Issues with the M$ Update site.

[Roger Faucher]

Hi:

Is everyone aware of SUS (Software Update Services)? See: http://www.microsoft.com/windows2000/windowsupdate/sus/default.asp

Roger

[Norman_21]

John,

It's as indicated by the guys, to double check with the Networking guys or the Firewall guys to see if they blocked something. Also, if you are a part of the WAN Corp. why not calling one of the branches or the Corp. office to see if they have the same problem assuming they go thru the same Gateway. If you think something has to do with the IE settings. Try downloading another Browser, e.g) www.Mozilla.org or www.netscape.com just to test the download. Do you have problems downloading from other sites.

Just my $0.02 Cents.
Take care.

[Roger Faucher]

Hi all:

Here's a quote from Brian Livingston's newletter which probably explains the difficulty.

"The programmer of Blaster, however, erred by directing the attack at the domain name windowsupdate.com. This name always redirected to the true name, windowsupdate.microsoft.com. Microsoft averted Blaster's attack by simply disabling the shorter name. The service itself remains operational, although it was slowed by the many Windows users who suddenly wanted to download patches."

See BriansBuzz.com for Brian's website or to subscribe to his newsletter.

HTH

Roger

[Norman_21]

John,

I think Roger is right, Have you tried to use the removal tool from symantec:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

[Jay Bollyn]

John,

It sounds like you might need more than SUS. You might need SMS, here is the link:

http://www.microsoft.com/smserver/

SUS is only good for strictly win2k/winxp clients. Also, we apply windows service packs manually. (We cannot trust this kind of thing to an automated process.) Plus, SPs are only issued yearly or so. Very different issue from Critical Updates, which are approximately twice per month.

:-) Jay

[Jay Bollyn]

I forgot to mention, if you subscribe to Technet Plus Single User ($530), you get lots of late beta (release candidate) or time-limited software (180 days) to try out. I am running SUS on windows 2003 server, 180-day license.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/subscriptions/wanttn.asp

More, as the spirit moves me. (after all, it is weekend.)

:-) Jay

[John Collier]

OK ladies and germs, here???s the last thing I have found on this issue:

It seems as if M$ has done part of this to us by putting a different IP address on their download server linked to the M$ Update Site. If you put a ping out on your unmodified M$ machine to ???dowload.windowsupdate.com??? you will get the wrong address (most likely). I know I did and it took one of our internal support people to point it out to me (but he still hasn???t told me where he got the info from ).

It required a change in the host file with the new IP addresses to solve the problem on the Win2k machines and now it all seems to work just fine with them.

The problem has not been fixed on the NT4 machines, though. The same entries in the host file has no positive results on them.

Anybody know if M$ has a different download server for NT$ than it does for the Win2k machines? If so, any pointers on what entries in the host file would resolve the issues with them?

Input is still welcomed on this???


BTW,

Jay,

The idea of putting out $530 for anything right now is simply terrifying. Maybe when the economy improves some I might be able to reconsider, but it just isn???t happening right now. Thanks for the thought, though???

[Jay Bollyn]

John,

In response the the sobig virus, we recently had to change the IP addr of our Intranet SMTP server. Sounds like a similiar deal on the MS Intranet.

$530 is no small amount of $, especially if it is you or me writing the personal check. But in my view, everyone who is responsible for administering MS desktops (and especially MS server stuff) needs a subscription to MS TechNet Plus. That is where I got the 180-day license of server 2003, on which I am running SUS. Once management sees that stuff is actually going to work, based on the trial software, they are more inclined to pop for the real thing.

I have already shown them how many hours it takes for my staff to visit each PC applying critical updates. It is even more scary to make users Local Admins, so they can update their own PCs. My users simply cannot handle the responsibility from a technical standpoint, and many resist because they will never understand the security concepts involved.

I also got a copy of SMS 2003 RC1 through TechNet Plus, but it appears one needs to be running domains, which rules my network out, since we are Novell Netware.

Everyone is expected to do more with less these days, and I don't mind working harder and smarter. But there are some software tools that make good business sense, and TechNet Plus is one of those tools.

:-) Jay