Deploying Windows Updates using WSUS and MBSA (Windows-based HP Thin Clients)

ManualsBrandsHP ManualsComputersF5A54AA

Technical white paper

Deploying Windows Updates

using WSUS and MBSA

Windows-based HP Thin Clients

Table of contents

Overview ................................................................................................................................................................................. 2

Requirements for applying Windows security patches .................................................................................................... 2

Additional precautions .......................................................................................................................................................... 2

Windows Server Update Services ........................................................................................................................................ 2

Enabling WSUS for Windows 10 IoT Enterprise ............................................................................................................ 3

Preparing the thin client ............................................................................................................................................... 3

Applying updates through the servicing mode ......................................................................................................... 3

Creating a servicing task ............................................................................................................................................... 4

Enabling WSUS for Windows Embedded Standard 7 ................................................................................................... 5

Preparing the thin client ............................................................................................................................................... 5

Scheduling updates in Task Scheduler ....................................................................................................................... 6

Disabling Windows Update .......................................................................................................................................... 7

Re-enabling the write filter .......................................................................................................................................... 7

Microsoft Baseline Security Analyzer ................................................................................................................................. 7

Preparing the thin client ................................................................................................................................................... 7

Applying Windows updates.............................................................................................................................................. 7

For more information ........................................................................................................................................................ 10

Summary of content (10 pages)

PAGE 1
Technical white paper Deploying Windows Updates using WSUS and MBSA Windows-based HP Thin Clients Table of contents Overview .................................................................................................................................................................................2 Requirements for applying Windows security patches ....................................................................................................2 Additional precautions ..............................
PAGE 2
Overview This white paper describes the requirements and strategy recommended by HP for using Windows Server Update Services (WSUS) and Microsoft Baseline Security Analyzer (MBSA) to deploy Windows updates to HP thin clients that are based on Windows Embedded Standard 7 or Windows 10 IoT Enterprise. Note Windows Embedded Standard 7 includes Windows Embedded Standard 7E and Windows Embedded Standard 7P.
PAGE 3
Enabling WSUS for Windows 10 IoT Enterprise Note WSUS version 4.0 or later is required for Windows 10 IoT Enterprise support. Preparing the thin client 1. Log on to the thin client as Administrator. 2. Select Start > All Apps > Windows System. 3. Right-click Command Prompt and select Run as administrator. 4. Disable the UWF and restart the system by entering the following commands: uwfmgr filter disable shutdown -r -t 0 5. After the system restarts, log on as Administrator. 6.
PAGE 4
After you restart the thin client, it automatically logs on to the servicing account and servicing starts. After servicing starts, no user interaction is required. The system might restart, if it is required by the Windows updates that are being installed. If a restart is required, the system re-enters servicing mode after the restart and continues until all updates have been installed. During servicing, the UwfServicingScr.scr screensaver is displayed on the device.
PAGE 5
14. Enable UWF and restart the system by entering the following commands: uwfmgr filter enable shutdown -r -t 0 Enabling WSUS for Windows Embedded Standard 7 To enable automatic updates through WSUS on an HP thin client running Windows Embedded Standard 7, use the following procedure. Note Due to the limitations in the behavior of the EWF related to the protection of individual directories on a given volume, these instructions assume that the FBWF is in use. Preparing the thin client 1.
PAGE 6
B. Replace this string in each file with the following, where Name is the name of any other user in the Administrators group: Name Scheduling updates in Task Scheduler Next, two tasks must be added to Task Scheduler. These tasks are defined in WindowsUpdateWithWriteFilter-Startup.xml and WindowsUpdateWithWriteFilter-Scheduled.xml. WindowsUpdateWithWriteFilter-Scheduled.xml This task checks for available Windows updates at a scheduled time.
PAGE 7
6. Change the working directory to the unprotected directory that you created earlier (C:\WSUS). Note Do not change the other settings. 7. Select OK. Note Do not change the trigger settings. 8. In the Create Task dialog box, select OK. 9. If prompted, provide the Administrator account credentials. Disabling Windows Update When you are using the WUS-WF solution for updates (instead of using the Windows Update program), you must configure Windows Update to never search for updates as follows: 1.
PAGE 8
2. Select the Check for security updates option, and then start the scan. 3. After the scan is complete, select Result details under the Windows Security Updates issue category.
PAGE 9
4. Notice the updates listed as Critical. 5. Verify that there is enough flash memory on the thin client by determining the total size of all critical updates. 6. Download all critical updates to a USB flash drive or network drive. 7. Access these updates from the thin client and follow the instructions to install them. 8. Repeat steps 3 through 7, but for the Developer Tools, Runtimes, and Redistributables issue category. 9.
PAGE 10
For more information For information about how to deploy and configure a WSUS server within your environment, go to https://technet.microsoft.com/en-us/library/hh852340(v=ws.11).aspx. For information about UWF servicing mode, including how to add third-party updates into your servicing process, go to https://msdn.microsoft.com/en-us/library/jj962927(v=winembedded.81).aspx.