Dell World Software User Forum 2013

Transcription

1 Dell World Software User Forum 2013 December 9-12 Austin, TX Advanced Patching Topics Making Patching Work for You Chris Grim

2 Advanced Patching Why do we Patch? Survey Says Security Reliability/Stability Not because I hate my users Microsoft sends it to me so it must be good Constant change in my environment keeps things interesting Installing and Uninstalling constantly makes windows more stable 2 Software

3 Advanced Patching Why do we Patch? Perfect World Software would have no bugs Bad guys would go away Users would be smarter No reboots Real World Your users are your customers Security takes a village There is no Easy Button 3 Software

4 Advanced Patching Ground Rules Discussion There is no one right answer Patching requires thinking You all collectively know more than I do 4 Software

5 Agenda Anatomy of Patching Feed Agent Configuration Best Practices / Tips Environment Planning Steady State Assessment Monitoring Progress Common Issues Forensics Working with Tech Support 5 Software

6 Survey How are you doing Operating System patching today? - KACE - Windows Update - WSUS - Imaging - Not 6 Software

7 Survey How are you doing 3 rd party application patching today? - KACE - Vendor Auto-update - Imaging - Managed Installations - Not 7 Software

8 Anatomy of Patching 8 Software

9 Breakdown of Patching How does patching work? Patch Feed Lists Signatures and Patches Sources Client Library Logs Downloads Evolution 5.3/ sp1 5.5 Lists mcescan.cab 60mb All OS Lists, all languages 100mb each Application lists Non-security list Signatures, Packages and Patches Signatures -.pls files detection definition Packages bulletins Patches individual executables exe or plp Sources Software

10 Breakdown of Patching How does patching work? Patch Feed Lists Signatures and Patches Sources Client Libraries Logs Downloads Evolution 5.3/ sp1 5.5 Libraries kpatch.exe pluginpatching.dll Logs kpatch.out pluginpatching.dll Downloads Patches 10 Software

11 Breakdown of Patching How does patching work? Patch Feed Lists Signatures and Patches Sources Client Library Logs Downloads Evolution 5.3/ sp /5.4 mcescan.cab 60mb All OS Lists, all languages 100mb each 5.4sp1 Vega 1 Operational (Non-security) Patches ospx files security, dependencies, applications, os files no mcescan.cab 5.5 Vega 2 WSUS parity Only subscribed lists and languages Only changes go to endpoints Compression of detect results back to server 11 Software

12 Breakdown of Patching Configuration Patch Settings Control Panel Signature Downloads Patch Download Options Patch Download Schedule Offline Update Options What happens when new things are downloaded Notifications - Parsing of the signature lists Replication Impact Updates to existing files 12 Software

13 Breakdown of Patching Configuration Subscriptions Operating Systems Languages Many patches are not language specific Subscription check boxes Things to think about Application Installers Disabled Patches Auto Activation Superceded 13 Software

14 Breakdown of Patching Patches Types Bulletins vs Files Operating System vs Applications Service Packs are in App Feed Subscription check boxes Activation vs Disabled Patch Detail Links/Summary Supercedes/Superceded Labels Files/Feed list 14 Software

15 Breakdown of Patching Subscriptions How - Detect and Deploy Who - Machine Selection Labels OS Filter What Detect set Deploy set When Schedules Server/Agent Time Suspension Window User Interaction Alerts Reboots Suspend 15 Software

16 Breakdown of Patching Grouping and Reporting Reporting Built in reports New options in 5.5/6.0 reporting wizard New options in 5.5/6.0 labels Interesting Tables PATCHLINK_MACHINE_STATUS KBSYS.PATCHLINK_PATCH KBSYS.KONDUCTOR_TASK 16 Software

17 Best Practices / Tips 17 Software

18 Survey What is your patch approval process? Automatically accept all patches Automatically accept critical patches Test critical patches Test all patches Do you have exceptions? 18 Software

19 Best Practices The Easy Button Automatically manage the computers to be patched Machine Smart Label Automatically manage the patches Patch Smart Label Automatically Run Patching Detect and Deploy Force Reboot Run on Next Connection when offline 19 Software

20 Survey Do you have a dictated patch SLA? What is your timeline? - ASAP - 7 days after patch Tuesday - 30 days after patch Tuesday - Longer Do you have exceptions? 20 Software

21 Best Practices Plan What is your SLA / patch goal? Timeline OS vs. 3rd party What is your change management policy? How do you want to handle out of band or updated patches What is your approval process? What is your environment central site, remote sites, laptops/mobile workforce, servers? What is your user tolerance for reboots? What is your power management policy? What does your image look like? How often is it refreshed? Do you have internal audit with a 3rd party scanner like WSUS, Nexpose or OVAL? How to prepare for that 21 Software

