Software

Ask something
Discussion Locked

Patch Management

0 helpful
40 replies

by lachlann562

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have just recently started on a project for implementing a patch management solution. So far these are the products i've learned about:
Microsoft WSUS (Upgraded SUS - not yet released)
Micrsosoft SMS
Shavlik's HFNetCheckPro

I am with a company of about 300 employees, and 200 servers (DMZ's, extranet, intranet).

Any help would be appreciated.

40 replies

by cg it

There a long list of companies that have patch management software. Quest software has one thats pretty all encompassing BUT with a hefty price.

Windows Update Service is what we are playing around with right now. We nabbed a beta copy and its pretty good. Runs just like the Windows update except its on our servers. Software Update Service requires a LOT of admin effort. A LOT. you have to baseline ALL computers and track whats on what, when and when. Then approve ipdates for deployment, then deploy them. Lot a work.

Systems Management Server is a lot like Software Update Service but has way way more capabilities than just getting patches and services packs rolled out. Its pricey to and unless your running hundreds of workstations all over hell and back, just isn't worth it.

by lachlann562

How do you find the reboot control, we have approximately 107 servers in production and 110 servers in offices (and approximately 150 test servers). They main concern is the production servers, how much control do you have on whether or not it restarts?

by cg it

Microsoft has a Security update notification service which we subcribe to. We can read about the patches, hotfixes etc and whether it requires a reboot. If it does, we then schedule when we do a cluster. We don't automatically push updates out or let servers automatically pull updates. We do workstation but not servers.

Heck most of our time was devoted to reading all the crap that comes out [which everyone bitched at Microsoft because we couldn't keep up with the daily notifications. So they went to a monthly deal].

Now we know when an update is coming out and can schedule the server nodes that need reboots. It's still a big admin chore but it was a HUGE admin chore before.

by jason.meissner

300 employees and 200 servers?
My first point of managing this environment would be to ask why the hell you have 200 servers in the first place?
For a company of your size it is quite ridculous that you have this many servers, even if they are a software development shop.
x2 Decent servers to manage Data.
x2 Decent servers to manage print
x4 Development servers to handle application and web - use a product such as vmware's Vmotion to create images and rollout new servers in 10 minutes, but all on the same hardware.
x1 Exchange
X2 DC's
x1 DMZ ISA
x1 DMZ web presence
X1 Intranet ISA
etc, etc
Look at consolidating your server hardware first. This will reduce the amount of servers you have to manage and reduce the amount of servers to patch.
Then look at a product that will scan your servers for vulnerabilities (WUS cannot)and have the ability to push approved patches out to those servers.
My two cents.
Jason

by rcharles

I have tested the WSUS and yes this requires a lot of work. But the Other products I have tested Are Ecora Patch Management Solution and it is really easly to setup and use. The reporting in this product is much better than any on the market.

Another one you miight want to consider is LanDesk. This provides reporting and Software distribution capabilities.

by lachlann562

I was just reading over the website and I had a couple concerns that you might have encountered.

It is helpful that it supports multiple OSes as we have mixed environment.

All operating systems should be the default installation, do not load additional software prior to PATCHLINK UPDATE. Windows 2000 and Windows 2003 must be updated with the latest service packs.

Does this mean we would have to reinstall windows on each server? If so this is unnaceptable.

Important: You must NOT have SQL Server or MSDE installed on the target system for PATCHLINK UPDATE Server.

Do you know if they are referring to haveing it installed on an SQL server or is it unable to patch an SQL server?

by atxstranger

We are currently working on testing a PatchLink installation on our site and hopefully I can help. The items you are talking about are on the server that will be running the PatchLink software. During my talks with our software provider, their recommendation was to run PatchLink on a standalone box with no other software loaded, especially SQL Server or MSDE. The way I understand it, Patchlink should be able to patch an SQL server but shouldn't be loaded on a machine running SQL server.

For our rollout we are going to buy a seperate workstation to run Patchlink. That seems to be the most effective and safest way to do ti.

by bfilmfan

That is correct. The PatchLink server should be a plain-vanilla installation.

PatchLink can indeed patch SQL boxes, as I used it to patch my MOM 2005 servers just the other evening.

by etwell.karikoga

I have implemented SUS and GFI LANguard Network Security Scanner which has proved to be quite effecient in dealing with patch management. SUS is able to provide OS patch management while GFI give you flexibility to install both OS and application patches.

Hope this will help.

by chad.gniffke

My current Patch Managment guy ran Altiris for about a year. When he started at our company I introduced him to Kaseya.com and he loves it. Patch management is just the tip of the iceberg on this one baby!

by stefanidis

My friend, i was in the same situation as you - except that i had installed SUS and tried to stay sane!... It kept upddating itself from Microsoft Update, the Group policy was OK, but... it worked only for a few days (updating the clients) and then miraculously stopped updating!
I tore it apart completely and installed WSUS (which just came out) and it is juuuuust great so far! works with extranet and intranet, different subnets, over VPN, the works! It also automatically downloads patches and packs for SQL server, Exchange and Office! i love it.
Of course, SMS 2003 is definitely stronger and you can have much more control. However, my philosophy is to always try to keep it simpler, and go to something larger only if the smaller doesn't do the job. WSUS really works fine, i have no complaints at all, and this come from a guy who was about to smash the SUS server machine with a sledgehammer!
Enjoy...! :-)
Hope i helped.

