Providing Patch Management with N-central. Version 9.1

Transcription

1 Providing Patch Management with N-central Version 9.1

2 Contents Patch Management 4 Introduction 4 Monitoring for Missing Patches 4 Setting up Patch Management in N-central 5 Adding a WSUS Server to N-central 8 What Versions of WSUS Are Supported? 8 How N-central Monitors Your WSUS Servers 10 Enabling or Disabling WSUS Servers 10 Changing which Customers can Use a WSUS Server 11 Configuring WSUS Server's Patch and Language Options 12 Maintaining your WSUS Servers 14 Patch Profiles 16 Adding Patch Profiles 16 Patch Profile Settings 17 Editing Patch Profiles 21 Viewing the Folders and Devices Associated to a Patch Profile 21 Deleting Patch Profiles 22 Configuring Devices for Patch Management 22 Approving and Declining Patches 24 Automatically Approving Patches 29 Viewing Installed Patches 34 Patch Management Reporting

3 Patch Status Report 36 Patch Inventory Report 36 Missing Patches Report 36 WSUS Status Report 36 Appendix: Patch Installation and Approval Status

4 Patch Management Introduction In today's security-conscious environment, providing patch monitoring and management services is critical for anyone delivering managed IT services. The challenge is that while delivering patch management services has the potential to be both complex and expensive, your customers will not want to pay extra for it and will simply expect it to be a part of your service offering. With these issues in mind, N-able Technologies provides an integrated patch management feature with N-central 9.1, powered by Microsoft WSUS 3.0. N-central takes a unique approach to providing patch management by dividing patch monitoring and patch management into two separate functions. Patch Monitoring, which provides the ability to see which software patches are missing on devices, can be done on both Essential and Professional devices, while Patch Management (the approval and declining of specific patches) can only be done on Professional devices. This distinction provides added flexibility that allows IT service providers to better tailor their service offerings to the needs of their clients. Who Should Read This Guide? This document is designed for N-central administrators. It is highly recommended that anyone who is using the Patch Management features in versions prior to N-central 9.1 read this guide before upgrading. This guide is current as of October 18, Monitoring for Missing Patches When an N-central 9.1 Windows Agent is installed on a device, the Patch Status service is automatically added to that device. The Patch Status service queries the Windows Update Agent (WUA) on the device to determine the patches that are missing. WUA is local to the device that is being monitored and so the Patch Status service will report patch data even if the device is not configured to report to a WSUS server. The Patch Status service returns key information including: the total number of missing patches the number of patches installed with errors missing patches by category (Security Updates, Critical Updates, Service Packs, Update Rollups, Feature Packs, Updates, and Software Driver Updates) missing patches (of specific categories) older than a user-specified number of days

5 Setting up Patch Management in N-central N-central provides a very flexible, powerful, integrated patch distribution and management solution. The solution is based on Microsoft WSUS but all configuration and management of WSUS is managed using the N-central interface. Beyond installing WSUS, there is virtually no interaction required with the WSUS user interface. There are three phases to setting up patch management in N-central: Configuring your WSUS servers Creating Patch Profiles Approving and Declining Patches Before reviewing how to configure your WSUS servers, we should first examine where you might want to install them. Common WSUS Deployment Scenarios N-central 9.1 provides a great deal of flexibility in how you deploy your WSUS servers. You can make WSUS servers available to just one customer, all customers within a Service Organization, or across all Service Organizations in your N-central server. Those WSUS servers can be either on-site (within - 5 -

6 your customer's network) or can be publicly accessible on the internet. Through patch profiles, N-central also gives you the ability to use a mix of on-site and publicly-accessible WSUS servers giving you the flexibility to offer patch management to devices that are on the road (like a Salesperson's laptop) and in the office. The main advantage to using on-site WSUS servers is that they can store patches locally and distribute them to servers and workstations on the local network. This optimizes the Internet bandwidth that is used because the patches are only downloaded from the internet once. The disadvantage of on-site WSUS servers is that they can only be used for devices on the same network as soon as a device leaves the network, it no can no longer be managed by that WSUS server. The main advantage of a publicly accessible WSUS server is that it can be used by any device that has internet access. The disadvantage of a publicly accessible WSUS server is that each patch must be downloaded separately by each device making bandwidth consumption an issue. It is likely that you will want to use patch profiles (covered later on in this document) to have your customer's workstations and servers report to an on-site WSUS server, and your customer's laptops report to a publicly accessible WSUS server

