B3000 Windows 2000 Enterprise updates

[Craig Hale]

What is the "offical" stance on applying MS security patches, hotfixes, etc...to the OS? Since auto-update is disabled by default, I used the MS Network Security Analyzer to locate missing updates post SP3. Anyone with "real-world" experience in this area?
Thank you,
Craig Hale

[Kevin Harlan]

Service Packs:

HP receives pre-release services packs from Microsoft which HP evaluates through out the release process including the release candidate.

Testing includes loading the patch and running functionality tests to confirm that no issues are found

HP releases formal documentation in the form of an EA/CA upon completion of the testing. The current EA/CA reads Service Pack 3 may be applied. A new EA/CA is in process.

Due to the nature and size of Service Packs, service pack testing generally is a lengthy process and support for the service pack does not coincide with the release from Microsoft.

HP does not support Service Packs loaded by the customer on their system until HP has completed the testing of said Service Pack and released the corresponding EA/CA.

Hot-Fixes:

Microsoft Quality Assurance teams fully test all "Critical Updates & Service Packs" prior to their release on Windows Update -- except Security Updates, which are released on an accelerated time line

Due to the nature of Hot-fix releases, HP receives very little to no warning of a release.

When a release occurs, HP recommends installing the fix when it involves security holes because HP believes holding up a security fix could potentially leave the customer open to attack.

At the time of the release ( within 2 business days), HP performs testing which includes loading the patch and running functionality tests to confirm that no issues are found.

Current policy, HP does not issue an advisory unless a problem is found with a particular patch.


--------------------------------------------------------------------------------


FUTURE PLANS: What we are now attempting to do is create a PDF file with a chart of all the patches and their information, and then post that (somewhere) on our NAS product website. Once we can get that in place, then anybody can pull up the list and see what patches we have tested and whether there are any issues.


--------------------------------------------------------------------------------