what would scooby do

One of our techies is having a problem with a SUS server - it keeps saying it can't push down the updates to the PC's (XP PRO) as the user does not have admin rights. Now never having seen SUS server meself can someone please give me an idea on how it is supposed to work i.e. do you create an admin equiv account on each pc and give the SUS server that account to use ??

ozzy

IIRC, the user needs local admin permissions (i.e. member of local admin group) to interact with AU service.

If the local user doesn't have admin permissions, then the AU needs to be scheduled using a Global Policy.

The SUS server interacts with the AU service on each client PC. It's the AU service that initiates the update queries not the other way around.

Have a look at the SUS White Paper for more detailed info.

Stefan

what would scooby do

Cheers, I've already downloaded the paper so I'll take a look

NickAdams

iTrader: (5)

Yep,as per what Stefan is saying...
MBSA (Microsoft Baseline Security Analyser) won't allow you to scan a remote client either unless you have admin rights on that particular machine.Easy enough to grant yourselves admin rights on the remote machines though!!

Good luck

Nick

what would scooby do

.. yup Nick, only problem is this is a corportate environment where admin rights are never granted to local users /workstations

ozzy

You should be able to manipulate the AU using a policy so that the workstations pull the updates from the SUS server.

Or you should really consider something along the lines of SMS Server in a large Corporate environment. SUS is really for small businesses.

Stefan

what would scooby do

Sure, yes in a Microsoft environment we would use SMS but here there be netware and Linux

darlodge

I'm still playing with an SUS server (running on Server 2003). Its distributing updates to Windows 2000 and XP machines running Novell.

Have you loaded the updated adm file called wuau.adm on each machine? This enables you and me () to schedule the updates at different times (we are going to do ours at 11am). If the user on the machine is an Administrator they receive a 'balloon' to tell them there are updates to install. If the user is a 'normal user' it just install it without asking, exactly how we wanted it to work

I am still playing with it and am not 100% how it works but its free so I like it

Darren

what would scooby do

Sounds good - I'm gonna set one up and have a play

darlodge

No worries,

E-mail me, PM me or post here for any assiatance. I might be able to help. Its really cool once you get going. Easy administration, simple (once you get your head round it).

Saves running around 300 machines all at once. I am sure we will go over to SMS at some point as its apparently better designaed and there are more functions but we needed something ASAP and from what I read, SMS was/is a b|tch to set-up.

Darren

what would scooby do

cheers Darren

Puff The Magic Wagon!

iTrader: (2)

<kicks memory>

Its all about having a Global GP set up for every user that runs MS Update but checks with SUS instead.

The "howto"s are all in TechNet or KB but each machine (irrespective of user) checks itself against the latest specs (either @ 03:00 for me or on boot) then d/loads the relevant files and installs them. I have not had to muck about with permissions.

The only problem I have is that I need to click the tray icon to install (my first attempt) as opposed to auto-install. Can't seem to change that though I have tried to amend the defaults...

darlodge

Puff,

If you have added the updated adm file (have you done this?) onto each machine and the user is logged on a normal user you should not receive the sys tray icon.

Once you have loaded the adm file there are a few extra registry entires that have to be added and then the updates will install sliently, proving you are a USER on the machine. If you are logged in as an Administrator, you will receive the systray icon.

I can't remember what the options are but they are something like these DWORD values
AUOptions = 4 (This is vital and makes the updates install at the scheduled time)
AUSCHE = 0

There are more but I can't remember the exact keys but I'll whack them up on Monday. I've also got the adm file at work if you need that.

DArren

WRX_Rich

iTrader: (5)

u will get the tray icon if you are a admin on the local pc, none admins will just install at the time set in the group policy

www.susserver.com

we use it along side sms 2003, they both have there strengths but as sus is so easy to set up we stick with it and I only set sms up 2 weeks ago

can you use sms 2003 just the same as sus with regular downloads ?

darlodge

WRX_Rich,

We have not got a group policy running yet so we added these command line entries in the

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto Update]

"AUOptions"=dword:00000004 (4)
"AUState"=dword:00000002 (2)
"ScheduledInstallDay"=dword:00000000 (0)
"ScheduledInstallTime"=dword:0000000b (11)
"LastWaitTimeout"="2004.05.29 01:51:10"

Darren