Regards,
Spiro Stefanidis
IT Supervisor
Ergo Textile S.A.
Thessaloniki, Greece

by gjones

If you want a more robust solution and don't mind paying some cash in both software licensing and some heafty hardware (depending on how spread out your sites are) and training, then SMS 2003 (SMS 2.0 was a nightmare) is the way to go. SUS/WSUS is a free, much more simple solution which also allows you to tell your clients to go to Microsoft's Update servers for 'Approved' updates. Good luck!

by mdisbury

Lachlan,
You have to look at ZenWorks form Novell. It's just brilliant. It does patch management, application delivery, hardware & software inventory and remote control or workstations.
It will run on Microsoft, Netware and Linux.
It's really cheap and just works.
BTW, why has each 1 1/2 employees got a server each :-)

Regards

Mike

by anandu

We use SMS in our environment for Patch Management and it works really good. If you are only looking for Patch Management, you should look for single product that only provides Patch Management solution, because SMS provides everything from Asset Management to Software distribution. Single product may save you some money. Compare it with full SMS.

by sdattoli

However, in larger companies where vulnerabilities etc. create much more work in patching everything else that is not MS.

Once again using the Adobe example from their site, here is a clear example of the limitations of WSUS being an MS-only solution: Here is a pull from a forum on the latest Adobe vulnerabilities.

Adobe Systems on Wednesday rolled out patches for security vulnerabilities found in Adobe Reader 7.0 and 7.0.1, and in Adobe Acrobat 7.0 and 7.0.1.

The hole in the products, referred to as an XML External Entity vulnerability, under certain circumstances allows XML scripts to be used to discover a user's local files.

According to Adobe officials, the vulnerability is within the Adobe Reader control. If an XML script is embedded in JavaScript, it is possible to discover the existence of local files, according to a security advisory from the company. An attacker could then maliciously use the gathered information. But the statement pointed out that the local files can be found only if the attacker knows the complete file names and paths in advance of such an attack.

Programs like Shavlik's newest release in 3 weeks and a couple of the others mentioned do address these issues. WSUS is "free", but it does have a cost. That cost depends on how much work is spent manually dealing with all the other patches from all the other programs out there (mainly the popular one's like Adobe) that WSUS does not address.

by sdattoli

First, this is in addition to some of the other considerations/features already mentioned. Second, this is not a sales pitch -- I work only with F1000 companies. Third, I am somewhat biased in that we are a partner of Shavlik. However, we are also a partner of Microsoft and have designed solutions to complement SMS etc. We chose Shavlik because they were simply the best "Microsoft" patching solution.

Now, that brings me to the all important piece I have heard no one mention yet (I may have missed it -- sorry to anyone if I did). Most likely, you are going to want a patching solution that will address patching for some of the other ubiquitous programs like Adobe right? With WSUS you would be SOL.

Shavlik new release covers things like Adobe and Firefox (HFNetChkPro 5.1 --- GA in about 3 weeks).

Here is a clear example of the limitations of WSUS being an MS-only solution: Here is a pull from a forum on the latest Adobe vulnerabilities.

Adobe Systems on Wednesday rolled out patches for security vulnerabilities found in Adobe Reader 7.0 and 7.0.1, and in Adobe Acrobat 7.0 and 7.0.1.

The hole in the products, referred to as an XML External Entity vulnerability, under certain circumstances allows XML scripts to be used to discover a user's local files.

According to Adobe officials, the vulnerability is within the Adobe Reader control. If an XML script is embedded in JavaScript, it is possible to discover the existence of local files, according to a security advisory from the company. An attacker could then maliciously use the gathered information. But the statement pointed out that the local files can be found only if the attacker knows the complete file names and paths in advance of such an attack.

The vulnerability impacts Acrobat and Reader running on Windows and Mac platforms.

Adobe recommends that Reader and Acrobat for Windows customers download the updates provided on the Adobe Web site here.

To clarify - PA+ *will* cover things like Adobe Reader and Firefox, as soon as Shavlik the next release HFNetChkPro 5.1 in 3 weeks My understanding is that this product also addresses/runs on Linux according to their website

The product is also very easy and much less money than most of the other Enterprise Patching Solutions. Yet, It is the TCO that really makes the difference. While WSUS may seem like the least expensive product, consider the amount of time you will still be spending addressing patching & security issues from Adobe and all the other non-MS products that your 300 or so desktops will need. Hope this helps

by cneustadt

We use a suite of products form Altiris for software deployment, imaging, inventory, remote control and local hard drive back up. Included in the latest versio is a good patch management product. Further, Altiris' roadmap is to utilize the patch management solution for Oracle,and other application and OS besides Microsoft. We get a lot of bang for our buck out this product

by sscarbrough

Cisco bought Perfigo last year. Consider their "Clean Access" product. It does wired as well as wireless authentication, nessus, and policy based patch management. You decide the policy, you load the patches on the management server, clients must pass muster to gain access to the LAN, be they wired or wireless.