22 Best Practices Patch Approval Automation vs Manual Getting the right smart label hands off Using manual labels be sure what is going out Know your change mgmt profile and control downloads Exception Handling Machines that can t be patched Patches that can t be deployed Outliers that don t match smart label Minimizing Schedules Test Production 22 Software

23 Best Practices Patch Approval 4 Labels Subscription Exceptions Outliers Production = subscription (filtered) + outliers exceptions Variations on the theme Automation for end users, Manual for servers Current Month patches and all previous patches 23 Software

24 Best Practices Other Thoughts Replication Don t download only detected Maybe don t download every day Testing to Beta to Production Set a calendar around Patch Tuesday Wed is go time Aggressively Attacking machines that aren t patched Drop machines from the target label as they get patched Remember to detect again sometime 24 Software

25 Best Practices Environmental Challenges Imaging Process Reboot Tolerance/Mandate Laptops/Mobile Workers Power Management Remote Sites Internal/External Audit 25 Software

26 Best Practices Application Feeds Some Microsoft patches are in the Application Feed OS Service Packs Recommend Manual Approval of Application Patches Installers vs Patches! Installers detect as missing Application Feed is Big Most application patches are actually full installers Application Feed has many versions of each app Application compatibility Know if your apps have Flash/PDF/.NET/Java dependencies New versions can break mission critical apps TEST, BETA, DEPLOY 26 Software

27 Assessment 27 Software

28 Assessment Phases and what they mean Scheduled Waiting to Connect Not Scheduled Detecting Deploying Downloading Reboot Pending Completed Suspended Error (Patch Download Failed) Error (Log Upload Failed) 28 Software

29 Assessment Monitoring Progress Patch List View by deployment label Sort by Not patched to find the biggest problems Patch Schedule to see task completion rate Identifies machines that are offline, not finishing, etc Patch Detail Identifies success of specific patch Fail/Not Patch/Patch/All Common Errors Machine Detail Status Errors - When 29 Software

30 Assessment Monitoring Progress Reporting Useful Reports that aren t in the box Excel Dashboard Example 30 Software

31 Troubleshooting Common Error Codes and what they mean Feed Issues Patch Download Log Errors that are likely environmental 20 File Extraction 99 download error 102 pending reboot Error Codes that might need a trouble ticket 80 Error in Patch Deploy Script 98 Detect or Deploy Data Caused Crash 31 Software

32 Working with Support How to get issues Resolved Quickly Agent with debugging enabled Put the problem set of patches in a label Create a test schedule targeting one or more problem machines Detect and deploy them with debugging enabled After it is done, run capture state to get all logs plus Event Logs Execute the patch manually last to get true error message MBSA 2.2 and Windows update screenshot and if the patch is installed (When applicable to the issue) 32 Software

33 Questions 33 Software

34 Resources 34 Software

35 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 35 Software

36 Select to retype header Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 36 Software

37 Select to type in a 2-line header that would look something like this Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 37 Software

38 Select to type in a 2-line header that would look something like this Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 38 Software

39 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 39 Software

40 Select to retype header Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 40 Software

41 Select to retype header Subject here Lorem ipsum dolor sit amet, consectetur adipiscing elit (Max. 3-lines of copy) Subject here Lorem ipsum dolor sit amet, consectetur adipiscing elit (Max. 3-lines of copy) Subject here Lorem ipsum dolor sit amet, consectetur adipiscing elit (Max. 3-lines of copy) 41 Software

45 Select to retype header Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 45 Software

46 Select to type in a 2-line header that would look something like this Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 46 Software

47 Select to type in a 2-line header that would look something like this Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 47 Software

48 Select to retype header Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 48 Software

49 Select to retype header Select to retype subhead (don t change color of subhead or bullets) Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 49 Software

50 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets X X X X 50 Software

51 Select to retype header Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets Sales 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 51 Software

52 Select to retype header Select to retype paragraph (Use stock photo from DAM for photo on the right) Select to retype bullets 2nd level bullets 3rd level bullets 52 Software

53 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) 53 Software

54 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets X X X X Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 54 Software

55 Select to retype header Sales Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 55 Software

57 Select to retype header Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) 57 Software

58 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets X X X X 58 Software

59 Select to retype header Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets Sales 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 59 Software

61 Select to retype header Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) 61 Software

62 Select to retype header X X X X Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets 62 Software

63 Select to retype header Sales Select to retype paragraph Select to retype bullets 2nd level bullets 3rd level bullets 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr 63 Software

65 Select to retype header Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Select to retype paragraph Select to retype bullets 2 nd level bullets 3 rd level bullets Lorem ipsum dolor sit amet (Max. 2-lines of copy) Subject here Lorem ipsum dolor sit amet (Max. 2-lines of copy) 65 Software

66 Divider title here 66 Software

70

71

72

73