Providing Patch Management With N-central · Providing Patch Management With N-central Technical documentation for using N-central to administer patch management

Providing Patch Management with N-centralVersion 10.1

- 2 -

Contents

Patch Management Overview 4

Microsoft Windows Patch Management 4

Third-Party Patch Management 5

Patch Caching 10

Patch Management Profiles 11

Patch Management Profile Settings 12

Patch Setup Wizard: Overview 16

Patch Setup Wizard: Profile Configuration 17

Patch Setup Wizard: Detection 18

Patch Setup Wizard: Pre-Download 19

Patch Setup Wizard: Installation 20

Patch Setup Wizard: Reboot 21

Patch Setup Wizard: Rule Configuration 23

Patch Setup Wizard: Summary 24

Configuring Devices for Patch Management 25

Approving and Declining Patches Manually 27

Approving by Device 28

Approving By Patch 30

Filtering in the Patch Approval Wizard 32

N-central 10.1 Providing Patch Management with N-central

- 3 -

Filtering on sections 32

Filter using text 32

Automatic Approval to Rules 33

Patch Management Reporting 37

N-central Reports 37

Report Manager Reports 37


- 4 -

Patch Management Overview

N-central includes a patch distribution andmanagement solution that lets you tailor service offerings tothe needs of your customers.

Patch management involves configuring the followingmaintenance windows individually for one ormore devices:

l Detectionl Pre-downloadl Installationl Reboot

You can also use the Patch SetupWizard to guide you through configuring a new Profile, configuring thepatch maintenance windows, and packaging the configuration into a completed Rule. See Patch SetupWizard: Overview on page 16 for details.

This section provides best practices for Patch Management.

Microsoft Windows Patch ManagementThis section addresses Microsoft Windows considerations.

Managing Windows Updates1. The Windows Agent communicates with Microsoft Windows Updates and requests a list of available

updates.

2. The Windows Agent transmits this information to the N-central server.

3. The N-central administrator configures approvals for the list of updates.

4. The Windows Agent communicates with the Probe and requests the approved updates.

5. The Probe downloads the updates.

6. The Windows Agents downloads the updates from the Probe.

7. The Windows Agent applies the schedule for installing updates.

Limitations and Restrictions Affecting Windows Patch Managementl You must upgrade both the N-central server andWindows Agents to version 9.2 or later. ThePatch Status, CPU, Memory and Process services will report aMisconfigured status if you havenot upgraded.


- 5 -

l Because Windows, Mac and Linux agents are automatically updated, the Patch Status, CPU,Memory and Process services will automatically transition from aMisconfigured state to aNormal/Warning/Failed state.

l After you upgrade to N-central 9.2 or later, review all previously-configured Patch Managementprofiles. There are new settings in profiles you must configure before Patch Management will workproperly.

l To approve or decline patches with devices that have not yet upgraded their Agents to Version 9.2or later, sign in directly to the appropriate WSUS server and approve or decline patches there.

Microsoft Patch Management in N-centrall N-central does not support uninstalling Microsoft patches for Windows Vista and Server 2008.l For devices usingWindows 8,Windows 10, andWindows Server 2012 operating systems, FlashActiveX is treated as aWindows Feature Update. Use Microsoft Patch Management to approve ordecline Flash ActiveX updates for these devices.

l If Internet Explorer updates andWindows Updates are not current on devices runningMicrosoftWindows XP Service Pack 3, reporting in N-central can take excessive amounts of time and sys-tem resources.

l WinZip is no longer supported on devices usingWindows XP or Windows Server 2003. Third-partypatch management cannot update WinZip on those devices.

Third-Party Patch ManagementThis section addresses third-party considerations.

Third-Party Patch Pop-ups and Updates Summary

VendorApplicationName

Description LocalizationDisables pop-ups

Preventsinternetupdates

Adobe Adobe AcrobatX

None

Adobe Adobe AcrobatXI

None

Adobe Adobe ReaderMUI

None N/A, in-appnotificationsare stopped

Yes

Adobe Adobe Reader EN,FI,NL,SV,DE Yes Yes

Adobe AdobeAIR Disables in-app updaterthrough the registry.


