Is my duty to ensure that it is patched and not vulnerable to exploits that might compromise not only that particular workstation but also the whole environment. However, if a user managed to somehow install Silverlight on a computer, it I might consider that a Windows XP computer should never need Silverlight patches, simply because I, as the system administrator, have never deployed Silverlight to any computers.

With Microsoft adding more and more categories, to create a deployment that's based on what our assumption of what categories a computer should belong to is completely foolish. i.e., no more categories will be added/removed/changed. Even if this was correct (which it obviously is not) it would still assume that those categories are written on stone and will never change. NET patches, Windows Defender patches, SQL patches, WSUS patches, Silverlight, Skydrive, Malicious Software It assumes all patches will fall into one of the categories above (what about IE patches.

The proposal above of separating patches into Office, XP and 2003 assumes quite a few things which are not correct: There's a limitation of 500 patches per deployment. There are a few things that need to be taken into account (which are more real in 2013 than they were back in 2009): John Marcum, Systems Management Architect - I know I shouldn't revive such an old thread, but it is the first thread that appears in Google when looking for SCCM patch deployment best practices and I believe this answer is very misleading. Server 2003 2003 Updates - 8:26:51 AM Deployment Packages: Server Patches Update Management: (these I remove and add new each month so I can set a new deadline and available time) If you target SMS 2003 clients, you should should be careful and make sure they run the installation from the DP. SCCM 2007 clients only download the updates they really need (called 'Selective Download'). Different behavior (notification/schedule/reboot/.).īecause I usually don't want an automatic reboot on my clients or my servers and both should be compliant within the same time frame, I only create a new deployment management if new updates need to be deployed.Īs long as all your target machines have an SCCM 2007 client, there is absolutely no reason to create several deployment packages (although Microsoft advises not to include more than 500 updates/package). The only criteria I use to create seperate deployments are: In addition, I would even use the same deployment management for various products. I would rather use 1 package per month, per quarter or even per year and create Search Folders to filter out only those you want to deploy. Apart from extra operational overhead, what added value does it bring? I don't see a benefit in having a package per product.

Sccm patch deployment best practices