7 - 7 -

8 Adding a WSUS Server to N-central Adding a WSUS server to N-central is simple - you simply install a Windows Agent on it. The Windows Agent will discover the installed WSUS software and will then add the server to the list displayed on the WSUS Server Management screen (accessible through Configuration > Patch Management > WSUS Servers in the N-central UI). WSUS servers that have been discovered but are not yet enabled for patch management will be indicated by an icon. Servers that have been enabled will be indicated by a icon. If you install WSUS on the server after the agent has been installed, the WSUS server will still be discovered as the agent repeats its discovery action every 24 hours. Additionally, you can trigger an immediate discovery by clicking Update Now on the Asset tab of the device in question. The following are the time intervals for interaction between Windows Agents and WSUS: Activity Interval Patch Discovery (Patches Needed) Upon agent start and every 22 hours WSUS Group Creation If successful: every 6 hours If unsuccessful: every 5 minutes Reapply WSUS Group Hierarchy Every 6 hours WSUS Server Configuration If successful: every 24 hours If unsuccessful: every 5 minutes Verify Patch Status Every 12 hours Patch Approval Synchronization For Security Updates and Critical Updates: every 24 hours For all other categories: every 168 hours (7 days) What Versions of WSUS Are Supported? N-central 9.1 supports, at minimum, Microsoft WSUS 3.0 Service Pack 2. Older versions of WSUS will be discovered but cannot be used for patch management in N-central. As new versions of WSUS become available, N-able Technologies will test the integration with N-central and make any updates necessary to provide support for the new version. We do not recommend upgrading WSUS until official support is provided for the new version in order to ensure that your patch system is operating properly

9 To display the WSUS servers managed by N-central In the navigation pane, click Configuration > Patch Management > WSUS Servers. To add a new WSUS server to the list of WSUS servers managed by N-central The following procedure can only be performed at the Customer or Site level. Select the appropriate Customer or Site in the View Selection Menu to continue. 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. Click Add. 3. The Add WSUS Servers dialog box that appears will instruct you to install an agent on the WSUS server itself (and provides a link for downloading a Windows agent). N-central's asset discovery mechanism will automatically add the server to the list. If the WSUS server is publicly-accessible, you must change the Network Address of the WSUS server in N-central from the private IP address to a public IP address. To force N-central to detect WSUS on a device already managed by N-central 1. Navigate to the appropriate customer. 2. Click All Devices view in the navigation pane. 3. Click on the name of the device that is the WSUS server. 4. Select the Asset tab in the Device Properties screen. 5. Click Update Now. When the discovery job is completed, the WSUS server will be included in the list displayed on the WSUS Server Management screen

10 Previously-configured WSUS Servers For N-central to manage devices in WSUS, client-side targeting must be disabled in the WSUS UI by performing the following: To configure client-side targeting on a WSUS server 1. Click Control Panel > Administrative Tools > Windows Server Update Services to access the WSUS UI on the WSUS server. 2. Click Options in the left-hand UI pane. 3. Click Computers in the middle UI pane. 4. Select Use the Update Services console. 5. Click OK. How N-central Monitors Your WSUS Servers Once you have configured WSUS and are using it to manage software patches, it will become a key component of your infrastructure. As a result, WSUS itself must be managed and monitored. When you add a WSUS server to N-central, the WSUS 3.0 service template will be automatically assigned to the device. This provides complete monitoring of WSUS including event log, process availability, and the WSUS Status service. This monitoring ensures that the WSUS server is not reporting errors and that it is synchronizing with Microsoft correctly. The collected data is included in the WSUS Status report which will help in providing optimal service levels and can demonstrate the availability of the patch solution to your customer's auditors. Tip: If your WSUS server is publicly-accessible and your WMI-based services transition to a Misconfigured state, perform the following: 1. In N-central, configure the Network Address of the WSUS server to the public IP address. 2. Wait until your WMI-based services transition to a Misconfigured state. 3. Disable the Windows Firewall on the WSUS server. 4. After the scan for the WMI-based services is completed again, the services should transition back to a Normal state. 5. Enable the Windows Firewall on the WSUS server once more. Enabling or Disabling WSUS Servers Managing a WSUS server in N-central includes the ability to enable or disable the server as a point of distribution for patches. Enabling a WSUS server allows it to be used for deploying patches and to be monitored by N-central. Disabling a WSUS server makes it unavailable for deploying patches and it will not be monitored by N-central

11 You must enable or disable WSUS servers on an individual basis as you cannot enable or disable multiple WSUS servers simultaneously. All newly-added WSUS servers are disabled by default. To enable a WSUS server 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. In the Enabled column beside the name of the WSUS server that you want to enable, click the icon. A icon will appear in the Enabled column beside the name of the WSUS server that has been enabled. To disable a WSUS server 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. In the Enabled column beside the name of the WSUS server that you want to disable, click the icon. 3. In the Disable WSUS Server dialog box, click Save. An icon will appear in the Enabled column beside the name of the WSUS server that has been disabled. Changing which Customers can Use a WSUS Server The WSUS Server Management screen can be accessed from any level (System, Service Organization, or Customer). Only the WSUS servers that can be managed by the current user will be displayed. Under the Customer/SO Name column, you will see the level at which the WSUS server is currently listed. If you want the WSUS server to only be visible to devices within the current customer, this column should display the customer name. If you want to make a WSUS server visible to all devices at the service organization level, select it and click Make Available at Another Level. Select the service organization name from the drop-down menu that appears and click Save. You will see the customer name change to the service organization name

12 To change the level of a WSUS Server 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. Select the check box beside each of the server names whose level you want to change in the WSUS Server Management screen. Tip: Selecting the check box at the top of the column will select all of the WSUS servers in the list. 3. Click Make Available at Another Level. 4. Select the new level from the drop-down menu in the Make Available at Another Level dialog. 5. Click Save. Configuring WSUS Server's Patch and Language Options In addition to controlling which customers can use a given WSUS server, you can also use the WSUS Server Management screen to configure the WSUS server s patch and language options. Available options include:

13 Products to support Product Classifications Download and Store Patches on the WSUS server Which languages to support Synchronization schedule Since you can select more than one server from the WSUS Servers screen, it is easy to configure all of your WSUS servers to use the same settings. It is strongly recommended that you manage these settings through N-central rather than using the WSUS user interface. Best Practices If you are using a hosted server, DO NOT store patches locally but if you are using an onpremise server, DO store patches locally. If you store patches locally, adjust the languages supported to only those that are in use by your customers. This will minimize WSUS disk space requirements. Ensure that your WSUS server is set to synchronize automatically at least once per day. This will ensure that your patch list is always up to date. To configure WSUS Server options No configuration changes can be made to disabled WSUS servers. The settings are saved in N- central. When the WSUS server is enabled, the settings are then applied to the WSUS server

14 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. Select the check box beside each of the names of the WSUS servers that you want to configure in the WSUS Server Management screen. Tip: Selecting the check box at the top of the column will select all of the WSUS servers in the list. 3. Click Configure WSUS Options. 4. Select the configuration options in the Configure WSUS Server Settings dialog that you want to apply from the following: a. Select which product you would like to support - identifies the patch products you want the WSUS server to support. b. Select the update classification to provide - identifies the classification of patches you want the WSUS server to provide. c. Specify where you would like to store Update Files - identifies whether Windows Update files will be stored locally on the WSUS server or not. If you select Store updates locally, you must identify the type and language of updates to be stored. d. Configure your desired Synchronization schedule - identifies whether the WSUS server will synchronize manually or automatically. If you select Synchronize automatically, you must select the time of the first synchronization as well as the number of synchronizations per day. When selecting check boxes in the Configure WSUS Server Settings dialog, your selection can have three possible settings: Selected Indicates that the setting will be applied to the WSUS server. Not Selected No Change Indicates that the setting will not be applied to the WSUS server. Indicates that the setting will not change any current settings already applied to the WSUS server. 5. Click Save. Maintaining your WSUS Servers WSUS servers require periodic maintenance which includes deleting unnecessary patches, optimizing the database, and other routine tasks. All of these actions can be done by performing a WSUS Server Cleanup Task from the WSUS Server Management screen

15 If you select a WSUS server and click Cleanup WSUS, the task is created as a "run now" scheduled task whose status can be viewed in the Job Status view. If you wish to schedule this task for periodic execution, you can do so from the Configuration > Scheduled Tasks menu. To clean up WSUS servers 1. In the navigation pane, click Configuration > Patch Management > WSUS Servers. 2. Select the check box beside each of the names of the WSUS servers that you want to clean in the WSUS Server Management screen. Tip: Selecting the check box at the top of the column will select all of the WSUS servers in the list. 3. Click Cleanup WSUS. 4. Type the Name you want to use to identify the cleanup task in the WSUS Cleanup Settings dialog. 5. Select the cleanup settings you want to apply to the task from the following: Remove unused updates and update revisions Delete computers not contacting the server

