I keep SQL Server patched on the known servers and on my desktop (Dev Editition). But, as has been mentioned, it's entirely possible there are copies of Dev or Express on the network that I don't know about.
If you install the contact manager for Outlook, that installs a copy of MSDE/Express, and patches for it get included in the Microsoft Update service, if you run that.
Once had a whole building's LAN brought to its knees by a laptop that had a demo copy of a CRM called "Everest" on it, because it installed a copy of MSDE 2000, and it was never patched, and got Slammer. Same LAN had been crashed a few months earlier by someone accidentally getting the network cables mixed up on an IP phone. Fun times!
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon