5/12/2019 2:57 PM © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Server Patch Management at Microsoft 5/12/2019 2:57 PM Server Patch Management at Microsoft Sue Brazier IT Manager Microsoft Corporation © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Agenda Microsoft IT Environment Challenges Requirements 5/12/2019 2:57 PM Agenda Microsoft IT Environment Challenges Requirements Patch Management Process Patch Management Framework Lessons learned More information © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Microsoft IT Environment 5/12/2019 2:57 PM Microsoft IT Environment 101,000 e-mail server accounts Single Instance SAP (1.5Tb Db) 300,000+ PCs and devices Dublin Redmond Tukwila Silicon Valley Tokyo Charlotte Singapore 92,000 end users 89 countries Johannesburg 3M+ e-mail messages per day internally 99.99% availability 7,000,000 remote connections/month © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Microsoft IT’s Priorities 5/12/2019 2:57 PM Microsoft IT’s Priorities Being Microsoft’s first and best customer Enabling world-class and predictable customer, client, and partner experience Protecting Microsoft’s physical and digital assets Excelling in integrated operations and IT © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Vulnerability Management 5/12/2019 2:57 PM Vulnerability Management Product ship Vulnerability discovered Disclosed Update released deployed Automation of exploit Responsible Disclosure HIGH RISK LOW RISK © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Challenges Large, highly dynamic environment Security 5/12/2019 2:57 PM Challenges Large, highly dynamic environment Security 2,500 attacks, probes, and scans daily Over 125,000 virus-infected messages quarantined monthly Unique IT environments for product development, testing, support, and research require special security Technology-literate staff 95% with local administrator right to their desktop © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Requirements Automated security update and application deployment 5/12/2019 2:57 PM Requirements Automated security update and application deployment Enforcement within prescribed timeframes Minimized unplanned downtime Central reporting and administration Clear communication path More accurate and efficient patch management More updates, fewer administrators, less time Reduction in manual effort to deploy updates Automated tools, fewer scripts © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Server Patch Management Process: Team Roles 5/12/2019 2:57 PM Server Patch Management Process: Team Roles Microsoft Response Centre (MSRC) Releases security bulletins Corporate Security Assigns deployment priority Data Centre Operations Manages data centres Hosts SMS infrastructures Patches servers © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

SMS Environment Desktop Management Environment 115,000 clients worldwide 4 AD forests Server Management Environment 7,000 servers worldwide 3 AD forests 1 Central Site Server Windows Server 2003 SQL Server ™ 2000 SP3a 1 Central Site Server Windows Server 2003 SQL Server 2000 SP3a 22 Primary Site Servers Windows Server 2003 1 Network Load Balancing server (Puget Sound) 30 Dedicated Secondary Site Servers 100+ Shared Secondary Site Servers Windows Server 2003 10 Primary Site Servers Windows Server 2003 © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Patch Management Framework 5/12/2019 2:57 PM Patch Management Framework Identify New Patches Relevance Enforcement Assess Environment to Be Patched Baseline Assess Review 1. Assess 2. Identify 3. Evaluate and Plan Deploy the Patch Distribute Install Report 4. Deploy Evaluate and Plan Patch Deployment Testing Risk Assessment Schedule © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Server Patch Management Process: Phases 5/12/2019 2:57 PM Server Patch Management Process: Phases Phase 4: Deploying the patch 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Thursday Friday 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Standard Deployment Saturday 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Sunday 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Hour 1 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Thursday Hour 2 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Emergency Deployment Friday Hour 3 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Saturday Hour 4 12 A.M.– 4 A.M. 4 A.M.– 8 A.M. 8 A.M.– 1 P.M. 1 P.M.– 4 P.M. 4 P.M.– 8 P.M. 8 P.M.– 12 A.M. Sunday © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Lessons Learned and Best Practices 5/12/2019 2:57 PM Lessons Learned and Best Practices Establish a change advisory board To control planned downtime, use a change control database Target update distribution according to pre-determined maintenance periods Suspend monitoring during patching Aggressively monitor and manage SMS client © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Lessons Learned and Best Practices 5/12/2019 2:57 PM Lessons Learned and Best Practices Make status self-serve through a website Monitor bandwidth when sending updates between SMS sites Streamline the SMS 2003 installation by enabling only necessary features Test the impact of the update © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Lessons Learned and Best Practices 5/12/2019 2:57 PM Lessons Learned and Best Practices Baseline the environment Begin with accurate inventory Keep baseline simple and enforce rigidly Bring sub-baseline computers into compliance Carefully consider servers that exceed baseline Establish enforcement policy © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

5/12/2019 2:57 PM For More Information For additional information about how to deploy, operate, maintain, and support SMS, visit http://www.microsoft.com/smserver/ For details about MSM and MOF, visit http://www.microsoft.com/technet/itsolutions © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

5/12/2019 2:57 PM For More Information Additional content on Microsoft IT deployments and best practices can be found on http://www.microsoft.com Microsoft TechNet http://www.microsoft.com/technet/itshowcase Microsoft Case Study Resources http://www.microsoft.com/resources/casestudies E-mail IT Showcase showcase@microsoft.com © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

© 2003-2004 Microsoft Corporation. All rights reserved. 5/12/2019 2:57 PM © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.