You heard about it here and elsewhere, plus Microsoft should have been popping up in your system tray asking you to update. Did you do it? If not, now is the time to get on it. Some exploit code has been published, so this typically means that it will not be much longer before people with ill intentions integrate the code into some other type of malicious software.
Clearly this one was not quite as dire as we were led to believe, however it is a good exercise in emergency patch procedure. I recently wrote about having to delay the monthly patches a week due to some high profile visitors and a general sudden paranoia about the safety of patching. The same week I finally pushed patches with WSUS was the week this critical patch was released, so we quickly called for some downtime again with the servers and forced the patch out to all users.
I did some things a long time ago to make such an emergency patch more feasible. The first thing was to lower the interval that desktops check for the patch. Since they are checking with my WSUS server, this ads slightly more network activity, but does not slow down the WAN connection one bit. The default limit is 24 hours and I changed it to 8. This means that so long as I schedule a patch outside of 8 hours of a deadline I can hit every single computer that was turned on. The second thing was an auto-approve rule. I automatically approve every single patch that comes into my WSUS server for a computer group called Not Fully Approved, or NFA that has no computer as member. This forces the patch to immediately begin downloading so that it is immediately ready for distribution when I approve it.
Entries (RSS)