Yes

Adobe Flash ActiveX None Yes Yes


- 6 -




Adobe FlashPlugin None Yes Yes

Adobe Shockwave Disables in-app updaterthrough the registry.

None Yes Yes

Apple iTunes Disables in-app updaterthrough the registry.


Yes

Apple QuickTime None

Apple Safari None

Foxit Foxit Enter-prise Reader

EN

Google Chrome Turns off Google Updaterapplication.

None N/A, the auto-update is silent

Yes

Google GoogleEarth Turns off Google Updaterapplication.

None Yes Yes

Mozilla Firefox EN,FI,NL,SV

Mozilla SeaMonkey EN

Mozilla Thunderbird EN

Notepad++ Notepad++ None

Opera Opera None

Opera Opera Chro-mium

None

Skype Skype None

Sun Java_6_32 Turns off the entire javaupdate mechanism throughthe registry.

None Yes Yes

Sun Java_6_64 Turns off the entire javaupdate mechanism throughthe registry.

None Yes Yes


- 7 -




Sun Java 7 Turns off the entire javaupdate mechanism throughthe registry.

None Yes Yes

Sun Java 8 Turns off the entire javaupdate mechanism throughthe registry.

None Yes Yes

VLC VLCMediaPlayer None

WinRAR WinRAR None

WinZip WinZip Disables in-app updaterthrough the registry.

EN,ES,DE,NL N/A, in-appnotificationsare stopped

Yes

If a Probe has patch caching enabledWhen patch caching is enabled, the Probe must have full access to web sites so that it can downloadinstallation software. In this configuration, Agents only require access to the Server In The Sky.

For Third Party Patch Management to function properly, your network firewall must be configured toallow access to the followingweb sites:

Device Type Vendor - Web Site URL

Device with Probe l Server In The Sky (SIS) - http://sis.n-able.coml Adobe Acrobat - http://ardownload.adobe.coml Adobe Reader - ftp://ftp.adobe.com/l Adobe Air - http://airdownload.adobe.com/l Apple Products - https://secure-appldnld.apple.coml Flash - http://download.macromedia.com/l Foxit - http://cdn01.foxitsoftware.com/l Google Products - https://dl.google.coml Java - http://javadl.sun.com/l Mozilla Products - https://download-installer.cdn.mozilla.netl Notepad++ - http://download.tuxfamily.org/l Opera - http://get.geo.opera.com/l Shockwave - http://www.adobe.com/l Skype - http://download.skype.com/l WinRAR - http://www.rarlab.com/l WinZip - http://download.winzip.com/l VLC - http://download.videolan.org/

Device with Agent l Server In The Sky (SIS) - http://sis.n-able.com


http://sis.n-able.com/

http://ardownload.adobe.com/

ftp://ftp.adobe.com/

http://airdownload.adobe.com/

https://secure-appldnld.apple.com/

http://download.macromedia.com/

http://cdn01.foxitsoftware.com/

https://dl.google.com/

http://javadl.sun.com/

https://download-installer.cdn.mozilla.net/

http://download.tuxfamily.org/

http://get.geo.opera.com/

http://www.adobe.com/

http://download.skype.com/

http://www.rarlab.com/

http://download.winzip.com/

http://download.videolan.org/


- 8 -

If no Probes have patch caching enabled

Device Type Vendor - Web Site URL

Device with Agent l Server In The Sky (SIS) - http://sis.n-able.coml Adobe Acrobat - http://ardownload.adobe.coml Adobe Reader - ftp://ftp.adobe.com/l Adobe Air - http://airdownload.adobe.com/l Apple Products - https://secure-appldnld.apple.coml Flash - http://download.macromedia.com/l Foxit - http://cdn01.foxitsoftware.com/l Google Products - https://dl.google.coml Java - http://javadl.sun.com/l Mozilla Products - https://download-installer.cdn.mozilla.netl Notepad++ - http://download.tuxfamily.org/l Opera - http://get.geo.opera.com/l Shockwave - http://www.adobe.com/l Skype - http://download.skype.com/l WinRAR - http://www.rarlab.com/l WinZip - http://download.winzip.com/l VLC - http://download.videolan.org/

Notes:

l Third-party software patches are not incremental. If you configure a third-party patch asApproved for Removal,N-central will remove the entire application from the device, not justthe software patch.

l Some software patches require that the target device be re-started in order to complete theinstallation. Until the target device is re-started, patches will be reported asApproved but notinstalled even after installation.

l Software patches cannot be installed on the following third-party applications when the applic-ation is running Chrome, Java, Opera, Safari or Skype. To avoid the failure of installing third-partysoftware patches because of this issue, log out the local users before attempting to install thepatches.

