins, attempted logins, logouts, administrative activities, and perhaps attempts to access or delete critical system files. Auditing should be limited to gathering just the information that is needed, as it does require CPU and disk time for auditing to gather information. Log Management software should be used, if possible, for ease of managing and analysing information. Report can be generated from Systems Center and WSUS as proof of patching cycle.

Log Retention

Servers keep multiple logs and, by default, may not be set to reuse log file entries. It is a good practice to expand the size of the allowed log file and to set it to reuse space as needed. This allows logging to continue uninterrupted. How far back your log entries go will depend on the size of the log file and how quickly you are accumulating log data. If your server environment is critical, you may wish to ensure that the log file size is sufficient to store about 30 days of logging information, and then rotate log files once per month.

Installing Updates on a single Exchange Server

Download Exchange Update from Microsoft Download Center. Record Current Exchange Version information

Check for publisher’s certificate revocation

1. Start Internet Explorer.

2. On the Tools menu, click Internet Options.

3. Click the Advanced tab, and then locate the Security section.

4. Clear the Check for publisher’s certificate revocation check box, and then click OK.

5. After the update rollup installation is complete, select the Check for publisher’s certificate revocation option.

Pre-check before installing

1. Determine which update rollup packages are installed on your Exchange server roles

2. Determine whether any interim updates are installed

3. Review interim updates

4. Obtain the latest update rollup package

5. Apply on a Test Exchange Server

Install Exchange Update

1. Ensure that you have downloaded the appropriate rollup to a local drive on your Exchange servers, or on a remote network share.

2. Run the Windows Installer *.msp Setup file that you downloaded in step 1.

Install Exchange Update on DAG Member

To update all DAG members, perform the following procedures on each DAG member, one at a time. Set the member server in maintenance mode using this PowerShell Command.

.StartDagServerMaintenance.ps1 <ServerName>

Install the update rollup

1. Close all Exchange management tools.

2. Right-click the Exchange update rollup file (.msp file) you downloaded, and then select Apply.

3. On the Welcome page, click Next.

4. On the License Terms page, review the license terms, select I accept the License Terms, and then click Next.

5. On the Completion page, click Finish.

Once installed exit from maintenance mode run the StopDagServerMaintenance.ps1 script. Run the following command to re-balance the DAG, as needed

.RedistributeActiveDatabases.ps1 -DagName <DAGName> -BalanceDbsByActivationPreference -ShowFinalDatabaseDistribution

When the installation is finished, complete the following tasks:

  • Start the Services MMC snap-in, and then verify that all the Exchange-related services are started successfully.
  • Log on to Outlook Web App to verify that it’s running correctly.
  • Restore Outlook Web App customizations, and then check Outlook Web App for correct functionality.
  • After the update rollup installation is complete, select the Check for publisher’s certificate revocation option in Internet Explorer. See “Certificate Revocation List” earlier in this topic.
  • Check Exchange 2010 version information
  • View Update rollup in Control Panel>Programs and Features

Patching Microsoft Failover Cluster

You can install Windows service packs on Windows Server Failover Cluster nodes using the following procedure. Administrative privilege is required to perform the following tasks.

Procedure to install Windows service pack or hotfixes in Windows Server 2003:

  1. Check the System event log for errors and ensure proper system operation.
  2. Make sure you have a current backup and updated emergency repair disk for each system. In the event of corrupt files, power outage, or incompatibility, it may be necessary to revert back to the state of the system prior to attempting to install the service pack/hotfixes.
  3. Expand Node A, and then click Active Groups. In the left pane, right-click the groups, and then click Move Group to move all groups to Node B.
  4. Open Cluster Administrator, right-click Node A, and then click Pause Node.
  5. Install the service pack on Node A, and then restart the computer.
  6. Check the System event log for errors. If you find any errors, troubleshoot them before continuing this process.
  7. In Cluster Administrator, right-click Node A, and then click Resume Node.
  8. Right-click Node B, and then click Move Group for all groups owned by Node B to move all groups to Node A.
  9. In Cluster Administrator, right-click Node B, and then click Pause Node.
  10. Install the service pack on Node B, and then restart the computer.
  11. Check the system event log for errors. If you find any errors, troubleshoot them before continuing this process.
  12. In Cluster Administrator, right-click Node B, and then click Resume Node.
  13. Right-click each group, click Move Group, and then move the groups back to their preferred owner.

