Patch Manager PATCH MANAGER 1 Overview... 1 Using the Patch Manager... 7 Using the Patch Manager for Groups... 8 Ignoring Patches... 11 Denying Patches... 12 Removing Patch Approvals from Groups... 12 Applying Patches to Different Groups... 12 Copy Approval from One Group to Another... 13 Daily Approval to an Update Group... 16 Document Revision History... 17 Overview The Patch Manager simplifies the patching process: automatically discovering new updates, detecting missing patches and allowing you to approve and install them in an efficient manner. The Patch Manager has two functional levels: one for groups and one for computers. Group mode will approve and set the patch on the group selected and it will only show patches on that group. In computer mode, you will see the computers and can approve patches directly to that machine. TIP: You can set the Patch Manager to default to a specific group when opening by adding the property DefaultPatchManagementGroup with the groupid as the value. Adding the property will also set the Listing Style to Group Assigned Updates. For more information, refer to the Properties documentation. 5.51.155.PatchManager.docx 1
Patch Manager Figure 1: Patch Manager IMPORTANT: It is important to note when approving or installing patches, if you are in global mode (the Apply to: setting is set to Global ), the selected patch(es) will be approved on all machines with LabTech agents that you have permission to access, NOT a group. 5.51.155.PatchManager.docx 2
Table 1: Field/Menu Options Option Listing Style Missing Updates Missing Critical Updates Detected Updates Detected Critical Updates All Updates Ignored Updates Unapproved Detected Updates Unapproved Detected Critical Updates Unapproved Updates Group Assigned Updates Group Unassigned Updates Operating System Windows 7,Windows Vista, Windows 2008, Windows 2003, Windows XP, 32 Bit OS, 64 Bit OS Category CAPICOM, Critical Updates, Definition Updates, Drivers, Exchange Server, Expression Web 3, Feature Packs, Microsoft Lync, Microsoft Online Services Sign-In Asst., Office, Office Communications Server, Office Description Shows all patches that are missing from one of the computers you have permission to access. Shows all patches that have any severity level and is missing from one of the computers you have permission to access. Shows only patches for computers that you have permission to access. For example, if you do not have access to any Windows 2000 machines, you will not see any patches for Windows 2000. Shows all critical patches (as defined by Microsoft) that have been installed on computers that you have permission to access and were not installed by LabTech. Shows all available patches except detected and ignored patches, if those options are enabled in the Options list. Shows all globally ignored patches and will be excluded from all reports. Shows all patches that are detected on computers you have permission to access, that have not been approved to any group. Shows all critical patches (as defined by Microsoft) that are detected on computers you have permission to access, that have not been approved to any group. Shows all unapproved patches that have not been approved to any group. The difference between unapproved detected and unapproved, is unapproved detected will only display unapproved patches for computers that you are responsible for. The unapproved will show all updates regardless of OS. Shows all updates for the selected group that have been assigned (e.g., approved to install, denied, ignored, etc.) Shows all updates for the selected group that have not been assigned yet. You can filter the list of updates based on operating system. Click on each operating system (a check mark will display) to show that it is included in the filter. Remove the checkmark to eliminate from the filter. You can filter the list of updates based on the category. Click on each category (a check mark will display) to show that it is included in the filter. Remove the checkmark to eliminate from the filter. 5.51.155.PatchManager.docx 3
Patch Manager Communicator, Report Viewer, Security Updates, Service Packs, Update Rollups, Updates Options Detected Patches Hide Ignored Patches Refresh Group Detection Show Missing Automatically Show Only Security Patches Apply to: Apply to: Approve Selected Updates Security Updates in List All Updates in List Assign Deny Selected Updates Ignored Selected Updates Remove Selected Updates Clear Selected Updates Install Selected Updates Will not display detected patches by default. To view detected patches, select Detected Updates from the Listing Style drop-down or if you want to see detected patches for your current listing, remove the checkmark from the Detected Patches option. Returns to the default when Patch Manager window is closed. Will not display ignored patches by default. To view ignored patches, select Ignored Updates from the Listing Style drop-down or if you want to see ignored patches for your current listing, remove the checkmark from the Hide Ignored Patches