Managing Third-Party Updates1. The Windows Agent downloads a list of third-party applications from the Probe and compares that list

to the third-party applications that are installed on the device.

2. The Windows Agent then transmits to N-central a list of the third-party applications that could beupdated on the device.

3. The N-central administrator configures approvals for the available patches.

4. The Windows Agent communicates with the Probe and requests the approved software patches.

5. Upon receiving the request, the Probe downloads the patch from the software producer.



http://ardownload.adobe.com/

ftp://ftp.adobe.com/

http://airdownload.adobe.com/

https://secure-appldnld.apple.com/

http://download.macromedia.com/

http://cdn01.foxitsoftware.com/

https://dl.google.com/

http://javadl.sun.com/

https://download-installer.cdn.mozilla.net/

http://download.tuxfamily.org/

http://get.geo.opera.com/

http://www.adobe.com/

http://download.skype.com/

http://www.rarlab.com/

http://download.winzip.com/

http://download.videolan.org/

- 9 -

6. The Windows Agents then downloads the patch from the Probe.

7. The Windows Agent applies the schedule for installing software patches.

Monitoring for Missing PatchesWhen an Windows Agent is installed on a device, the Patch Status service is automatically added to thatdevice. The Patch Status service queries the Windows Update Agent (WUA) on the device to determinethe Microsoft and third-party application patches that are missing.

The Patch Status service returns key information:

l total number of missing patchesl number of patches installed with errorsl missing patches by categoryl missing patches older than a user-specified number of days

Viewing Installed PatchesThe Agent will automatically discover all installed patches on the device when the Agent is first installedas well as when the Agent runs its daily asset discovery. This includes patch details, installation date, andinstallation status. This information is then made available in the N-centralAsset tab and in the MissingPatches (Detailed) Report and Patch Installation Status Report.


- 10 -

Patch Caching

After checking and disabling existing group policies for patching (link to best practices) the next step forpatch management in N-central is to ensure that a patch cache is set upwith the correct cachingdestination and enough space for caching tomeet your needs.

A patch cache is typically one of the probes or the only probe in your customer's environment. This localprobe cache is used as a staging point, allowing N-central to save bandwidth and time by organizing thedownload of needed patches to a single location and then sending them to all your user's devices.

Maximum Patch Cache SizeTypically the 20 GB default will be adequate. However, if you have a large environment or anenvironment where a number of devices are roaming in and out, you may want to increase the cachesize to 30 or 40 GBs, if you have the space. This will ensure that required patches will be available whenthe roaming devices check back in after a few weeks.About Cache LocationThe location, which can beany UNC path in your environment, must be able to accommodate a large volume of dataIf you changethis location after configuring Patch Management, the change takes place immediately after savingwithout any delay. Changing this location more than once may cause patching issues.

Note: If you have only a small group of devices you do not need a probe cache. In that case, you can setup a patch profile that instructs devices to to go directly to Windows Update for their patches. Formore information, refer to Patch Management Profiles on page 11.

To check and update probe cache settings

1. At the SO or customer level, navigate to Configuration > Patch Management> Caching toopen the Probes page.

2. Locate the icon in the Patch Caching column. This icon identifies a local probe with cachingenabled.

3. Hover over the icon for the probe to display the probe'sMaximum Patch Cache Size andCache Location.

4. If you would like to change the size of the repository or the destination, click the probeName toopen the Edit Probe page.

5. Click the Caching tab.

6. Under Patch Data Persistence, edit theMaximum Patch Cache Size andCache Location set-tings as required.


- 11 -

Patch Management Profiles

Patch Management Profiles let you re-use the same settings across multiple customers or sites.