16 Delete unneeded update files Decline expired updates Decline superseded updates 6. Click Save. Patch Profiles Patch profiles are used to configure all of the patch-related settings that need to be configured on Windows devices. This includes items such as the WSUS server to use, whether or not to reboot after installing the patches, and whether or not to alert the user when new patches are downloaded. Patch profiles are a key feature in N-central, as they allow you to re-use the same patch settings across multiple customers. This saves you and your technicians time that would have to be otherwise spent configuring patch settings in the Group Policy of each of your customer's domains. Access to patch profiles is based upon the level at which they are created. For example, a profile created at the System level is available at all levels while a profile created at the Service Organization level would only be available within that Service Organization. Best Practices Configuring the default Patch Management profile at the highest level possible will provide consistent settings for all lower-level accounts. For example, modifying the default Patch Management profile at the Product Administrator level will define the settings for the profiles in all Service Organization and Customer accounts. It is strongly recommended that you disable any group policy objects that configure Windows Update as they will conflict with the N-central settings. Adding Patch Profiles N-central provides a default Patch Management profile. Depending on your needs, however, it may be necessary to create additional profiles. You can also copy a profile by using the "clone" feature to create a new profile that has a similar configuration to an existing one but with minor differences. This can make the task of creating multiple profiles faster and easier. Cloning a profile will include both its settings and its associated devices. To add a new profile 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click Add in the Profiles screen. 3. Define the profile settings as required in the Add Profiles screen. For more information, refer to Patch Profile Settings on page

17 4. Click Save. 5. Click Save in the dialog box that appears confirming whether you want to save the new profile. To clone a profile 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Select the profile you want to duplicate in the Profiles screen. 3. Click clone. 4. Type a descriptive Name to identify the profile. 5. In the Description field, type additional information about the profile. 6. Click Save. After you have cloned a profile, you need to edit the new profile's settings. For more information, refer to Editing Patch Profiles on page 21. Patch Profile Settings Patch Management profiles have a number of different settings that will affect how patches will be deployed including: Setting Name Description Description A descriptive term or label used to identify the profile. Additional information about the profile that will be displayed in the Profiles table. Configure Automatic Updates Disable Automatic Updates Activates (or de-activates) N-central's ability to automatically install software patches when they are approved through N-central. Warning! Disabling this option means that all devices associated with this profile must have software patches manually applied

18 Setting Description Configure Automatic Updating Defines how the deployment of patches will be applied to target devices from one of: Notify before download - Will send a notification of software updates being available before they are downloaded and before they are installed. Automatically download and notify of installation - Will automatically download software updates when they are available but will send a notification before they are installed. Automatic download and scheduled installation - Will automatically download software updates when they are available and will install them at the scheduled date and time. Automatic Updates is required but end users can configure it - Will automatically download software updates but will allow users to configure options such as the date and time when they will be installed. If Automatic download and scheduled installation is selected, you must select a Schedule Install Day and Schedule Install Time when patches will be installed. Enable Automatic Updates Detection Activates (or de-activates) the automatic detection of software updates. If Enable Automatic Updates Detection is set to Yes, you must select the Automatic Updates Detection Frequency (Hours) value to determine the interval between when N-central will check for software updates (to a maximum of 22 hours). Allow Non- Administrators to receive update notifications Provides permission for N-central to send notifications to non-administrator accounts. For example, if this option is enabled, end users will be notified when software updates have been downloaded and are available to be installed on their computers. Turn on Software Notifications Activates (or de-activates) the transmission of notifications. The notifications sent will depend on the setting selected for the Configure Automatic Updating option. Allow Automatic Updates Immediate Installation Activates (or de-activates) the immediate installation of minor updates that do not interrupt Windows services or require Windows to be restarted. If this is set to Yes, N-central will immediately install these updates as soon as they are downloaded and ready to be installed

19 Setting No Auto Restart with Logged On User for Scheduled Automatic Updates Delay Restart for Scheduled Installations Description Activates (or de-activates) N-central's ability to automatically restart Windows devices when a user is currently logged on. If this is set to Yes, N-central will not restart the device automatically after software updates are installed and a user is logged on to the device. The user will be prompted to restart the device. Activates (or de-activates) a specified delay before N-central will restart Windows devices following the installation of software updates. If Delay Restart for Scheduled Installations is set to Yes, you must select a value for Wait (minutes) before proceeding with scheduled restart from 1 minute to 29 minutes. Re-Prompt Restart with Scheduled Installations Activates (or de-activates) a specified delay before N-central will send another prompt to logged-on users that Windows devices will be restarted following the installation of software updates. If Re-Prompt Restart with Scheduled Installations is set to Yes, you must type a value for Wait (minutes) before proceeding with scheduled restart. Reschedule Automatic Updates Scheduled Installation Activates (or de-activates) a specified delay before N-central will install software updates that were missed (for example, if a device was shut down during a scheduled software update). If Reschedule Automatic Updates Scheduled Installation is set to Yes, you must type a value for Wait (minutes) after system startup

20 Setting Description Enable Windows Update Power Management to Automatically Wake up the System Activates (or de-activates) the capability to "wake up" a Windows device (even if it is in hibernation mode) in order to install a critical software update. Specify Patch Server to use (WSUS or Windows Update) Identifies either the WSUS server or Windows Update service that will be used for deploying patches. Using a Windows Update service for deploying patches will disable the patch approval features available with a WSUS server. After you have identified the server or service from which patches will be deployed, activate (or de-activate) Allow Signed Updates from an Intranet Microsoft update service location. This controls whether or not software updates will be accepted if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. If this setting is set to No, software updates from an intranet Microsoft update service location will only be accepted if they are signed by Microsoft. Do not display "Install Updates and Shut Down" option in Shut Down Menu Activates (or de-activates) the ability to display an "Install Updates and Shut Down" option when a Windows device is being turned off or restarted even if software updates are available. If Do not display "Install Updates and Shut Down" option in Shut Down Menu is set to Yes, you must activate (or de-activate) the Do not adjust default option to "Install Updates and Shut Down" in Shut Down Menu option. One of the key settings for Patch Management profiles is the Specify Patch Server to use. This determines the location to which the Windows Update agent will connect in order to receive patch information. There are several options available including: Windows Update (default setting) Best Available WSUS Servers These options provide very different results. The Windows Update option configures the Windows Update Agent to connect to the Windows Update service. This allows patch management to be performed on a device without using WSUS. The advantage to this is the universal availability of the Windows Update site. One drawback, however, is the lack of management capabilities - the administrator cannot configure which individual patches should be applied. Best Available configures the Windows Update Agent to use the best available WSUS server directing N-central to look for a customer-level WSUS server. If one is available, the device will be configured to

21 use that server. If there is no customer-level WSUS server available, N-central will attempt to configure an SO-level server. If an SO-level server isn t available, N-central then will attempt to use a product-level server. Should there be no WSUS servers available, N-central will configure the WUA to use Windows Update. The advantage to this functionality is that N-central will re-evaluate the best available configuration whenever a new server is enabled. As a result, if a system is configured to use an SO-level server and a customer-level WSUS server is added, N-central will automatically reconfigure the devices to use the customer-level server. Selecting WSUS Servers allows you to select a specific WSUS server. Use this option if you know the specific server that you want to use. Editing Patch Profiles Any patch profile (including the default profile provided by N-central) can be modified. When a profile is modified, any changes made will be applied to all of the devices that use the profile. If you try to edit a profile that was created at a higher account level, N-central will automatically create a copy of the profile at the level that it is being edited, including the associated devices, and save it at that level. This will disconnect the association to the profile that was created at a higher account level. For example, an SO Admin attempting to edit a profile created at the system level will create a new copy of the profile within their respective service organization. To edit a profile 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click the name of the profile that you would like to edit in the Name column of the Profiles screen. 3. Update the profile settings as required in the Edit Profiles screen. For more information, refer to Patch Profile Settings on page Click Save. 5. Click Save to confirm the modifications when prompted. Viewing the Folders and Devices Associated to a Patch Profile You can view the associations a Patch Management profile has to folder templates, folders, and devices. You can view the associations a Patch Management profile has to folders. To view profile associations 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click the name of the profile for which you would like to view all associations in the Name column of the Profiles screen. 3. Click the Associations tab in the Edit Profiles screen

22 Deleting Patch Profiles You may want to delete one or more patch profiles as your patch deployment policies evolve. Be cautious when you do this as devices will need to use an existing profile if they are to receive deployed patches. If you try to delete a profile that is currently being used by one or more devices, you will be warned that it is an active profile. You may then either cancel the deletion or specify a replacement profile to be applied to those devices that are using the profile. Tip: You can delete multiple patch profiles simultaneously. To delete a profile 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Select the check box next to the profile (or profiles) that you want to delete in the Profiles screen. Tip: You can select the check box next to the Name column to select all of the profiles. 3. Click Delete. 4. When prompted, click Delete to confirm the removal of the selected profiles. Configuring Devices for Patch Management After WSUS servers are configured (and enabled) and your patch profiles are set up and ready to use, you can enable Patch Management on your managed devices. The Patch Management feature is only available on Professional devices that have a Windows Agent installed on them. Patch Management can be enabled in three different ways: on a per-device basis, by bulk-editing multiple devices simultaneously, or by configuring Patch Management options through a folder. It may take up to 24 hours for the Patch Management feature to be fully operational as the Windows Update Agent (WUA) on all configured devices must synchronize with a WSUS server. Following the completion of this initial registration period, Patch Management functionality will be fully available on managed devices. To configure single or multiple devices for Patch Management The following procedure can only be performed at the Customer or Site level. Select the appropriate Customer or Site in the View Selection Menu to continue. 1. Click All Devices view in the navigation pane

23 The All Devices view screen appears. 2. Perform the following: For a single device, click the device that you would like to edit in the Name column. For multiple devices, select the check box beside each of the device names you wish to edit and click Edit. 3. Under Patch Management, select Enable Patch Management. 4. From the Select Patch Management Configuration Profile drop-down list, select the profile that you want to be applied to the device (or devices). You can Add a new profile or View/Edit profiles to ensure that the correct one is selected. 5. Click OK. The device properties are updated and the All Devices view screen appears. You can click Save to apply the settings and remain on the current screen. To enable Patch Management using Rules The following procedure can only be performed at the Service Organization or Customer level. Select the appropriate Service Organization or Customer in the View Selection Menu to continue. 1. In the navigation pane, click Configuration > Monitoring > Rules

24 2. In the Name column of the Rules screen, click the Rule that you would like to edit. 3. In the Edit Rule screen, select the Configuration Options tab. 4. Under Patch Management, select Enable Patch Management Settings. 5. From the Select Patch Management Configuration Profile drop-down list, select the profile that you want to be applied to the devices associated with the folder template. 6. Click Save. This operation can also be carried out at the Customer level for individual Rules. After you enable Patch Management on a device and apply a profile, the N-central agent will configure the settings for the device and then connect to the specified WSUS server so that the device can be placed in the correct computer groups. Approving and Declining Patches After the configuration of the WSUS system is complete, you can begin approving patches for deployment. In N-central, patches can be deployed using one of two methods: automatically using Automatic Patch Approval rules (for more information, refer to Automatically Approving Patches on page 29), or the Patch Deployment Wizard. Through the Patch Deployment Wizard, N-central allows you to efficiently deploy patches across a number of Windows devices (regardless of the customer that they belong to) by completing the following steps: 1. Filtering and searching available patches to determine which should be deployed. 2. Selecting the approval status to be assigned to patches. 3. Setting a patch deployment deadline (if applicable). 4. Accepting EULAs (End User License Agreements) on a individual patch basis or all at once (if applicable). 5. Confirming your selections

25 To display the list of patches waiting for deployment In the navigation pane, click Configuration > Patch Management > Approve/Decline Patches. Current Status and Approval Reported for Patches The list of available patches displayed on the Select Patches screen includes specific information for each patch including: KB (Knowledge Base) Number Patch Name Date Classification Severity Status Approval Clicking on the name of the patch will display additional information such as the Patch Description, whether it has been Superseded or not, if the patch is Removable, the Restart Behavior, and other pieces of information relevant to the patch. The Status of each patch will be a combination of the individual Status values of that patch across all applicable devices. The combined Status value can be one of the following (listed in order of importance): 1. Failed 2. Needed

26 3. Installed 4. Not Needed The highest-ranked of these statuses found on any applicable device will be reported as the combined Status for the patch. For example, if one device had a status of Failed for this patch, while two other devices have a status of Needed for this patch, the patch would have an overall combined Status of Failed. Patches with the status Needed will be displayed with the following icon: Clicking on this icon will display all of the devices that are reporting the Needed status for this software patch. This allows you to better understand which devices will be installing the patch after it has been approved. The Approval value of each patch will be a combination of the individual Approval values of that patch across all computer groups. The Approval values are combined as follows: Declined + any other Approval value = Declined Approved for Install + Not Approved = Approved for Install Approved for Install + Approved for Removal = Mixed Approved for Install + Not Approved + Approved for Removal = Mixed Not Approved + Approved for Removal = Mixed To filter the list of patches Depending on your configuration, the list of available patches can be quite long and may require filtering in order to provide a manageable amount of patch information. 1. In the navigation pane, click Configuration > Patch Management > Approve/Decline Patches. 2. Select the classification of patches you want to display from one of the following in the Classification column of the Select Patches screen: Critical Updates Definition Updates Drivers Feature Packs Security Updates Service Packs Tools Update Rollups Updates 3. Select the current approval setting of patches you want to display from one of the following in the Approval column:

27 Approved for Install Approved for Removal Declined Mixed Not Approved 4. Select the severity rating of patches you want to display from one of the following in the Severity column: Critical Important Low Moderate Unspecified 5. Select the specific software for which you want to display patches in the Products column. 6. Select the current status of patches you want to display from one of the following in the Status column: Failed Installed Needed Not Needed Tip: You can use Ctrl-click or click-and-drag to select multiple criteria within a column. 7. Type the information to be used to filter the patch list in the Enter text to search for field (including the name of the patch, Knowledge Base number, or other criteria). 8. Click Filter. You can use Reset Filter to undo any selections you have made and display the entire list of available patches. To approve/decline patches 1. In the navigation pane, click Configuration > Patch Management > Approve/Decline Patches. This feature may also be accessed through the Actions menu. 2. If necessary, filter the list of displayed patches in the Select Patches screen as described in To filter the list of patches on page Select the check box next to the patch (or patches) you would like to deploy

28 Tip: You can select the check box next to the KB Number column to select all of the patches in the list that is currently displayed. 4. Click 2. Approve Patches or Next Step to proceed. 5. Select the criteria for Set selected patches to from one of the following in the Approve Patches screen: Approved for Install Approved for Removal Declined Declined is only available as an approval criteria for Product Administrators or SO Administrators if there are no product-level WSUS servers available in N-central. Approved for Removal is only available for software patches that support this feature. If you selected Approved for Install, you will need to Specify your target devices (or device groups) by navigating through the list of folders and choosing the service organization, customer and folder (or folders) for which the associated devices will have the patch installed. The target devices tree is hierarchical in nature so that selecting a folder at one level will apply the patches to matching folders at all levels below the one that is selected (including new devices as they are added). Icons in the target devices tree indicate selections as follows: Approved for Install Indicates that approved patches will be installed on all devices associated with the folder. Not Approved Indicates that approved patches will not be installed on all devices associated with the folder. No Change Indicates that existing patch approvals should not be altered for devices associated with the folder. 6. Click 3. Set Installation Deadlines (if applicable) or Next Step to proceed. If applicable, the Set Installation Deadline screen will appear. If no deadline setting is available, skip to step Specify the deadline options for the patches from one of the following: None Custom

29 If you selected Custom, you will need to specify the Date and Time that will be the deadline by which all approved patches must be installed. Click in the respective fields to select Date and Time values. 8. Click 4. Review and Accept EULAs (if applicable) or Next Step to proceed. If applicable, the Review and Accept EULAs screen will appear. If no EULAs are provided for the accepted patches, skip to step Click EULA beside the name of the patch to read its End User License Agreement. When the EULA is displayed, click Accept or Decline in the dialog box to indicate acceptance or refusal of the agreement. You can also select the check box next to the patch (or patches) to accept a EULA without displaying it. Tip: You can select the check box next to Accept EULA to indicate acceptance of the EULAs for all of the patches. 10. Click 5. Confirmation (if applicable) or Accept EULA and Approve Patches to proceed. 11. Click Finish in the Confirmation screen. At any time during the Patch Deployment Wizard, you can click Back to review previous stages of the procedure. Automatically Approving Patches Creating Patch Approval Rules allows N-central to automatically approve patches for you that meet specific criteria saving you and your technicians time and effort. Patch Approval Rules are stored and run on the N-central server. They are not passed on as an automatic approval rule to the WSUS server. Patch Approval Rules are created and applied through N-central which then passes the approval to the WSUS server. Automatic Patch Approval Rules can be created at the Product Administrator, Service Organization and Customer levels. Editing and deleting rules is restricted by the level at which they are created: Rules created at a higher level can be used but not edited or deleted by lower level accounts. Rules created at a lower level can be edited or deleted by higher level accounts. It is important to note that patches that require EULA consent cannot be approved using Automatic Patch Approval Rules; those patches must be approved manually so that the EULA can be reviewed and accepted

30 Rules can be enabled or disabled to allow further temporary suspension. N-central also allows you to run a Rule on-demand. The Rule status will be indicated by one of the following icons: Enabled Disabled Warning - This automatic approval rule has no groups associated. This warning is displayed when a rule is not associated with any valid groups (for example, if a group has been removed after the rule was created). The rule will not be applied and must be edited to associate it with a valid group. To add an Automatic Patch Approval rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Click Add in the Automatic Patch Approval Rules screen. 3. Configure the properties of the rule in the Add Automatic Patch Approval Rule screen:

31 Name A unique identifier for the rule. Description A personalized summary of the rule that should identify what it does. Approve Patches for Used to identify how the rule will be applied based on the following criteria: Products - either Local Publisher or Microsoft (with the option to select individual products within each category). Classifications - selected from one or more of the following: Critical Updates Definition Updates Drivers Feature Packs Security Updates Service Packs Tools Update Rollups Updates Groups - for selecting multiple devices by folder. The criteria displayed in the Product and Classifications lists are provided by data accessed through the WSUS Servers screen. If a Product or Classification has not been enabled in the WSUS server profile, it will not be available in the Add Automatic Patch Approval Rule screen. Specify the deadline options for the patches Select from one of: None - no deadline applied. Custom - used to specify how many days after approval that the patch should be installed and by what time on the deadline date. 4. Click Save. 5. Click Yes - Run the Rule Now or No - Do Not Run the Rule Now in the Do you Want to Run this Rule Now? prompt based on your current needs. If you select Yes, the rule will be applied and software patches approved. If you select No, the rule will not be applied. If you choose to run the new rule immediately, it will be applied against all of the software patches that your WSUS server currently manages as well as any new software patches from this point on. If you choose not to run the new rule immediately, it will only be applied to future software patches that your WSUS server downloads from Microsoft