option. If you change from group to group, use this to refresh the listing. Enable this to automatically load update information in the lower half of the screen (e.g., groups, computer missing updates, etc.). Otherwise, use the Show Missing button to display this information. Enable this to automatically display only security patches. Choose from the drop-down list to apply patch based on groups that are set up or globally to apply to all clients, in all groups, for all machines that the logged in user has access to. It is important to note that the global option while in group mode, will apply directly to the machine not the group. This will approve all selected (highlighted) patches selected in the window. Security Updates in List will only approve those patches with a category of Security Updates This will approve all patches in the list. If the entire list is 15 pages, it will approve all. This will deny all selected (highlighted) patches to the selected group or globally. This will ignore all selected (highlighted) patches to the selected group or globally. This will attempt to remove selected (highlighted) patches from the machines in the selected group or globally, if the update has been installed. This is only applicable if the agent is attached to WSUS server. This will remove any setting on that group or globally, effectively clearing the setting. Installs the selected updates to the selected group or 5.51.155.PatchManager.docx 4
Security Updates in List All Updates in List globally. Column Descriptions (top half of window) KB Article Title Category Missing Update Updates Installed Group Approval Severity Operating System Date Discovered Viewing Options (top half of window) No Filter Search Clear Refresh Options Installs only the updates that have the category Security Updates to the selected group or globally. Installs all updates in the list to the selected group or globally. Displays the KB article number. Click on the magnifying glass to view the details of the article. Displays the patch title. Displays the category the patch is associated with (e.g., security updates, feature packs, updates, etc.) Shows you the number of agents that are missing the update. These values will only count for the group members in the selected group. Displays the number of updates that have been installed. These values will only count for the group members in the selected group. Displays the group approval status (e.g., install, remove, denied or ignored) on the Group Assigned Updates or the All Updates listing. A global status of not applicable indicates that global is selected instead of a group. Displays the severity of the patch based on Microsoft s determination. Displays the operating system the selected patch affects. Displays the date that Microsoft released the patch. You can apply additional filters to the data by selected the desired criteria from the No Filter button. Select the appropriate filter to apply, a checkmark will display to the left of the option and then click the No Filter button. The text will change to Filtered to indicate that the data has been filtered. Click again to show all data. The search feature allows you to search all patches for any criteria (e.g., OS, partial description, severity, etc.). Wildcard search is set by default to allow for wildcards at the beginning and end of your search criteria. You can also set your search to search all columns and to clear the search field when finished by selecting the desired option from the pull-down. Clears the search criteria and returns the default data. The refresh button will only refresh the listing after performing a search and clearing the search criteria. For refreshing group information after changing from group to group, use the Refresh Group Detection under the Options menu. The page size can be modified to show more or less updates on a page. You can change the number using your keyboard (not the number keypad). 5.51.155.PatchManager.docx 5
Patch Manager Column Descriptions (bottom half of window) The auto refresh option can be set for the data to autorefresh every 30 seconds up to 10 minutes. List Settings allow you to set the default settings, to save or clear your custom settings when closing the Patch Manager. Export all to Excel will export the data to an.xls file to be opened by Excel. KB ID Title Description OS Category Severity Update Type Uninstallable Date Added Group window Globally Ignore Show Missing Show All Location Computer Update Approved Update Installed Date Detected Update Day Displays the ID of the KB article. Displays the patch title associated to the KB article. Displays the description of the patch. Displays the operating system the selected patch affects. Displays the category the patch is associated with (e.g., security updates, feature packs, updates, etc.) Displays the severity of the patch based on Microsoft s determination. Displays the type of update that the patch is (e.g., software update, driver update, etc.) Will display yes or no, on whether the patch can be uninstalled