Note the following best practices for Patch Management Profiles:

l Disable any group policy objects that configure Windows Update as they will conflict with the N-central settings.

l Create a minimum of three patch profiles: one for Laptops, one for Workstations and one for Serv-ers.

l Configure the default Patch Management Profile at the Service Organization level so that it can bereplicated across multiple customers.

Adding a Patch Management Profile

Note: You can also create a Patch Management Profile using the Patch SetupWizard. See Patch SetupWizard: Overview on page 16 for details.

1. In the navigation pane, click Configuration > Patch Management > Profiles.

2. Click Add in the Profiles screen.

3. Define the profile settings as required in the Add Profiles screen. See Patch Management ProfileSettings on page 12.

Cloning a Patch Management Profile


2. Select the profile you want to duplicate in the Profiles screen.

3. Click Clone.

4. Type a descriptiveName to identify the profile.

5. In theDescription field, type additional information about the profile.

Editing a Patch Management Profile


2. Click the name of the profile that you would like to edit in theName column of the Profiles screen.

3. Update the profile settings as required in the Edit Profiles screen. See Patch Management ProfileSettings on page 12.


- 12 -

Viewing Rules and Devices Associated to a Patch Management Profile


2. Click the name of the profile for which you would like to view all associations in theName column ofthe Profiles screen.

3. Click the Associated Rules tab in the Edit Profiles screen.

Note: At the Customer or Site level a list of SO Level Rules is also displayed. Click Clone besidethe appropriate rule to create a duplicate for your own use.

Deleting Patch Management Profiles

Note: Be cautious when you do this as devices will need to use an existing Profile if they are to receivedeployed patches. If you try to delete a Profile that is currently being used by one or moredevices, you will be warned that it is an active Profile. You may then either cancel the deletion orspecify a replacement Profile to be applied to those devices that are using the Profile.

To delete a Patch Management Profile


2. Select the check box next to the profile that you want to delete in the Profiles screen. Select thecheck box in theName column to select all profiles.

Patch Management Profile Settings

Note: When using the Patch SetupWizard, you cannot edit an existing profile from the Wizard. Do thisby Editing a Patch Management Profile on page 11.


- 13 -

Property Description

Pop-up MessagesYou can configure whether or not the Windows agent will display a message to the user to let them know thatpatches will be installed at a certain time. You have the options to not show amessage at all, display only amessage to Administrators or to display messages to all user accounts. You can also configure how much timebefore the patch is scheduled to show the message, and if the user dismisses the message, how often to repeatthe message.

This message will not delay the patch.

Show messages to Administrators Configures the Agent on the device to displaymessages related to patch management for logged-inusers with Administrator privileges.

Show messages to Users Configures the Agent on the device to displaymessages related to patch management for logged-inusers with standard user privileges.

Installing updates - Installing <x> updates.

Show messages before the patch is scheduledto be installed

Configures messages to be displayed prior to thescheduled installation date and time of softwarepatches. The user will have the option to install thepatches immediately instead of waiting for thescheduled date and time.

New updates are ready to install - There are <x>updates scheduled to be installed on dd/mm/yyyyhh:mm. Click here to install updates now.

Repeat messages if dismissed every Selects a time interval (in minutes) during whichpatch management pop-up messages will bedisplayed.

Communicate Externally for UpdatesThis feature is very useful for mobile devices like laptops that are frequently outside the corporate network andcan't access the probe. Through this feature, you can ensure that roaming devices can still download and installpatches.

By default this is turned off.

Download updates directly from externalsources as needed

Configures the Agent on the device to downloadsoftware patches directly fromWindows Update if it isunable to connect to the Windows Probe. For example,if the device is a laptop computer and is in a differentlocation.


- 14 -


Time to try to reach a probe cache before usingexternal resources

Selects a time interval (in minutes) before the Agentwill attempt to download software patches directlyfromWindows Update.

Install Missed Patches on Next Boot Up

Force missed patch installation on boot Allows installation of approved patches for any devicethat has missed a scheduled installation time. Formore information on patching a device on boot, seePatch on Boot.

Time to wait before installing the patches Time in minutes to wait after a device is online beforeinstalling patches.


- 15 -


Windows Update Access

Windows Update access is Select one of the following settings to restrictWindows Update access to the device during patchinstallation:

Allowed for all User accounts and Applications—This setting is the default setting. It will allow deviceaccess to Windows Update for all account levels andapplications.

Limited to Administrators and Applicationsonly—This setting will restrict device access toAdministrator-level accounts and applications.

Restricted to N-central activity only—This settingis the most restrictive. This blocks device access 97%of the time if you are using a typical weekly patchschedule.

It opens for the following N-central activities:

l It will open briefly to allow access to Admin-istrators and applications when N-centralperforms patch-related tasks such as install-ations and new patch detections.

l It will also open during daily asset scans.

Depending on the activity, access to the device may beallowed for 5 minutes or up to an hour.

Best practice: As much as possible, patch activityshould be scheduled outside of customer core hours.

Installing Patches When the Device is Powered Off

Automatically wake up system for patchinstallation

This option allows you to power on the machine if it isasleep or in hibernation in order to "wake up" aWindows device (even if it is in hibernation) in orderto install software updates.

Associated RulesThis feature allows you to select the Rules that will be associated to this patch profile.

You can select the node and all the rules under it, System, SO or Customer depending on yourpermissions. You can also expand each node to review and select individual Rules.


- 16 -

Patch Setup Wizard: Overview

The Patch SetupWizard will help you configure many of the components you will need for N-centralPatch Management quickly and easily.

The Patch SetupWizard guides you through choosing or creating a new Profile, configuring patch(maintenance) windows, and packaging the configuration into a completed Rule.

Note: You cannot edit an existing Profile using the wizard.

The wizard includes seven (7) tabs in the order shown here:

1. Profile Configuration2. Detection3. Pre-Download4. Installation5. Reboot6. Rule Configuration7. Summary

Read the description along the top of each page, configure the component as you wish, and clickNEXTat the bottom.

Note: You can skip all but the first tab. Skipped configuration settings will not be included in the Rule.

Default schedules have already been added in some of the maintenance windows. You can adjust theseas necessary.

The navigation bar at the top of the screen indicates where you are in the setup process. You may clickthrough the completed steps in any order to review your configuration.

Nothing in this wizard will be saved and committed to a Rule until the final screen where you click theFINISH button.

To begin the Patch SetupWizard, in the Navigation pane go to Configuration>PatchManagement>Patch Setup Wizard.


- 17 -

Patch Setup Wizard: Profile Configuration

The Profile Configuration tab lets you configure a new Profile, or to use an existing one.

See Patch Management Profile Settings on page 12 for descriptions of the configurable fields on this tab.

Note: You cannot edit an existing profile from the Patch SetupWizard.

From here you can configure the following:

l Your Profile Name.l How your devices will communicate with end users.l How your devices will communicate with external sources.l How to react if patches are missed.l What kind of access local users will have toWindows Update.l How to handle patches if a device is turned off.

Co n s i d er creat i n g a m i n imum o f th ree p at ch p ro f i l es :

l one for Laptopsl one for Workstationsl one for Servers

Each of these types of devices often require different settings.


- 18 -

Patch Setup Wizard: Detection

TheDetection tab lets you configure a patch Detection Window. This window determines when yourend user devices will check with Windows Update for new patch data and update the Patch Statusservices in N-central.

Detection should be scheduled to occur two or more of times per day, during less busy hours. This isespecially important for workstations and servers hosted in virtual environments, because devicerequests for patch detection on virtual machines will result in cumulative load and can result in slowerperformance overall.

The table below describes the configurable fields on this tab.

Enable this MaintenanceWindow

Select whether or not to enable a patch detectionschedule.

Maintenance Windowshould last for

Configures the window of time in which yourdevices can initiate a detection of new patches.

Schedule Configures the date and time interval when theAgent on the device will check for availablesoftware patches from one of the following:

l Customl Hourlyl Monthly

Start Time Selects when the Agent will check for softwarepatches.

If an Hourly schedule is configured, use repeatevery <x> hours to define an interval when theAgent will again check for patches.

If Custom or Monthly schedules are configured,select an additional time and click Add to definean interval when the Agent will again check forpatches by.

Click Delete to remove a start time.

Click Clear All to remove all start times.

Days of the Week The days in each week on which you would like theAgent to check for software patches.

Days of the Month The days in each month on which you would likethe Agent to check for software patches.

Months of the Year The months in which you would like the Agent tocheck for software patches.


- 19 -

Patch Setup Wizard: Pre-Download

The Pre-download tab lets you configure your Pre-DownloadWindow to download devices approvedpatches ahead of your installation schedule to speed up your install. For example you may choose to pre-download the approved patches on Wednesday night and install them Thursday morning.



Select whether or not to enable a patch pre-download schedule.

When to pre-download Select whether to pre-download patches as soonas they are approved, or only at a scheduled time.


Configures the window of time in which yourdevices can attempt to pre-download patch data.

Schedule Configures the date and time interval when thepatch is downloaded and stored on the devices,from one of the following:


Start Time Selects when software patches will be downloadedand stored on the devices.

If an Hourly schedule is configured, use repeatevery <x> hours to define an interval when thepatches will be downloaded.

If Custom or Monthly schedules are configured,select an additional time and click Add to definean interval when patches will be downloaded.



Days of the Week The days in each week on which you would like todownload patches.

Days of the Month The days in each month on which you would like todownload patches.

Months of the Year The months in which you would like to downloadpatches.


- 20 -

Patch Setup Wizard: Installation

The Installation tab lets you choose when end user devices will begin to install patches. They caneither be installed as soon as they are approvedwith noWindow or at a scheduled time.

Note: Be sure to schedule your installation with a suitable amount of time after a detection and anypre-download cycles to give them a chance to complete first.


When to install patches Configures the Agent on the device to installpatches as soon as they are approved, or only at ascheduled time.


Configures the window of time in which yourdevices can attempt to install patches.

Note: Once one full patch install cycle completesthe window is over.

Schedule Configures the date and time interval when theAgent on the device will install available softwarepatches, from one of the following:


Start Time Selects when Agent will install the softwarepatches.

If an Hourly schedule is configured, use repeatevery <x> hours to define an interval when theAgent will again check for patches.

If Custom or Monthly schedules are configured,select an additional time and click Add to definean interval by when the Agent will again check forpatches.



Days of the Week The days in each week on which you would likeAgent to install software patches.

Days of the Month The days in each month on which you would likeAgent to install software patches.

Months of the Year The months in which you would like the Agent toinstall software patches.


- 21 -

Patch Setup Wizard: Reboot

The Reboot tab lets you configure a Reboot Window that determines when and how a device will rebootif an installed patch requires it.

UsingReboot Options, you can choose to allow the users to postpone a reboot beyond theMaintenance Window you have set. Once the user no longer responds to the delay request, or choosesto allow rebooting to occur, the device will restart.

If you choose to force the user to reboot in the Maintenance Window, the user will be able to delay rightup until the end of the Window, at which time the system will carry out a restart.

Under Reboot Schedule you will have the options to allow the system to begin a reboot cycleimmediately when it is required, or to schedule a time to commence a reboot.



Select whether or not to allow a reboot after apatch has completed installation.

Reboot Options

Reboot Method Select whether or not to allow a user to postponereboot beyond the maintenance window or, forcethe user to reboot in the maintenance window.

Prompt and countdownfor

A prompt will be presented to your end userinforming them that a reboot has been scheduled.The time you enter here will determine how longthat prompt will be shown before the systemcontinues with its reboot.

Message from/ Message Configures if a default message is composed, andif it is sent from the default account.

Place device in downtimeduring reboot

Select whether or not to place the re-bootingdevice into downtime.

Once a reboot has been completed, the device willbe brought out of downtime.

Save current systemstate

Select whether or not to save the current systemstate of the device.

This option will attempt to save the desktop stateof current Windows OS's including openapplications and folders.

Reboot Schedule


- 22 -

When to reboot Select whether to prompt for the device to rebootimmediately when required, or only at a scheduledtime.


Configures the duration of the maintenancewindow.

Schedule Configures the date and time interval when thedevice reboots, from one of the following:


Start Time Selects when the device reboots.

If an Hourly schedule is configured, use repeatevery<x> hours to define an interval when thedevice reboots.

If Custom or Monthly schedules are configured,select an additional time and click Add to definean interval when the device reboots.



Days of the Week The days in each week on which you would like toreboot the device.

Days of the Month The days in each month on which you would like toreboot the device.

Months of the Year The months in which you would like to reboot thedevice.


- 23 -

Patch Setup Wizard: Rule Configuration

The Rules Configuration tab lets you:

l Name your Rulel Provide a description of the rule.l Enable or disable third-party patching.l (Optional) Select Filters that target devices on which you want to configure Patch Management.l (Optional) Select Customers and Sites that target environments you want this new Rule to affect.

Note: You can skip these optional items f you do not want the Rule to go into immediate effect. If youskip these, you will need to edit your Rule after the wizard is completed to add a Filter andCustomers. Rules can be found under Configuration > Rules.


- 24 -

Patch Setup Wizard: Summary

The Summary tab lets you review your schedules and Rule settings. You will be presentedwith theoption to EDIT the Rule directly, or to simply EXIT back to the All Devices view.

Note: The Patch management schedule can be edited at any time through the newly created Rulefound under Configuration > Monitoring > Rules under the Maintenance Window section ofthe Rule.


- 25 -

Configuring Devices for Patch Management

Patch management for your managed devices is performed primarily through Probes and Agents. It canbe configured by editing devices, or by configuring Patch Management options through a Rule. It isrecommended you turn on andmanage Patching through Rules (see: Patch SetupWizard: Overview onpage 16).

To edit devices for Patch ManagementNote: The following procedure can only be performed at the Customer or Site-level. Select the

appropriate Customer or Site in the View Selection Menu to continue.

1. Click All Devices view in the navigation pane.

2. In the All Devices view screen, perform the following:

l For a single device, click the device that you would like to edit in theName column.l For multiple devices, select the checkbox beside each of the device names you wish to editand click Edit.

3. Under Patch Management, select Enable Patch Management.

4. From the Select Patch Management Configuration Profile drop-down list, select theprofile that you want to be applied to the device (or devices).

Note: You can Add a new profile or View/Edit profiles to ensure that the correct one isselected.

5. Select Enable Third Party Patching to manage non-Microsoft software patches.

6. ClickOK.

The device properties are updated and the All Devices view screen appears.

Note: You can click Save to apply the settings and remain on the current screen.


- 26 -

To enable Patch Management using RulesNote: This procedure can only be performed at the SO or Customer-level.

1. In the navigation pane, click Configuration >Monitoring > Rules.

2. In theName column of the Rules screen, click the Rule that you would like to edit.

3. In the Edit Rule screen, select theNetwork Device Configuration Options tab.

4. Under Patch Management, select Enable Patch Management.

5. From the Select Patch Management Configuration Profile drop-down list, select theprofile that you want to be applied to the devices associated with the folder template.

6. Select Enable Third Party Patching to manage non-Microsoft software patches.

7. Click Save.

Note: This operation can also be carried out at the Customer level for individual Rules.


- 27 -

Approving and Declining Patches Manually

You can approve and decline patches manually through the Patch Approval Wizard. This allows you toapprove patches and updates that are not captured by automatic approval rules.

You can also approve and decline patches through the Actionsmenu on the left side of the N-centralscreen.

Warning! Third party software patches are not incremental. This means that configuring a third partypatch asApproved for Removal in N-central will remove the entire application from thedevice and not just the software patch itself.

Note: Patch removal cannot be performed on Windows devices that use Windows XP,Windows Vista,Windows 2003,Windows 2008, or earlier versions of the Windows operating system. Patchremoval can be performed on Windows devices usingWindows 7,Windows 8,Windows 2008 R2,Windows 2012, or later versions of Windows.

About Patch Status and Approval valuesThe Status of each patch will be a combination of the individual Status values of that patch acrossall applicable devices. The combined Status value can be one of the following (listed in order ofimportance):

1. Failed2. Needed3. Installed4. Not Needed

The highest-ranked of these statuses found on any applicable device will be reported as thecombinedStatus for the patch. For example, if one device had a status of Failed for this patch,while two other devices have a status of Needed for this patch, the patch would have an overallcombinedStatus of Failed.

