Server 2008 Core Windows Updates Full Management

The latest version of the SmartX Core Configurator takes a stripped down default process and makes it fully admin friendly. No more do you have to unplug and pray that the updates install while your reboot the Core machine. WSUS can tell you what you need installed, you can approve the install but there is no way to ‘on demand’ force it to initiate the installation process. If it fails to install you aren’t given easy access to the relevant logged information. If you feel like the Core OS’ scant footprint is too scant in this are then you need this tool. Like Exchange 2007 which is fully Power Shell driven so is Core; and also like Exchange you can build a nice GUI to call common shell scripts to do some quick work rather than fill your mind with more information to memorize (and forget).

In next window hit Advanced button.

And then you can Search for needed updates and check the box and install whatever subset of updates you wish. You can even see a history of whatever is installed on the Core machine – very nice!

Reference – WSUS 3.0 wsusutil command-line utility

http://technet.microsoft.com/en-us/library/cc708604.aspx

Summary of wsusutil Commands

 

configuressl

Updates the WSUS server registry key after the IIS configuration has changed.

healthmonitoring

Configures health monitoring values in the database. If new values are not specified, the current values are displayed.

export

Part of the export/import process used to synchronize a downstream WSUS without using a network connection.

Exports update metadata to an export package file. You cannot use this parameter to export update files, update approvals, or server settings.

import

The second part of the export/import process.

Imports update metadata to a server from an export package file created on another WSUS server. This synchronizes the destination WSUS server without using a network connection.

movecontent

Changes the file system location where the WSUS server stores update files, and optionally copies any update files from the old location to the new location

listfrontendservers

Lists the front-end servers related to this WSUS server.

deletefrontendserver

Deletes the specified front-end server from the WSUS database.

checkhealth

Checks the health of the WSUS serve. Results will appear in the Application Event log.

reset

Checks that every update metadata row in the database has corresponding update files stored in the file system. If update files are missing or have been corrupted, downloads the update files again.

listinactiveapprovals

Returns a list of update titles with approvals that are in a permanently inactive state because of a change in server language settings.

removeinactiveapprovals

Removes approvals for updates that are in a permanently inactive state because of a change in WSUS server language settings.

usecustomwebsite

Changes the port number used by the WSUS Web services from 80 to 8530 or vice versa.

BITS Peer Caching – many clients only one Windows Update download – WSUS optimization

Inside the WSUS 3.0 SP2 Operations Guide document in Appendix E (p123) I found this very cool nugget.  This applies to WSUS deployments where updates are not downloaded, stored, and distributed locally.

Assuming all the clients are online and scheduled to query and sync for Windows Updates (WSUS, WU, MU) together you could greatly benefit from only downloading a patch once.  For my peers in Australia who pay for bandwidth used this may be quite valuable.

Peer caching

Peer caching is a new feature of BITS 3.0 that allows peers (computers within the same subnet of a network that have the peer caching feature enabled) to share files. If peer caching is enabled on a computer, the Automatic Update agent instructs BITS to make downloaded files available to that computer’s peers as well.

When the files have been downloaded, BITS caches them. When another (peer caching-enabled) computer tries to download the same update, BITS on that computer sends a multicast request to all of that computer’s peers. If one or more of the peers responds to the request, BITS will download the file from the first computer to respond. If the download from the peer fails or take too long, BITS continues the download from the WSUS server or Microsoft Update.

This feature of BITS can optimize the bandwidth used by WSUS in several ways.

1. Peer caching decreases the amount of data transferred from the WSUS server to its clients, because computers in the same subnet will usually download the updates from each other.

2. Peer caching decreases the amount of data transferred across the WAN when some or all of the clients of a WSUS server are located in different locations.

3. Peer caching decreases the amount of data transferred across the Internet if WSUS clients in the same subnet are configured to download updates from Microsoft Update.

Note

BITS peer caching requires computers to be running Windows Vista or Windows Server 2008, and to be part of an Active Directory Domain.

For more information about peer caching and peer servers, see Peer Caching (http://go.microsoft.com/fwlink/?LinkId=79432).

To enable peer caching (on Windows Vista)

1. Start the Group Policy Object Editor (click Start, click Run, and then type gpedit.msc).

2. Expand Computer Configuration, then Administrative Templates, then Network, then Background Intelligent Transfer Service.

3. Enable the Allow BITS Peercaching setting.

4. Enable the Maximum network bandwidth used for Peercaching setting, and set the maximum bandwidth in bits per second (the default is 104857), then click OK.

5. Enable the Limit the BITS Peercache size setting, and set the percentage of disk space to be used for the peer cache (the default is 5 percent), and then click OK.

6. Enable the Limit age of items in the BITs Peercache setting, and set the number of days (the default is 90), and then click OK.

Note

You must be an administrator to perform this procedure.

**author note**  besides modifying the applicable GPO on Vista you could also do this from a Server 2008 server.  Vista is the first client OS to provide domain scope GPO management.