32 To delete an Automatic Patch Approval rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box next to the rule that you would like to delete in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column heading will select all of the rules. 3. Click Delete. 4. Click Delete in the Confirm Delete prompt. To edit an Automatic Patch Approval rule Modifications made to existing rules will only be applied to new software patches that are downloaded after the changes have been made. 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Click the Name of the rule that you would like to modify in the Automatic Patch Approval Rules screen. 3. Modify the properties of the rule as needed in the Edit Automatic Patch Approval Rule screen. 4. Click Save. To enable an Automatic Patch Approval rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the rules that you want to enable in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the rules. 3. Click Enable. 4. Click Enable in the Confirm Enable prompt. A will appear in the Enabled column beside the name of the rule (or rules) that has been enabled. To disable an Automatic Patch Approval rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the rules that you want to disable in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the rules

33 3. Click Disable. 4. Click Disable in the Confirm Disable prompt. An will appear in the Enabled column beside the name of the rule (or rules) that has been disabled. To run an Automatic Patch Approval rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the rules that you want to run in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the rules. 3. Click Run Rule Now. 4. Click Run Rule Now in the Confirm Run Now prompt

34 Viewing Installed Patches The Windows Agent will automatically discover all installed patches on the device when the agent is first installed as well as when the agent runs its daily asset discovery. This includes information such as patch details, installation date, and installation status. This information is then made available in the N-central UI on the device's Asset tab and is also included in the Patch Status Report and Patch Inventory Report. Patch Information on the Asset tab

35 Patch details in the Patch Status report

36 Patch Management Reporting A key element of N-central's Patch Management feature is the ability to provide effective reporting. The patch management reports are designed to be highly flexible in order to support a variety of use cases. Specifically, there are several key reports that you can deliver: Patch Status Report Missing Patches (by system) One, several, or all devices One, several, or all categories Patches older than a certain age Installed Patches (by system) One, several, or all devices One, several, or all categories Patches installed in the last <x> many days All Patches (installed and missing) Patch Inventory Report Missing Patches (by patch) Installed Patches (by patch) Which computers are missing a specific patch Which computers have a specific patch Report on patches by name or KB article or other criteria Missing Patches Report Show (per customer) the number of missing patches (by type) Show top <x> customers by missing patches Click through to show individual customer details WSUS Status Report WSUS servers (up to a maximum of 20) that have the largest number of assigned devices Indicate the WSUS level, version, number of customers, number of devices and details on synchronization for each WSUS server Indicate customer assignment, update products, and update classifications for WSUS servers Indicate device assignment, update products, and update classifications for WSUS servers Leveraging these reports, N-central can support a wide range of needs including: helping a technician understand the software patches that need to be deployed or the devices on which a bad patch needs to be rolled back,

37 showing a customer their patch status, showing a customer the work that was done, needs to be done, or demonstrating to an auditor that patch management SLA s are being met

38 Appendix: Patch Installation and Approval Status The list of available patches displayed on the Select Patches screen includes the following information for each patch: KB (Knowledge Base) Number Patch Name Date Classification Severity Status Approval The Status of each patch will be a combination of the individual Status values of that patch across all applicable devices. The combined Status value can be one of the following (listed in order of importance): 1. Failed 2. Needed 3. Installed 4. Not Needed The highest-ranked of these statuses found on any applicable device will be reported as the combined Status for the patch. For example, if one device had a status of Failed for this patch, while two other devices have a status of Needed for this patch, the patch would have an overall combined Status of Failed. Patches with the status Needed will be displayed with the following icon: Clicking on this icon will display all of the devices that are reporting the Needed status for this software patch. This allows you to better understand which devices will be installing the patch after it has been approved. The Approval value of each patch will be a combination of the individual Approval values of that patch across all computer groups. The Approval values are combined as follows: Declined + any other Approval value = Declined Approved for Install + Not Approved = Approved for Install Approved for Install + Approved for Removal = Mixed Approved for Install + Not Approved + Approved for Removal = Mixed Not Approved + Approved for Removal = Mixed