Practical Security

Patching Windows

Since Windows is so prevalent, let’s look at Microsoft’s patching solution. Microsoft has a service called the Windows Software Update Services,^[25] or WSUS for short, that helps administrators manage the patching process for all the computers in a domain. With WSUS, you can push updates for Microsoft software to all the workstations in your domain. The details of WSUS are beyond the scope of this chapter, but here are the main things you’ll want to have:

• You should have automatic deployment of patches enforced at the Windows domain level.

• You’ll want some level of testing of patches. Ideally this would take the form of an automated test environment, where Windows computers go through the motions of simulating commonly performed ...