A. The current Windows Update site is ideal for home users because it automatically connects you to Microsoft's Web site, determines what updates you need, and downloads and installs the updates. For corporate users, however, this approach can be a nightmare for administrators, who would be unable to control what updates a user is applying and how much bandwidth the user is taking advantage of to download the updates.
Although you as the administrator can disable Windows Update, go to the Windows Update Web site, create a "basket" of updates, save the updates to a local machine, and distribute the updates to many other machines, you lose the ability to automatically install the updates, which is one of the main benefits of Windows Update. Fortunately, Microsoft has created SUS for corporate users.
SUS replaces the Windows Update Corporate Edition program and lets an administrator use a modified Windows Update interface to download fixes, test the fixes, and deploy them to a group of computers. The clients can then use a modified Windows Update client to automatically install the fixes. Microsoft has created a Macromedia Flash demo that explains the concept at Microsoft's Web site.
To use SUS, you need to download the server software and the client software (unless you use Windows XP Service Pack 1--SP1--or later or Win2K SP3 or later, which include SUS). You can download the software, along with white papers about deployment and a system overview, from Microsoft's Web site. The deployment white paper is comprehensive and describes an advanced configuration--I urge you to read it.
If you choose to use SUS, consider these caveats:
- You can't use a domain controller (DC) as a SUS server, but you can use a DC as a client.
- You can't use SUS to deploy service packs.
- You can't use SUS to deploy your own updates (you can use this tool to deploy only Windows critical updates, Windows critical security updates, and Windows security roll-ups).