Server requirements and recommendations for installing Microsoft Software Update Services (322365)

MORE INFORMATION

Recommended system requirements

A computer that has the following system requirements can support up to 15,000 clients:

• A Pentium III 700-MHz CPU (or equivalent).
• 512 MB of RAM.
• A network adapter.
• An NTFS file system partition with at least 100 MB of available free space for installing SUS SP1, and a minimum of 6 GB of available storage on an NTFS partition for the updates (if the administrator decides to host the updates locally).
• Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, or Microsoft Windows 2000 Datacenter Server with Service Pack 2 (SP2) or later.
• Microsoft Internet Explorer 5.5 or later.
• Microsoft Internet Information Services (IIS). Only the World Wide Web part of IIS and any components that it is dependent on are required. You can install Microsoft FrontPage Server Extensions, but this is not required.

Note With SUS SP1, you can install SUS on a domain controller.

Things to consider before you install SUS

This section describes recommendations for installing SUS. The server that will host SUS must have the recommended security configuration and it must be free of viruses. Also, Microsoft recommends that the IIS server host only SUS. Although this is not a required, it is a good idea because installing SUS locks down your IIS server by installing URLScan. The WebDAV, Internet Printing, and Indexing service features of IIS are turned off. Also, the session state is disabled by SUS. When the session state is disabled, ASP cannot create a session for each user who accesses an ASP program, and ASP scripts cannot store information in the Session object or use the Session_OnStart or Session_OnEnd events.

Important If the IIS server hosts Microsoft SharePoint Portal Server 2001 (SPS), installing SUS causes an inability to connect to SPS dashboard sites.

Windows 2000 server recommendations

To install SUS on a new or "clean" Windows 2000 Server installation, the administrator must follow these steps:

1. Physically disconnect the server from all network connections.
2. Install Windows 2000 Server.
3. Turn off all antivirus software to make sure that the antivirus software does not mistake the SUS installation as virus activity.
4. Install the latest service pack, security rollup package, and any security-related patches.
5. Install the Microsoft Security Tool Kit. To install the Security Tool Kit, visit the following Microsoft Web site:

   http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/stkintro.mspx

   Note Step 5 is optional because SUS installs the Security Tool Kit during its installation process. Additional server configuration may be required before clients can download updates. Steps 1 through 5 help to make sure that the server is at a base level of security and that the computer is free of viruses before you install SUS.

Existing server recommendations

To install SUS on an existing server, the administrator must follow these steps:

1. Make sure that the server is running the latest service pack, security rollup package, and security-related patches, and that the computer is virus-free.
2. Create an Emergency Repair Disk (ERD) that includes the registry information, or create a System State backup, or create both. An ERD is best for Windows 2000-based servers. If you cannot start the computer (even in Safe mode), the registry part of the ERD is saved to the local hard disk and is accessible from the Recovery Console.
3. Turn off all antivirus software to make sure that the antivirus software does not mistake the SUS installation as virus activity.
4. If IIS is not installed, physically disconnect the server from the network before you install IIS. After you install IIS, install any IIS security patches, and then run the IIS Lockdown tool before you connect the server to the network again.
   
   Note Steps 1 through 4 help to make sure that the server is at a base level of security and that the computer is free of viruses before you install SUS.

Troubleshooting Microsoft Software Update Services installation

The Setup program may not finish for any one of the following reasons:

• You have not logged on as an administrator
• SUS (SP1) is being deployed through Group Policy as a user setting.
• IIS is not detected on the computer.
• Internet Explorer 5.5 or later is not detected on the computer.
• An NTFS partition is not detected on the computer.
• Windows 2000 Service Pack 2 or later is not detected on the computer.
• You try to install SUS on a non-NTFS drive.

If your computer meets all the requirements but you still cannot install SUS, try the following methods to resolve the issue:

• Turn off all services that are not required.
• Turn off all antivirus software.
• Look in Event Viewer for error messages that may describe the problem and suggest steps to resolve them.

If you still cannot install SUS, try upgrading to Microsoft Windows Installer version 2.0. You can also turn on Windows Installer logging by following the instructions that are described in the following Microsoft Knowledge Base article: You can then use the Windows Installer log to look for errors during the installation process.