The excepted text below was taken from Chapter 8 of Creating the Secured Managed Desktop: Using Group Policy, SoftGrid, Microsoft Deployment Toolkit, and Other Management Tools, written by Jeremy Moskowitz and contributed to by Greg Shields. Get your copy on Amazon here, or from Jeremy's web site here.

...in this post we continue the topic of Microsoft patch management with a discussion on the Windows Update Agent and how it goes far into unifying Microsoft's previously separate tools for managing updates...

What is especially brilliant is the use of the Windows Update Agent by all these server-side tools. The Windows Update Agent is a small piece of client code installed to each managed computer, whether that computer is on, say, Windows XP or Windows Vista Desktop, an instance of Windows Server 2003, or Windows Server 2008. That code handles the interrogation of the machine to identify which patches are installed and which are yet needed. It also handles the installation of software as requested by any of these tools just listed.

There's a huge benefit to unifying the technology under a single client tool. As an example, consider how installations were done (and in some cases still are done) before the industry came to embrace Windows Installer: apps in many cases needed to build their own installation routines. The command line switches needed to install one piece of software were often very different than the ones used to install another. Unifying software installation under a single client tool now means that software installations are more predictable and easy to use. The same holds true for patch management. Whereas Windows Installer eased the software installation process, the Windows Update Agent eases the process of managing patches.

Better yet, you can start out with a free tool, like WSUS, and then later move up the pay-scale to SCE and SCCM with ease. That's because each of those products relies on the same underlying, already-installed client tools. As an example, if your environment has long used Microsoft Update as the tool for patching machines and you later want to implement WSUS, it's likely that you already have the necessary client pieces installed on your machines.

In tomorrow's post we'll talk about the two different ways that you can, with a WSUS infrastructure, target your clients for update distribution...