Windows Updating and Security

Keeping your Systems Up-to-date

Most compromises of machines running Microsoft operating systems have taken advantage of vulnerabilities for which patches were already available. Had these machines been up to date, they would have not been compromised. But keeping hundreds of workstations fully up-to-date is an almost impossible task without some level of automation.

The document Keeping Windows Workstations and Servers Up-to-date explains how one can use built-in Microsoft tools to simplify the updating process. In particular, it is shown how the Windows Software Update Service (SUS) can be conveniently setup in our environment to enable workstations to be automatically updated with Operating System patches.

Setting up SUS on client workstation is most easily achieved using Group Policies. Otherwise, editing of the registries of the individual workstations is necessary. However, areas of the University that are not part of the Active Directory forest can make use of the utility UnimelbSUSv1_2.exe to put the necessary registry edits in place and thus easily configure their workstations.

Securing Windows Computers with Templates and Policies

Windows installations "out-of the box" are not highly secure! However, tools exist which can help you in remedy this situation. The document Securing Windows Computers with Templates and Policies contains the note for a presentation at the University of Melbourne SecureCon 2004 workshop on this topic.