Procedure to install Windows service pack or hotfixes in Windows Server 2008 and Windows Server 2012:

  1. Check the event log for errors and ensure proper system operation.
  2. Make sure you have a current backup and updated emergency repair disk for each system. In the event of corrupt files, power outage, or incompatibility, it may be necessary to revert back to the state of the system prior to attempting to install the service pack/hotfixes.
  3. On Node A, Expand Services and Applications, and then click the service or application
  4. Under Actions (on the right), click Move this service or application to another node, then choose the node or select Best possible.
  5. In the Failover Cluster Manager snap-in, right-click Node A, and then click Pause.
  6. Install the service pack/hotfixes on Node A, and then restart the computer.
  7. Check the event log for errors. If you find any errors, troubleshoot them before continuing this process.
  8. In Failover Cluster Manager snap-in, right-click Node A, and then click Resume.
  9. Under Actions (on the right), click Move this service or application to another node, then choose the node.
    Note: As the service or application moves, the status is displayed in the results pane (in the center pane). Follow the Step 9 and 10 for each service and application configured on the cluster.
  10. Install the service pack/hotfixes on Node B, and then restart the computer.
  11. Check the event log for errors. If you find any errors, troubleshoot them before continuing this process.
  12. From the Failover Cluster Manager snap-in, right-click Node B, and then click Pause.
  13. In Failover Cluster Manager, right-click Node B, and then click Resume.
  14. Right-click each group, click Move Group, and then move the groups back to their preferred owner.

You can use the following PowerShell Cmdlet to accomplish the same.

1. Load the module with the command: Import-Module FailoverClusters

2. Suspend (Pause) activity on a failover cluster nodeA: Suspend-ClusterNode nodeA

3. Move a clustered service or application (a resource group) from one node to another: Get-ClusterNode NodeA | Get-ClusterGroup | Move-Cluster Group

4. Resume activity on nodeA that was suspended in step 5: Resume-ClusterNode nodeA

5. Move a clustered service or application (a resource group) from one node to another: Get-ClusterNode NodeB | Get-ClusterGroup | Move-Cluster Group

6. Suspend (Pause) activity on other failover cluster node: Suspend-ClusterNode nodeB

7. Resume activity on nodeB that was suspended in step 10 above: Resume-ClusterNode nodeB

Conclusion

It is critical that when service packs, hotfixes, and security patches are required to be installed, that these best practices be followed.

Bottom line

1. Read all related documents.

2. Use a change control process.

3. Apply updates that are needed.

4. Test patches and hotfixes on test environment.

5. Don’t get more than 2 service packs behind.

6. Target non-critical servers first.

7. Service Pack (SP) level consistency.

8. Latest SP instead of multiple hotfixes.

9. Apply only on exact match.

10. Subscribe to Microsoft email notification.

11. Always have a back-out plan.

12. Have a working Backup and schedule production downtime.

13. Consistency across Domain Controllers and application servers.

Additional Readings:

SQL Server failover cluster rolling patch and service pack process

Patch Management on Business-Critical Servers

Install and configure Forefront Client Security Step by Step part I

Forefront Client Security (FCS) is the protection technology for desktop and server against spyware and antivirus. FCS is centrally managed for both servers and client delivering automated virus protection for organisation. FCS got four different roles such as management, collection, reporting and distribution server. You can combine in a single server or your choice of multiple server. If you already have WSUS in your organisation you can install first three roles in one server and use WSUS as a distribution server.  The key features and benefits of FCS are:

  • Integrated solution for real-time virus and spyware protection
  • Includes advanced malware protection technologies
  • Backed by global malware research & response organization
  • Define one policy to manage client agent protection settings
  • Deploy security software and signatures effectively
  • Integrate with your existing infrastructure
  • View insightful reports
  • Stay informed with state assessment scans and security alerts
  • Customize alerts based on incidents and assets

The following are systems requirement you have to meet before you deploy FCS. Install and configure WSUS server before hand for update services. Follow the step by step guide to configure WSUS.

