--- Forwarded Message from Frank Keller <[log in to unmask]> ---

>Date: Wed, 19 May 2004 09:14:53 -0400
>From: Frank Keller <[log in to unmask]>
>Subject: Re: #7522 Windows updates and disk image management.
>To: [log in to unmask]

Your deployment of Deep Freeze makes this a very tough question. Here at
the JHU Language Lab, we use Ghost to image all of our machines, and a
new image is thrown onto the machines biannually. Over the summer, one
of the projects is to come up with a fresh working image that can be
used throughout the year (All PC's are near identical Dells). If a
student monitor finds out a machine is damaged beyond a 15 minute fix,
we just throw a new image on the sucker. All machines are set to
autoupdate both Windows patches and run on NAV servers. In the past we
have used Altiris, and will probably implement that again soon. Altiris
allows better management of machines, and easy image control. Building a
new image biweekly to keep up with patches seems to be something you
have to do these days.
Windows Updates are a mandatory exercise. We have had several virus runs
that have knocked down a good portion of the University network (Code
Red, Blaster), but Sasser caused very little effect (mostly dorm
machines) because of the strict policy of keeping NAV updates and Win
patches current. When I worked with banks, we used Novell for our
networks. Anytime there was a virus or patch issue, we had to come in
very early that morning or the night before, write the patch into the
login script, and let it execute. Seemed to work very nicely except for
the fact we were working reactively on patch situations.


Frank Keller
Microcomputer Support Specialist II
Language Lab, SAIS QT Streaming
and Political Science Dept.
506 Krieger Hall
Johns Hopkins University
410-516-6767
[log in to unmask]
>>> [log in to unmask] 05/18/04 2:19 PM >>>
--- Forwarded Message from David Kanig <[log in to unmask]> ---

>Date: Tue, 18 May 2004 12:12:57 -0400
>To: [log in to unmask]
>From: David Kanig <[log in to unmask]>
>Subject: Windows updates and disk image management.

We've been using DeepFreeze on our lab machines so that changes users
make occur only in a shadow file, and on restart the machines go back
to an inviolate, constant image.  Under the protection of DeepFreeze,
we've been forgoing updates both to Windows and virus definitions.
However, between DeepFreeze refreshes our machines are vulnerable to
temporary infections, making them vectors for the spread of worms,
and risking automatic filtration from our network by IT scanners.

We want to be free of the labor of having to perform many Windows
updates.  We can't automate middle-of-the-night updates because on
restart by DeepFreeze in an unfrozen state, our machines require
authentication through Novell before anything can be launched.

More importantly, we want our machine configurations to be stable and
predictable through the academic year.  In the past, one or more
Windows updates has caused a third-party program to fail,
interrupting course work.

How do you manage the conflicting goals of keeping disk images stable
and responding to the deluge of Windows updates?
--
~~~~~~~~~~~~~~~~~~~~~~
David Kanig
Manager, Technical Services
Language Resource Center
Box 1935
Brown University
Providence, RI 02912

(401) 863-7090