Windows XP SP2: Centralized Deployment and Defense

Windows XP Service Pack 2 (SP2), with its Windows Firewall component, promises to be a white knight for those of you who want to defend your XP client systems (and the rest of your networks) against malicious invaders. The thought of deploying the service pack and configuring the firewall on all your clients, however, might make you want to throw yourself in the moat. But hold on: XP SP2 takes advantage of Group Policy to let you centrally deploy the service pack and configure Windows Firewall. (Be aware that the final version of SP2 is likely to have changed somewhat from the prerelease version I used when writing this article, so some details might be different than those I describe here.)

Deploy...
All service packs for Windows 2000 and later include a Windows Installer (.msi) file that lets you automatically push out the packs to appropriate computers simply by using Group Policy's Software Installation feature. The first step in getting XP SP2 ready for autodeployment is to create a shared folder (appropriately named, for example, xpsp2) from which the computers can access the .msi file and two other SP2-related files. Give the Administrators group Full Control permissions on the folder and give the Domain Computers group Read access. Next, download xpsp2.exe from Microsoft (or find it on the XP SP2 CD-ROM) and run the executable with the /x switch to extract the service pack to the shared folder.

After the extraction is completed, you're ready to set up a Group Policy Object (GPO) that will install SP2 to all your XP computers. But how do you limit the GPO to XP computers and prevent it from trying to install SP2 on your Windows Server 2003 or Windows 2000 systems? You can't use a Windows Management Instrumentation (WMI) filter to limit the GPO's scope because Win2K computers don't recognize WMI filters attached to a GPO (and consequently apply the GPO as though no filter were present). You can use organizational units (OUs) to limit the GPO's scope, but to do so you need an OU that contains all your XP workstations and no other systems. If your OU structure doesn't permit that type of setup, you'll need to create an Active Directory (AD) group—called, for instance, XP Workstations—and make all your XP computers members of that group.

Create a new GPO at the domain root and give the GPO a name such as XP Workstation Computer Configuration. Open the GPO's Properties dialog box and select the Security tab. Delete the Everyone entry from the GPO's ACL and add an entry for the XP Workstations group, then grant that group Read and Apply Group Policy permissions. Now, even though the GPO is linked to the domain root, only computers that are members of XP Workstations will be able to apply the GPO and thus install SP2.

To configure the XP Workstation Computer Configuration GPO to install SP2, you need to edit the GPO. (If you need information about the process of editing GPOs, see "Resources.") In Group Policy Object Editor, right-click the Computer Configuration\Software Settings\Software Installation object and select New, Package from the context menu. In the Open dialog box that appears, enter the Universal Naming Convention (UNC) path to your shared installation folder in the File name text box, then append \i386\update\update.msi to that path and click Open. You'll be prompted to select a deployment method; select Assigned and click OK. The right-hand pane of Group Policy Object Editor will now display the Windows XP Service Pack 2 (1033) object, as Figure 1 shows.

Your XP systems won't install SP2 yet, however. XP's default startup behavior lets users log on even before full network access is available, and this behavior prevents Group Policy from automatically processing Software Installation policies that you add to a GPO. Microsoft documentation states that the installation will occur on each XP system the next time the system logs on to the network, but in my experience, Software Installation policies that you configure under a GPO's Computer Configuration node fail to execute unless you enable the Always wait for the network at computer startup and logon policy under the GPO's Computer Configuration\Administrative Templates\System\Logon object. You need to enable that policy for the GPO. After you do so, your XP systems will install SP2 the next time they reboot.

Note that users won't be able to log on until the SP2 installation completes, which can take 20 minutes. Therefore, I recommend that you alert users in advance of rolling out SP2. You might even want to encourage users to restart their computers before they leave for the day so that SP2 completes installation before they get to work the next morning. By the way, don't worry that users dialing in to your network or VPN will experience slow performance while Windows tries to download the SP2 installation files over a slow connection. By default, Windows automatically recognizes slow connections and postpones the application of certain areas of Group Policy—including Software Installation. You can use the policies under the GPO's Computer Configuration\Administrative Templates\System\Group Policy object to control this behavior.

...and Defend
After you've installed SP2 on all your XP computers and gotten to know the service pack's new Windows Firewall feature by working with it on a standalone test server (as I describe in "Windows Firewall: Building Security," July 2004, InstantDoc ID 42930), you can centrally manage the configuration of Windows Firewall on your XP SP2 systems. To do so, open the Microsoft Management Console (MMC) Group Policy snap-in on one of your XP SP2 systems so that you can edit the Group Policy settings under the XP Workstation Computer Configuration GPO's Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall object. (You'll need to have installed adminpak.msi on that system to edit the GPO; see the sidebar "Editing a GPO from a Windows XP System" for details.) If you don't see this folder when you first open the Group Policy console, don't worry—it simply means that the GPO hasn't yet been updated with the new Windows Firewall settings. Windows will automatically update the GPO and make the settings available when you begin to edit the GPO.

   Previous  [1]  2  3  Next