once it is installed. Displays the date that Labtech added the patch. This is the white box in the lower right-hand side of the screen. This will show all groups that the selected patch is approved for. You can double-click to remove this group or right-click to select a new group to apply this patch to. If this checkbox is selected, the selected patch is on the global ignore list. If Show Missing Automatically is not enabled under the Options (top half of screen), click the Show Missing button to show the computers that are missing the selected patch. This will only show computers that have you permission to access. Show all will show all of the computers that are missing the selected patch or that have been detected for computers that you have permission to access. Displays the location of the computer that is missing the patch. Double-click to open the Computer screen for the selected computer. Displays the computer name of the computer that is missing the patch. Displays yes or no based on whether the patch has been approved. Displays yes or no based on whether the patch has been installed. Displays the date that LabTech detected the patch. Displays the day that automatic patching takes place. If 5.51.155.PatchManager.docx 6
automatic patching is disabled, this will be indicated. Using the Patch Manager Initially, when you open the Patch Manager, it will show all missing updates for at least one computer that you have permission to access unless you have set the default patch management group. If an update is missing for more than one computer that you have permission to access, you will see the actual number of the missing updates. TIP: You can set the Patch Manager to default to a specific group when opening by adding the property DefaultPatchManagementGroup with the groupid as the value. Adding the property will also set the Listing Style to Group Assigned Updates. For more information, refer to the Properties documentation. 1. You can access the Patch Manager from the Control Center by clicking on Patch Manager from the main toolbar or if you are using the navigation menus, by clicking on Patch Management. Figure 2: Menu Patch Manager NOTE: The list will be sorted by the patch that is missing the most. 2. Select the Listing Style from the drop-down list. The Group Assigned Updates and Group Unassigned Updates options are the only two options that will put you in group mode. All other options will list patches pertaining to the computers in the system (computer mode). To use group mode, refer to the Using the Patch Manager for Groups section. 3. You can narrow your list down even further, if desired. 5.51.155.PatchManager.docx 7
Patch Manager Operating System: Allows you to filter your search results down to the operating system (e.g., show only operating systems Windows 2008 and 64 bit OS). Category: Allows you to filter your search results down to the type of update (e.g., critical, definition, feature packs, security, service packs, silverlight, update rollups and update). 4. From this listing, you can deny, ignore, remove, approve or install patches. Deny: Highlight the patch(es) to deny. Right-click and select Set Deny Patch or select Assign > Deny Selected Updates. Once denied, it will show denied in the computer s Patching tab. Ignore: Highlight the patch(es) to ignore. Right-click and select Set Ignore Patch or select Assign > Ignore Selected Updates. Once ignored, it will show ignore in the Computer s Patching tab. NOTE: You can also globally ignore a patch by right-clicking on the patch and selecting Global Ignore. This will hide the patch from all screens and effectively remove the patch from the system. To remove from global ignore, go to the Ignored Updates' listing and right-click in the Patch Manager window and select Global Ignore Remove. Remove. Highlight the patch(es) to remove. Right-click and select Set Remove Patch or select Assign > Remove Selected Updates. This will cause the patch to be uninstalled if it is already installed, only if the agent is attached to a WSUS server. Removing patches is not recommended. Once removed, it will show remove in the Computer Patching tab. Approve: Highlight the patch(es) to approve. Right-click and select Set Approve Patch or select Approve > Approve Selected Updates. You can also approve just the critical updates or all updates by selecting these options from the Approve menu. If the group is set to Global, the patch will be approved for all computers that you have permission to access. If a group is chosen, then all computers in that group will be approved. NOTE: If you have automatic patching enabled, the approved patches will be installed on the day specified. Automatic patching can be enabled by double-clicking on the client and going to the Info tab and selecting the Enable Patching checkbox and selecting the hotfix window. If you need to install the patch(es) immediately proceed to step 7 in the Using the Patch Manager for Groups section. Please note that if you have a fresh 2012 installation of LabTech, this will be different. Please refer to the Ignite documentation for more information. Install: Highlight the patch(es) to install. Right-click and select Install Patch Now or select Install > Selected Updates. You can also install just the critical updates or all updates by selecting these options from the Install menu. By selecting install, an install command will be issued to install the patches now on the computer. Using the Patch Manager for Groups Group mode will approve and set the patch on the group selected and will only show patches on that group. It is important to note when approving or installing patches, if you are in global mode (Apply to: setting is set to Global, the selected patch(es) will be approved on all machines with LabTech agents, that you have permission to access, NOT a group. 5.51.155.PatchManager.docx 8
TIP: You can limit the number of groups that appear in the Patch Manager to just the original LabTech groups and a patching group, by assigning a group to the Patching type. You can do this by right-clicking on a group and selecting Edit Group. In the Group window, select patching as the Type and click Save. Please note that if this group has sub-groups, their type will also change to patching. For additional information, please see the Group Management documentation. Additionally, you can set the Patch Manager to default to a specific group when opening by adding the property DefaultPatchManagementGroup with the groupid as the value. Adding the property will also set the Listing Style to Group Assigned Updates. For more information, refer to the Properties documentation. 1. You can access the Patch Manager from the Control Center by clicking on Patch Manager from the main toolbar. Figure 3: Menu Patch Manager 2. Upon opening the Patch Manager, all missing updates will display by default. Select the Listing Style from the drop-down list. The Group Assigned Updates and Group Unassigned Updates options are the only two options that will put you in group mode. All other options will keep you in computer mode. 3. If in group mode, select the desired group from the Apply to: drop-down. For example, if you chose Group Unassigned Updates from the Listing Style and chose Windows Updates.Approved from the Apply to: drop-down it will display any unassigned updates for that particular group as shown by the following example. IMPORTANT: It is important to note when approving or installing patches, if you are in global mode (Apply to: setting is set to Global, the selected patch(es) will be approved on all machines with LabTech agents, that you have permission to access, NOT a group. 5.51.155.PatchManager.docx 9
Patch Manager Figure 4: Sample Unassigned Group Updates 4. You can narrow your list down even further, if desired. Operating System: Allows you to filter your search results down to the operating system (e.g., show only operating systems Windows 2008 and 64 bit OS). Category: Allows you to filter your search results down to the type of update (e.g., critical, definition, feature packs, security, service packs, silverlight, update rollups and update). 5. You can deny, ignore, remove or clear updates by selecting the appropriate patch and selecting the corresponding option from the Assign menu. The selected patch(es) will move from the Group Unassigned Updates to the Group Assigned Updates and the Group Approval column will display the appropriate assignment based on what you selected as shown by the following example. NOTE: You can also globally ignore a patch by right-clicking on the patch and selecting Global Ignore. This will hide the patch from all screens and effectively remove the patch from the system. To remove from global ignore, go to the Ignored Updates' listing and right-click in the Patch Manager window and select Global Ignore Remove. 5.51.155.PatchManager.docx 10
Figure 5: Patch Manager Group Approval Denied NOTE: To clear from the assigned updates if you made a mistake, select the appropriate patch, and select Clear Selected Updates from the Assign menu. The patch will be moved back to the unassigned updates list. 6. The next step is to approve. There are a few different methods to approve patches: Approve individually: To approve individually, right-click on each individual patch and select Approve. Approve Selected Updates: Highlight the patch(es) you want to approve and select Approve Selected Updates from the Approve menu. Approve All Critical Updates in List: To approve all patches that are critical as defined by Microsoft (security updates), select Approve All Critical Updates from the Approve menu. Approve All Updates in List: To approve all patches in the list, select Approve All Updates in List from the Approve menu. NOTE: If you have automatic patching enabled, the approved patches will be installed on the day specified. Automatic patching can be enabled by double-clicking on the client and going to the Info tab and selecting the Enable Patching checkbox and selecting the patch window. If you need to install the patch(es) immediately proceed to step 7. Please note that if you have a fresh 2012 installation of LabTech, this will be different. Please refer to the Ignite documentation for more information. 