by nickc

Take a look at ScriptLogic's Patch Authority Plus - it does the patch and also manages services.

by wayne b

Don't know if anyone else has mentioned this but Microsoft's WSUS is available now and it works very well. Best of all, it won't cost you anything but some space on a server. I would recommend using SQL for the number of servers that you have.

by trevor.odell

Look at BigFix - www.bigfix.com
It is a cross platform patch solution with asset management capability. We use it to pacth our global enterprise ( 3,000 servers, 20,000 + desktops ). It uses a distributed architecture and is WAN aware, so you are not sending a patch to every device at the end of a WAN link, but to just the one you designate as a "relay". The relay will then distribute locally to the other devices - i.e. very small network footprint.

by glason

UE is good, and it is especially useful when managing patch installation and reporting for DMZ boxes where traffic is normally restricted.

by grpaki

We've been using UpdateExpert (http://www.stbernard.com) for years, and it seems to be pretty reliable. Recent versions cover a collection of software in addition to the operating system. We only use it for servers though - workstations are handled by Novell Xenworks which is superb for that purpose.

by drnz_54

Best Desktop Mgmt tool around...ok for Server Mgmt unless u have Proliants. Best VAR of this product: NetworkD

by leonard j rivera sr.

I have been using HFNetCheckPro v4 for a while. It has been less than perfect and very troublesome for a mixed environment (windows 2000, Windows XP and mixes of Office). I have upgraded to v5 and am curretly teesting, looks very promising, especially in mixed environments.

Never used SMS but hear it is garbage from friends.

We tried SUS (Older version of WSUS) and it was difficult without any reporting features, currently test the new WSUS and it too looks very promising. It handles shutdowns well.

No matter what you choose, keep this in mind. You will want a central server at each remote location that you can terminal service into and run the scans/deployments locally. It is a good practice to have seperate computer groups, especially if you are going to push to servers (which I don't recommend).

If you must push to servers, push to non-critcal servers as most other require certain services to be stopped and you may want to backup certain data prior to the push.

That's my 2 cents. Me and mine are curretly in the same patch management boat but has focused on 2 products, WSUS (in beta even for us) and HFNetcheckPro (Problematic in the past, new version may be our answer). A little bit of good luck and much research... Have fun!

by zaferus

We've just attained TI-Deploy and are testing it on our network. It takes a broader stance and will let us roll out/back any patch (MS or otherwise) as well as deploy any software package or files. It looks good on the surface, but we've just started mucking around with it.

by mdisbury

Lachlann,
Maybe you should consider ZenWorks, ZEN=Zero Effort Networking. Forget the Novell sticker, it's absolutely brilliant, the latest version runs on just about any platform, including Windows and Linux. It latest version has an excellent patch management deployment agent, and not just for Windows, but for any applications.
BTW, why has your company got 200 servers for only 300 employees?

by elpresidento

Well guys, just have a quick look at the Heimdal Security Agent, which has just been launched in Denmark by CSIS.

This security tool constantly keeps a selection of actively exploited software patched (the patch is provided by the vendor itself). The entire patching process is silent and unattended. So you just have to press the SCAN button and the patching process is done automatically.

Currently we are monitoring the following list of software which is known for their popularity and as well as being the most vulnerable too according to NVD (National Vulnerability Database):

1. Windows Media Player
2. Internet Explorer
3. MDAC
4. Mozilla Firefox
5. Adobe Reader
6. Adobe Flash player (mozilla plugin)
7. Adobe Flash plugin (ActiveX IE plugin)
8. Adobe Shockwave Player
9. Apple Quicktime
10. Oracle JRE (Java Runtime Environment)
11. Winzip
12. Skype
13. Opera browser

I bet you should have at least 5 of the above software installed on your home PC, with them remained in vulnerable state because you did not find time to download the latest version or is too lazy to download the patch or does not care at all ;=)

In fact, many users ignore the existence of exploits on these programs and are hence left vulnerable to attacks by hackers when they do online banking or other online transactions. Heimdal Agent helps to mitigate this vulnerability risk.

Another feature provided by Heimdal Agent is that you will have the possibility to remove information stealers (i.e. malwares from your machine).
If you want to install this security software, with me as referrer, well it is simple ...

Steps to follow:
--> Go to: https://webbank.csis.dk
--> username: amu@csis.dk
--> pass: amu
--> Download the Heimdal Agent
--> Install the software
--> Send your feedback to me (help -- send feedback)

Demo of the software: http://www.youtube.com/watch?v=ON0v7cLG4QQ

Another option is to download the software from our website itself: https://www.csis.dk/en/private/heimdal

Good news: we are going to monitor Google Chrome, Adobe Air, Real Player, ITune, Safari, Windows live messenger, Other Microsoft products and many more soon..

please see release note : https://support.csis.dk/en/heimdal/releasenotes
cheers

This discussion is closed to new replies.