  • SQL Server 2005 with SP1 or later, Enterprise or Standard (including Database Services, Integration Services, Reporting Services, and Workstation components)
  • .NET Framework 2.0
  • GPMC with SP1
  • WSUS 3.0 with SP1 or later
  • IIS 6.0 and ASP.NET
  • MMC 3.0

Client computers are Windows XP, Windows 7, Windows Server 2003, Windows server 2008, vista and windows HPC with windows update services running.

Note: FCS does not support SQL server 2008 and Windows Server 2008 R2.

Installation of FCS:

Insert disk into FCS server or mount FCS ISO if you want virtualize FCS server.

  1 2

3 4

For the shake this article, I am showing all the component in the component selection. However, in practical you have choose right server roles to deploy FCS.

5 6

7 8

 9 10

11 12

13

WSUS Deployment:  You must specify that Automatic Updates download updates from the WSUS server rather than from Windows Update or Microsoft Update.

To Select FCS Client in WSUS:

  1. In the WSUS console, click Options, Click on Products and Classification
  2. Click on products Tab, Scroll down and Click on Forefront Client Security
  3. Click on Apply
  4. Click on Classifications, Select Critical Updates, Definition Updates, Security Updates, Updates
  5. Click Apply and OK.

image 15

To configure Automatic Updates

  1. In the Group Policy Object Editor dialog box, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Windows Update.
  2. In the Setting list, double-click Configure Automatic Updates.
  3. In the Configure Automatic Updates dialog box, click Enabled, and then click OK.
  4. In the Setting list, double-click Specify intranet Microsoft update service location.
  5. In the Specify intranet Microsoft update service location dialog box, click Enabled, enter the client configuration URL in both the Set the intranet update service box and the Set the intranet statistics server box. For example, type http://servername in both boxes, and then click OK.  or http://servername:8530
  6. In the Setting list, double-click Allow Automatic Updates immediate installation.
  7. In the Allow Automatic Updates immediate installation Properties dialog box, click Enabled, and then click OK.

To approve the client components in WSUS

  1. In the WSUS console, click Options, and then click Synchronization Options.
  2. On the Synchronization Options page, under Update Classifications, click Change and verify that the following check boxes are selected: Critical Updates, Definition Updates, and Updates.Click OK.
  3. In the console, click the Updates icon.
  4. Select the most recent Client Update for Microsoft Forefront Client Security, and then under Update Tasks, click Approve for installation. In the Approve Updates dialog box, click OK.
  5. In the End User License Agreement dialog box, click I Accept.

16 

17 18

 19 20

FCS Administration:

To create a policy

  1. In the Client Security console, click the Policy Management tab.
  2. On the Policy Management tab, click New.
  3. In the New Policy dialog box, enter the settings you want for this policy.
  4. After you finish creating the policy, click OK.

To deploy a policy

  1. In the Client Security console, click the Policy Management tab, and then click the policy you want to deploy.
  2. Click Deploy.

In the Deploy dialog box, select the targets to which you want to deploy the policy. You can add multiple targets to deploy the policy.

  1. Click Add OU/GPO/Group. The Active Directory dialog box appears and lists the top-level OUs.
  2. Under Select a target, find an OU to which you want to deploy the policy and select it. If you want to deploy a policy to all of the managed computers in a domain, you can select the domain instead of an OU.
  3. Click OK.
  4. Click Deploy. Client Security deploys the policy to the targets you selected.
  5. If you deployed the policy to an OU and you want the policy to take effect immediately, you can run the gpudate /force command on each client computer in the OU or restart each client computer. Otherwise, the policy is applied to client computers when the standard Group Policy refresh occurs.

To approve clients manually through the MOM server:

  1. On the Client Security management server, click Start, click All Programs, click Microsoft Operations Manager, and then click Administrator Console.
  2. In the MOM 2005 Administrator Console, under Console Root, expand Administration, expand Computers, and then click Pending Action.
  3. In the Pending Action list, right-click the client computer, and then click Approve Manual Agent Installation Now. If you do not see the client in the Pending Action list, wait a few minutes, and then on the Action menu, click Refresh.
  4. In the Microsoft Operations Manager dialog box, click Yes to confirm approval. The client computer will disappear from the Pending Action list.

