How do you deploy patches over an NT network? IT pro Duncan Erb shares his solution
Windows Server Update Services (WSUS) is great for automating and simplifying deployment of Microsoft patches—as long as you're running Windows 2000 or later. When Duncan Erb and his partner accepted the assignment of designing, building, and managing a 1500-node Windows NT 4.0 WAN for a US Navy aircraft carrier, they had to figure out a method for deploying patches over the WAN to about 3500 users scattered across a 100-square-mile area. Windows IT Pro senior editor Anne Grubb recently spoke with Duncan, a senior consultant for IT services provider Keane, Inc., in Virginia Beach, Virginia, about how he handles patch management and other administrative tasks under the limitations of an NT environment.
Tell me some more about the work you do for the Navy and why you were hired to manage large, NT-based networks on aircraft carriers.
My partner, Roger Robbins, and I manage a contract through Northrop Grumman IIS for the Navy. Aircraft carriers come \[into port\] to Northrop Grumman for their 3-1/2 year overhaul. The ship is stripped down to the bare bones, including the network. We supply a WAN for the ship's personnel to use while the ship is in repair.
We manage two domains: one for the contractors and personnel who are permanently here, like myself and my partner, and the ship's domain. We basically take it over on our network. So we have to use whatever OS they're using, otherwise you run into issues when they return to their own network on board. Right now, I'd say that 90 percent of the carriers are on NT 4.0. The Navy, in certain respects, is a little behind the times. The issue is, the Navy can't just throw a \[new\] OS on because they have so much legacy software that they have to test first to make sure it all works \[with the new OS\], and then they have to come up with security for it.
Because the network is NT, you can't use Microsoft's Windows Server Update Services (WSUS) to deploy Microsoft updates and hotfixes to users. How did you solve that problem?
Doing patch management on NT is a near impossibility, unless you use a logon script or Microsoft Systems Management Server (SMS). I'm not a big script writer; I'm a network engineer. We do everything from putting in fiber to configuring switches, routers, workstations, and servers. After trying out a demo, we chose the ScriptLogic product because it simplifies building custom logon scripts. These scripts run a lot faster than the old Navy logon scripts did—15 seconds, instead of 15 minutes.
Talk about the patch-management solution that you developed.
We build logon scripts that are customized for each user. The Navy has departments in different locations that have different requirements. You have to set up printers, set different applications to run, have various drive mappings, and so on. There are only two of us administering the domain, and to handle all these tasks through NT by using user profiles or writing a script is fairly difficult. The product does the hard work for us: the day-to-day operations of getting our users \[the resources\] they need.
For patch management, we use logon scripts when we have a patch that we have to fan out to the area. The problem is that all the NT 4.0 workstations are configured differently. For example, some have Internet Explorer (IE) 5, others have IE 6. I can build a package using the product's Application Launcher and send all the patches out all at once. You can tell the tool to launch only one time, or launch multiple times, and over multiple OSs and with different loads.
What types of applications are deployed through the logon scripts?
Mostly Microsoft security patches. Also, when a virus hits, we have to farm out a special tool to search for the virus or to see whether any systems have the virus, whether it's been introduced into the network. Or if there's a special application that maybe just a couple of people need, and \[the users are\] in a remote location, we just put it into a special profile, and when they log on, the application launches for them.
Gartner estimated that more than 20 percent of installed Windows servers were still running NT at the end of 2004, when Microsoft stopped supporting the OS. I suspect a contingent of our readers are in a similar situation, where they're on old technology and have to find alternate methods for patch deployment.
I hope not! But I'm sure that's true, considering the way the economy's been. People have slowed down on upgrading.
Can you quantify the benefits that your solution has provided?
We've gained a huge time savings. We can plan out scripts for each user, location, and department, all in about 10 minutes, whereas it used to take hours. I can make profiles for each department, then designate the users by those profiles. It's like having Active Directory (AD) for NT. And even after the carriers move to Windows Server 2003, and we'll be able to use Group Policy and AD, we'll still use ScriptLogic to automate things like Outlook \[settings\], printers, paths, and drive mappings—the stuff that changes day to day.