7. The Install menu works the same way as the Approve menu, but issues an install command to install the patches right NOW on the computer. If a group is selected then only the members of the group will be issued the install command. Remember, that if global is selected then it will attempt to install on all computers. Ignoring Patches To ignore patches, right-click on a patch and select Set Ignore Patch. This will ignore the patch on the group level. If global is selected from the Apply to: it will ignore the patch for all computers that you have permission to access. If you are in group mode and you select Set Ignore Patch is selected, it will ignore the patch for that group. 5.51.155.PatchManager.docx 11
Patch Manager The patch will not display in the current listing if the Hide Ignored Patches is selected from the Options menu. By default, Hide Ignored Patches will always be selected. If Global Ignore is selected, it will ignore that patch for everything (all groups and all computers). If a patch has been globally ignored, the Global Ignore checkbox in the bottom half of the window will be selected. All globally ignored patches can be viewed under the Ignored Updates Listing Style. Right-click on patch and select Global Ignore Remove or uncheck the Global Ignore checkbox to remove the global ignore. Denying Patches To deny patches, right-click on a patch and select Set Deny Patch. The patch is removed from the current listing. This is used to set the patch approval policy by denying a patch and not counting the patch as missing. Removing Patch Approvals from Groups When you select a patch, the patch information will display in the lower-half of the window, including the group that this patch has been applied to, if any. You can find the group in the lower right-hand corner of the screen. In the example shown below, this patch was applied to the Windows Updates. Approved group. To remove this patch approval from this group, double-click on the group. Figure 6: Patch Applied to Group Applying Patches to Different Groups When you select a patch, the patch information will display in the lower-half of the window, including the group that this patch has been applied to, if any. You can find the group in the lower right-hand corner of the screen. In the example shown below, this patch was applied to the Bronze service plan. 5.51.155.PatchManager.docx 12
Figure 7: Patch Applied to Group 1. Right-click in the group box to select a different group. The list of groups will display, select the desired group to apply this patch to. This will add the selected group to any groups already listed in this box as shown by the following example. Figure 8: Applying Patch(es) to Multiple Groups Copy Approval from One Group to Another 1. From the Group Assigned Updates, select the group you want to copy from the Apply To: drop-down. In this example, we want to copy the approval from the Windows Updates.Approved group. 5.51.155.PatchManager.docx 13
Patch Manager Figure 9: Group Assigned Updates Windows Updates.Approved Group 2. You will be prompted to reload the patch list. Click Yes. Figure 10: Reload Patch List 3. Select the group you want to copy TO. 5.51.155.PatchManager.docx 14
Figure 11: Copy Approval from One Group to Another 4. Click No when prompted to reload patch list with selected group. 5. Select Approve > All Updates in List. The settings will be applied to the selected group. Figure 12: Settings Applied to Patch 6. Click OK to close this message. 5.51.155.PatchManager.docx 15
Patch Manager Figure 13: Approval Applied to Multiple Groups The group you copied the approvals to will now show up in the Group box in the bottom half of the Patch Manager window as shown in the above example. Daily Approval to an Update Group 1. From the Group Unassigned Updates, select the patch approval group you use (e.g., Windows Updates.Approved). This will display all updates that are detected on the computers and are NOT approved for this group. 5.51.155.PatchManager.docx 16
Figure 14: Group Unassigned: Patch Approval Group 2. Select Approve > Critical Updates in List or Approve > All Updates in List depending on your patch approval policies. You also have the option to go through the list and approve each patch manually after evaluating them. TIP: By approving the critical or all updates the list should be empty when you are done, and the next time you access this window you will only have new items to tend to. Document Revision History Date Notes 04/07/ 2011 New in 2011 release 08/01/ 2011 Updated for 2011.2 release. Missing and Installed values will count for only the group members in a selected group. 03/19/2012 Updated for 2012. Added DefaultPatchManagementGroup property information. 03/08/2013 Updated Remove Selected Updates to indicate that this is only applicable if the agent is attached to a WSUS server. 5.51.155.PatchManager.docx 17