Note: During the installation of FCS, a basic version of MOM install in FCS management server.

Relevant Articles:

How to install SQL Server 2005 Reporting Services on a Windows Vista-based computer

Install and configure WSUS 3.0 SP2 – Step-By-Step

Forefront Endpoint Protection

ShareAdd to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

Configure Forefront TMG 2010 to receive definition update from Windows server update services (WSUS)

Forefront TMG maintains the definitions of known viruses, worms, and other malware. To keep these important definitions up to date, Forefront TMG has built in a centralized mechanism called the Update Centre that allows the administrator to configure the update frequency as well as the automatic update action. The Update Centre can be accessed from the Forefront TMG console.

The following features in TMG rely on signature updates:

clip_image001 Network Inspection System (NIS) Microsoft Update delivers signatures and protocols that help protect the network.

clip_image001[1] Malware Inspection Microsoft Update delivers Microsoft Antivirus definitions to filter virus-infected files that can be downloaded by the users from the Internet.

clip_image001[2] Exchange (Anti Spam) Microsoft Update delivers Anti Spam signatures to the

clip_image001[3] Exchange Anti Spam agent.

clip_image001[4] Forefront Security for Exchange (FSE) Recipient Update Services deliver definitions to multiple antivirus engines used in FSE.

clip_image001[5] URL Filtering Updates Microsoft Updates delivers new URL Filtering categories to filter out unwanted sites.

Configuring Windows Server Update Services (WSUS), follow the steps:

1. Log on to WSUS server.

2. Open WSUS Console. In the left hand pan Click Options.

3. Click on Products and Classifications, Products and Classification Window will appear

4. On the Products Tab, scroll down to Forefront. Check Forefront Threat Management Gateway Definition update for HTTP malware Inspection, check Forefront TMG MBE and Forefront TMG definition update for Network Inspection system.

5. Click on Apply and Ok. Close WSUS Console.

To configure Update Centre in Forefront TMG 2010, follow these steps:

1. In the left pane of the TMG management console, click Update Centre.
2. In the right pane, under Tasks, click Configure Settings

3. The Update Centre Properties setting appears, with the Definition Updates tab selected

4. Highlight Malware Inspection and click Configure Selected.
5. The Definition Update Configuration settings appear

6. The default automatic update action is Check For And Install Updates. The other two options available are Only Check For Updates and No Automatic Action. For this example we will leave this at its default and recommended setting.

7. The Automatic polling frequency is set to 15 minutes by default. This is the time
interval in which TMG will poll for new definition updates. This can be increased up to 4 hours.

8. You can also set an alert to be triggered in case no new updates are installed within
a certain number of days. The default value for that is set to 5 days.
9. Click OK to return to the Definition Updates tab under Update Centre Properties
settings.
10. Highlight Network Inspection Service (NIS) and click Configure Selected. Again the Definition Update Configuration settings for NIS appears, which is the same as what we saw for Malware Inspection except for the number of days to trigger an alert (45 days for NIS).
11. Click OK to return to the Definition Updates tab under Update Centre Properties
settings.
12. Click the Microsoft Update tab

13. TMG uses Microsoft Update services to deliver malware updates to TMG. For TMG to receive these updates make sure that the option Use The Microsoft Update Service To Check For Updates is selected.
14. Click Microsoft Update Service to configure the policy configuration for protection mechanism definition updates

15. The option selected by default is Use Machine Default Service But Fallback To Microsoft Update. Here, check use Windows Server Update Services (WSUS).

16. Click Apply and OK to return to the TMG console.

Relevant Articles

Forefront TMG 2010: Publishing Exchange server 2010

Forefront TMG 2010: How to install and configure Forefront TMG 2010 —-Step by step

Forefront TMG 2010: Publish Outlook Web Access and Exchange Servers using Forefront TMG 2010

Beer mugAdd to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine