Deploying Windows Updates via Baselines

Transcription

1 IBM BigFix - Wednesday, March 16, 2016 Deploying Windows Updates via Baselines Panelists Adam McDonald (L2 Support Engineer) - Presenter Stephen Hull Senior Software Architect Aram Eblighatian Solutions Architect Kenny Chow Software Developer (Windows Patch Content) Yunfei Bai Software Developer (Windows Patch Content) Nathan Hanner L2 Support Engineer Kevin Reinstein - Manager, IBM BigFix & MobileFirst Protect On-Premises Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA toll-free: USA toll: Participant passcode: Slides and additional dial in numbers: NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call.

2 Agenda Baselines Finding Updates Building Baselines Baseline Relevance Maintaining Baselines Baseline Actions Preparing Downloads Taking Action Troubleshooting Baseline Actions Questions 2

3 Baselines

4 Baselines in BigFix A baseline in IBM BigFix is a container that allows you (the operator) to group and order a set of fixlets and/or tasks (in this case for the purpose of patching) into a single actionable entity. 4

5 Finding Updates

6 Windows Updates 6

7 Windows Updates By Source Severity: IBM BigFix bases the source severity for Microsoft security updates solely on the information released by the Microsoft Security Response Center (MSRC) for the update. ( By Category: Difference in category terms used by Microsoft and IBM BigFix ( ( Tip: Do not deploy only Critical updates. Deploy Security updates, Critical updates, and Service Packs if applicable. This will avoid future issues dealing with OS dependencies, functionality, and performance. 7

8 Windows Updates 8

9 Using filters to find fixlet components Menu > Tools > Create Custom Filter 9

10 Building Baselines

11 Add To New Baseline Select fixlets / tasks, right-click, select Add to New Baseline Name the baseline Select the site to create it in Specify Patch Management for the domain Click OK 11

12 Create New Baseline On the main menu, select Tools > Create New Baseline Name the baseline Select the site to create it in Specify Patch Management for the domain Click OK 12

13 Building New Baseline Create component groups Search for and add components to groups Move components up and down Move groups up and down Order for execution matters 13

14 Editing Baselines Ensure all fixlet components have an action specified Notice the Warning message when they do not Some components have no action associated with them, remove these from the baseline Some components have more than one action associated with them (requiring a decision) Some components do not have a default action specified (requiring a decision) 14

15 The Windows Patch Wizard in BigFix Labs Notes: As the wizard is in the BigFix Labs site it is only supported via the BigFix Forum Copies of the fixlets are made to the custom site specified (the fixlets become siloed, additional overhead) The baseline is created on the same custom site and is based off of the fixlet copies (not the originals) A video tutorial: 15

16 Best Practices Building Baselines ( Limit number of components to 100 ( Use custom sites to store your baselines (keep them out of the Master Action Site) Do not blindly select relevant fixlets (selecting all relevant fixlets is a recipe for disaster) Do not add administrative fixlets/tasks to your patching baseline (for example: upgrading your BigFix client); keep the intent of your patching baseline to patching only Read the description of the patching fixlets for important critical notes before deciding to deploy them Avoid including service pack level updates or large updates to your critical/important patching baselines; action on them separately Do not add patching fixlets which contain the words CORRUPT PATCH in their Name to your baseline ( Do not add patching fixlets which contain the word Superseded in their Name to your baseline ( Ensure each component has an action selected ( Maintain and re-synchronize your baselines over time Retire / delete baselines that are no longer needed 16

17 Baseline Relevance

18 Baseline Relevance If at least one component in a baseline is relevant for at least one computer in the deployment (evaluating the baseline), the overall baseline shows as relevant in the console. By default, this check box is checked for each component added. 18

19 Baseline Relevance For some items in your baseline (especially tasks) you may want to uncheck this. 19

20 Baseline Relevance The overall relevance can be modified for a baseline to restrict the baseline to being evaluated only on certain specific computers based on additional relevance statements. 20

21 Maintaining Baselines

22 Maintaining and Synchronizing Baselines Over time a baseline will become out of sync and will need some attention (at least every month). 22

23 Maintaining and Synchronizing Baselines The Baseline Synchronization Dashboard found in the BES Support site: Why does this happen? Microsoft released an update to one of their patches and the fixlet needed to be updated Content development released an update to one of the patching fixlets Content development withdrew fixlet(s) Microsoft released the fix on another KB and content development superseded the fixlet(s) 23

24 Maintaining and Synchronizing Baselines Housekeeping: Determine if any baselines can be removed/deleted from the deployment (and remove them) Synchronize the baselines that are to be kept (this is conveniently done through the dashboard) Address any remaining items within the baselines: Remove components that no longer have a source fixlet associated with them Remove components in which the component changed to a Superseded fixlet Specify an action in fixlet components which do not have an action specified in them Add any additional fixlets which may have been released to the baseline Sometimes it may be easier to choose to remove/delete old baselines in favor of creating new baselines from scratch. NOTE: When you change a baseline, the changes do not automatically propagate to the actions that have been taken that are based off of those baselines. You will want to stop any open baseline actions and retake them from the updated baseline. 24

25 Baseline Actions

26 Baseline Actions Preparing Downloads

27 Pre-Caching You can pre-cache downloads ahead of deploying baseline actions via the File Pre-Cache Wizard in the BES Support site Tip: Ensure you have plenty of space in your server s and relays caches. You can check cache sizes via the BES Relay Cache Information analysis in the BES Support site. Action can be taken on Task # 148 BES Relay / BES Server Setting: Download Cache Size See for more information on the Least Recently Used policy 27

28 Manual Caching Required Be aware that some patching fixlets require manual caching of their downloads ahead of actioning on them. For example: It will be apparent with Pending Downloads in the action s status It will also be apparent in the action s Summary, with an error similar to Baseline actions will get hung up if one of the components is in a Pending Download state 28

29 Manual Caching Required You can find which fixlets require manual caching of their downloads with the following console filters: Instructions for how to manually cache downloads on the server can be found in the fixlet description or here: 29

30 Baseline Actions Taking Action

31 Execution Criteria Set execution criteria: 31

32 Messages Set any messages you may want to display to end users: 32

33 Offer You have the option of making the baseline updates an offer to your end users: 33

34 Post-Action If you have not already included a restart task in your baseline you can specify a restart in the Post-Action criteria: 34

35 Baseline Actions Troubleshooting Baseline Actions

36 Action Summary 36

37 Action Info 37

38 Client Log Relevant : Update for Universal C Runtime in Windows - Windows 7 SP1 - KB (x64) (fixlet:1318) ActionLogMessage: (group:1302,action:1318) Action signature verified for Downloads DownloadPing command received (ID=1318) DownloadsAvailable: checking for ' DownloadsAvailable: true (action id 1318) ActionLogMessage: (group:1302,action:1318) Non-Distributed - DownloadsAvailable ActionLogMessage: (group:1302,action:1318) Submitting download request ActionLogMessage: (group:1302,action:1318) Download url: ' A187-97FB290D7A3F/Windows6.1-KB x64.msu' ActionLogMessage: (group:1302,action:1318) Non-Distributed DownloadsAvailable ActionLogMessage: (action:1302) Action signature verified for Execution ActionLogMessage: (action:1302) starting group action ActionLogMessage: (action:1302) starting sub action Command succeeded (Prefetch download manager collected file) prefetch Windows6.1-KB x64.msu sha1:99153d75ee4d103a429464cdd9c63ef4e size: A187-97FB290D7A3F/Windows6.1-KB x64.msu sha256:145623e0b85037b90e1ef5c45aee1aaa4120c4d12a388d94c48cfbb083e914e4 (group:1302,action:1318) Command succeeded (evaluated true) continue if {exists running service "wuauserv" OR NOT exists service "wuauserv" whose (start type of it = "disabled")} (group:1302,action:1318) Command started - waithidden "C:\Windows\system32\wusa.exe" "C:\Program Files (x86)\bigfix Enterprise\BES Client\ BESData\CustomSite_Windows_Patching_Baselines\ Download\Windows6.1-KB x64.msu" /quiet /norestart (group:1302,action:1318) Command succeeded (Exit Code=0) waithidden "C:\Windows\system32\wusa.exe" "C:\Program Files (x86)\bigfix Enterprise\BES Client\ BESData\CustomSite_Windows_Patching_Baselines\ Download\Windows6.1-KB x64.msu" /quiet /norestart (group:1302,action:1318) Command succeeded action requires restart "99153d75ee4d103a429464cdd9c63ef4e " (group:1302,action:1318) ActionLogMessage: (group:1302,action:1318) ending sub action Not Relevant : Update for Universal C Runtime in Windows - Windows 7 SP1 - KB (x64) (fixlet:1318) 38

39 Exit Codes List of error codes and error messages for Windows Installer processes Windows Installer Error Messages MsiExec.exe and InstMsi.exe Error Messages Error codes for Office 2010 update packages Windows Update Agent Result Codes: [in hexadecimal]

40 Best Practices When taking actions on baselines Test ahead of the deployment to Production Use non-master console operator accounts to deploy baseline actions Don t forget to unlock the computers in your deployment Choose a sufficient patching maintenance window to allow for enough time for patching to complete (4 hours?) Add a restart task as the first and last components of your baselines Expect multiple restarts on your endpoint machines, as needed, during the patching window (see Tasks 177, 390, and 391 in the BES Support site) You may want to increase the CPU utilization of the clients during the patching maintenance window to allow for faster evaluation of the baseline actions. Ensure server and relays have plenty of space in their download cache directories Pre-Cache downloads using the Pre-Cache wizard / Start client downloads before constraints are satisfied option in Take Action dialog If one of the component s Windows installer hangs; be prepared to stop the baseline action, restart the endpoint machine, remove the problematic component from the baseline, and re-take the baseline action for the rest of the baseline components to complete. RFE #

41 Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum on this topic: /15754/5 41

42 Where do you get more information? Questions on this or other topics can be directed to the product forum: More articles you can review: IBM BigFix in IBM Knowledge Center 9.2/welcome/IEM92_landing.html IBM BigFix wiki on IBM developerworks Endpoint%20Manager Useful links: How to Contact IBM Software Support for IBM Security IBM Support Portal Sign up for My Notifications Follow us: 42

43 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.