PATCHING WINDOWS SERVER 2012 DOMAIN CONTROLLERS. Prepared By: Sainath K.E.V MVP Directory Services

Transcription

1 PATCHING WINDOWS SERVER 2012 DOMAIN CONTROLLERS Prepared By: Sainath K.E.V MVP Directory Services

2 TABLE OF CONTENTS 1 Introduction: Patch management process Patching active directory domain controllers Permission Requirement... 8

3 1 INTRODUCTION: Patch Management is one of the critical risk associated activity of day-day System Engineer / System Administrators managing 100 s to 1000 s of Servers every day. Its challenge which involves risk, complexities, outages and escalations. Over the years, there has been proven methodologies to patch Windows Servers and every organization would follow different testing strategies to apply Patches to their Servers. Microsoft stems Windows updates into different category each of them affect Windows components upon upgrade which leaves Organizations to carefully test their applications against the Windows updates. Microsoft releases the following types of windows updates Security Update : These are important updates and must be installed on Windows Servers Recommended Updates: These are sometimes optional updates but requires careful understanding of the update Service Packs: Combination of hotfixes bundled together which assist Administrators / Developers to test their Apps / build their Apps based on the Service Pack levels. Language Pack: Low impact optional updates which may be required by Application developers who build multi language applications to run on Operating Systems. This article lists the Patch management process which highlights the different phases involved before a patch is installed and list the recommended permissions required to install Windows Updates on Domain Controllers.

4 2 PATCH MANAGEMENT PROCESS I have written the framework based on proven methodology implemented by Enterprise Organizations to install patch on the Windows Servers. Following are the critical phases on Patch Management Process Phase 1: Receive Patch Notifications Phase 2: Patch Management Plan Phase 3: Release the Patch Phase 4: Evaluate the Patch Phase 5: Systems to be Patched Phase 6: Acquire the Patch Phase 7 : User Acceptance Test Phase 8: Schedule Patch Deployment Phase 9: Deploy the Patch Phase 10: Confirm Patch Deployment Phase 11: Document Changes Phase 12: Roll back procedures.

5 Patch Management Framework Receive Patch Notifications Patch Unavailable Patch Mitigation Plan Deploying Patches on Slow Links Patch available but device is out of NW Patch requires application code change Release The Patch Critical/Important/ Low Evaluate The Patch Software/Driver Hardware/Network Desktops/ Servers/ Applications Systems To Be Patched Network Appliances/ Hardware WSUS/BigFix Altiris Acquire The Patch PatchLink/CA/Foxit Risk Assesment User Acceptance Test Risk Treatment Risk Acceptance Risk Monitoring Schedule Patch Deployment Deploy The Patch Same site / Diff Site Confirm Deployment How To verify? Document The Changes Fig: Patch Management Framework

6

7 3 PATCHING ACTIVE DIRECTORY DOMAIN CONTROLLERS By following the Patch management process implemented in any Organization, there are certain requirements and checks needs to be in place before patching Domain controllers. When Windows Server gets promoted to Active Directory Domain Controller, the local groups get migrated to Active Directory owned groups and the conventional way of adding Users / Group to local administrator group no longer valid. The above scenario holds valid for the cases where Organizations employ Vendors to perform Patch Management and have to accommodate Vendors to be part of Builtin Administrators group on the Domain Controllers. Before listing down the permissions required, I would like to list out the Domain Administrators vs Builtin Administrator privileges which gives good level of understanding on the groups on Domain Controllers. Groups Administrators Domain Admins User Rights Access this computer from the network; Adjust memory quotas for a process; Allow log on locally; Allow log on through Terminal Services; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Force shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Manage auditing and security log; Modify firmware environment variables; Perform volume maintenance tasks; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and

8 directories; Shut down the system; Take ownership of files or other objects 3.1 PERMISSION REQUIREMENT Administrator group has full access to AD objects which is close to / equivalent to Domain Administrators group, along with the full System level permissions on the Domain Controllers. Active directory Administrators / Architects should evaluate before adding Vendors to Builtin Administrators group. The one notable difference between Domain Administrators and Builtin \ Domain Local Administrators is that, Domain Administrators are part of Local Administrators group on Non Domain Computers ( both domain Joined Client and Server Operating Systems ) where as Builtin\ domain local Administrators group doesn t have the permission on Non Domain Controllers. One of the requirement for installing patches is to have Administrator access on the Windows Server / Clients Operating Systems and Vendor accounts should be added to Builtin\administrators group on the Domain Controller. Is it safe to allow Vendors to Patch : It is always not safe to allow Vendors to perform Patch Management activity on the Production Domain Controllers as they have complete access to Active Directory objects. But a strict monitoring in place can allow Vendors account to allow patching Domain Controllers for the update schedule time and disable the account. The other alternate and possible safe approach is to allow Domain Administrators to patch the Domain Controllers. Note: The above procedure is for the environments where there are no automated Patch management process in place.