Antivirus 2008 or was it 2009 or was it…? a Malware Removal Tool Discussion

Last month’s Microsoft Malicious Software Tool cleans this threat (Win32/FakeSecSen – Microsoft naming):

http://blogs.technet.com/mmpc/archive/2008/11/12/win32-fakesecsen-a-nasty-piece-of-work.aspx

…and Microsoft has had a great amount of success as reported by the tool:

---

From Sandi @ Spyware Sucks this business perspective breakdown in $

Fraudware detected on 994,061 computers

As reported by Microsoft:
http://blogs.technet.com/mmpc/archive/2008/11/19/msrt-review-on-win32-fakesecsen-rogues.aspx

The figures relate to what Microsoft has labeled “Win32/FakeSecSen”.  That figure does not (I think) encompass all of the fraudware (fake security software) products that are out there.

Just imagine, if you will, if just 1% of the owners of those detected machines were fooled into buying the fraudware software at $40 a pop – that’s $397,624.40 in illicit income garnered by the crooks.  When we take into account the fact that billing services such as the (now defunct?) Bucksbill were regularly accused of double-charging victim’s credit cards, then we’re looking at an illicit income of $795,248.80.

Scary, isn’t it.  Is it any wonder the crooks behind malvertizing are so persistent?

Published Friday, November 21, 2008 9:53 AM by sandi

---

Here’s a word on the tool from Microsoft’s Steve Riley including some information I found uniquely valuable:

Steve Riley [MSFT]

Newsgroups: microsoft.public.security.virus

From: “Steve Riley [MSFT]” <steve.ri…@microsoft.com>

Date: Mon, 1 Dec 2008 14:15:34 -0800

Local: Mon, Dec 1 2008 5:15 pm

Subject: Re: Alerting – Malicious software removal tool (MSRT)

When the MSRT runs, if it finds what it looks for, it removes it and reports that removal to Microsoft. If it finds nothing, it exits. Neither I nor the
tool nor the SIR make any claims that the MSRT completely cleans a machine. As others have pointed out, it is one element of an effective arsenal of
tools to help improve security.

Here’s something interesting, which might even surprise you: this month (November 2008) the single most prevalent piece of malware the tool detects
is Win32/FakeSecScan (rogues that mimic the Security Center). As of 13 November, we’ve tracked 811,000 removals. This includes some FakeSecScan
threats that were no longer active when detected — meaning that they were incompletely cleaned manually or by other AV products, and the MSRT
successfully cleaned out the remaining bits.

I have a proposal for you — actually, for everyone reading this thread. The MSRT creates a log file in %WINDIR%Debug. KB 890830 describes its output.
If you ever encounter an instance of where the tool fails to properly clean a machine, the Microsoft Malware Protection Center is ready to help. Go to
http://www.microsoft.com/security/portal, click on “Submit a Sample,” and please send us your MRT.LOG file and a sample of the malware, if you can.
We’d love to work with everyone to make sure the tool is as effective as possible.

–
Steve Riley
steve.ri…@microsoft.com
http://blogs.technet.com/steriley
Protect Your Windows Network: http://www.amazon.com/dp/0321336437

---

You may not be aware, but you can run that Microsoft tool manually.  ‘Run-> MRT’  It of course runs in the background quietly after you download it’s latest version via MU or WSUS each Patch Tuesday.  To learn more on running this manually and an in depth guide on the tool look here:  http://www.vista4beginners.com/Windows-Malicious-Software-Removal-Tool

Another tool I heard recommended that I’d never heard of before (much like it was with the ever successful against this threat – Malwarebytes) is SuperAntiSpyware:

Here’s some very interesting background on the bad guys behind this threat from security super-friend (think Hall-of-Justice) Jesper:

http://msinfluentials.com/blogs/jesper/archive/2008/11/07/xp-antivirus-in-the-news.aspx

If you want to be knowledgeable and prepared for this ever adapting malware threat, read the above and follow the references on how this elaborate shakedown scam got hacked.  It is very impressive to see how they have been so successful at their nefarious deeds due to capitalism in the black market.  Basically they have implemented a franchise business model of sorts founded on social engineering piggy-back attacks.

Blackberry Server Software, MDS, & Java Update Mayhem

A fundamental relationship exists between BlackBerry server software and Java Runtime Engine software.  This relationship specifically relates to the BlackBerry MDS Connection Service.   This becomes very apparent if ever on the related server you update Java to a current version and remove the older version(s).  Now Java does this cleanup of older versions automatically with the introduction of Java version 6.10.  Without the correct pointer to the latest changed Java version, the BlackBerry MDS Connection Service will become effectively broken.  The pointer is a registry entry that refers to the associated jvm.dll file of a version of Java you have installed.  Note – if you have multiple versions of Java then you have multiple jvm.dll files on your system.

It’s been a little while since I originally posted on this; in fact, since then RIM has introduced some new server products that are basically all the same code foundation.  This means that the same solution still applies wherever MDS is involved.  Perhaps in the future RIM will find a way to automatically make the adjustment, but for now you will have to do the steps yourself.  The nice thing, as you will see below, is that Java may help by using a consistent path with updates of the same version.

The path to the Java jvm.dll file has been changed; the new path is:

C:\program files\java\jre6\bin\client\jvm.dll

Use this link to the previous article for the outline of the registry editing steps involved:

http://duitwithsbs.wordpress.com/2008/08/05/bmds-errors-galore-after-removing-old-java-version-from-bes-server/