The Existing Approval value of each patch will be a combination of the individual Approval valuesof that patch across all computer groups. The Approval values are combined as follows:

l Approved for Install + Approved for Removal = Mixedl Approved for Install + Declined = Mixedl Approved for Removal + Declined = Mixedl Approved for Install + Not Approved= Approved for Installl Approved for Removal + Not Approved= Approved for Removall Declined + Not Approved= Declined


- 28 -

Approving by DeviceApproving patches by device By Device allows you to approve patches with granularity. When you clickBy Device, the wizard starts on the device screen displaying a list of all Microsoft Windows systems thathave Patch Management enabled on their devices.

It is recommended you manage Patching through Rules, and use device level approval only for specificexceptions.

1. In the navigation pane, click Configuration > Patch Management > Approve/DeclinePatches.

2. Select By Device to open the Wizard on theDevices screen, which shows a list of systems withPatch Management enabled.

3. On theDevices screen, select the devices you would like to patch.

4. ClickNext.

The Patches screen displays the patches that are relevant to the systems you picked. Patchesare added to the list when devices make queries to Microsoft Update.

5. Select the Show Device Counts check box at the top of the screen to identify which patches arecurrently outstanding.

Outstanding patches are those that have an Existing Approval status ofNo Approval, whichmeans no approval decision has been made.

Note: Some patches with an Existing Approval ofApproved for Install,Mixed, orDeclinedmay have some devices still needing those patches listed underneath them that have notbeen approved. UsingShow Device Counts will clarify this situation.

6. On the right-hand side of the screen, select Show Filter. You can use the filter to identifypatches by classification that may not have automatic approval, such as Drivers, for example.

7. In the filter, select the Classification andStatus. For example, "Drivers" and "Needed".

8. For the Approval status, select both Mixed andNot Approved patches.

Mixed includes the following:l Approved for Install + Approved for Removall Approved for Install + Declinedl Approved for Removal + Declined

9. If you think you or a technician might use this filter again, click Save and type aName for the fil-ter. The filter will be available in the drop-down for future use.


- 29 -

10. From the list of patches on the main screen, select the check boxes for the ones that you wouldlike to install.

11. ClickNext for Approvals.

a. To change the approval for all devices in a node, underNew Approval, click the pencilicon ( ) to select the new approval property.

b. To change the approval at a more granular level, expand the node to reveal the cus-tomer and devices under this customer. This will allow you to set approvals for only thosedevices.

Select an New Approval from the following options:

l Not Approvedl Approved for Installl Approved for Removall Declinedl No Approvall Revertl Revert Childrenl Revert Current Node and Childrenl Apply to Children

Warning! Third party software patches are not incremental. This means that configuring a thirdparty patch asApproved for Removalwill remove the entire application from thedevice and not just the software patch itself.

Note: Perform Action Immediately is not recommended. Use this option only if you areapproving one or two critical patches. This option will start patching immediately andignore your patching schedule. Patching schedules are typically set up through Profiles tominimize daytime bandwidth load.

12. ClickNext.

13. If applicable, the EULA screen will open.

a. In the EULA column, click Read to review the End User License Agreements for applic-able software patches.

b. When the EULA is displayed, click Accept orDecline in the dialog box to indicate accept-ance or refusal of the agreement. You can also select the check box next to the patch (orpatches) to accept a EULA without displaying it.

Tip: You can select the check box next to Patch Name to indicate acceptance of theEULAs for all of the patches.


- 30 -

14. ClickNext for the Confirmation screen.

15. Review the list of approvals to confirm that the configuration is correct.

16. Click Finish in the Confirmation screen.

Note: At any time during the Patch Approval Wizard, you can click Previous to review previousstages of the procedure. To start the wizard over again and remove all current settings, clickStart Over.

Approving By PatchApproving patches by patch allows you to approve or decline patches through Rules associated todevices. The devices themselves are not shown.

1. In the navigation pane, click Configuration > Security Manager > Profiles. PatchManagement> Approve/Decline Patches.

2. Select By Patch to open the Wizard on the patches screen showing all patches available todevices, based on associated Rules.

3. Select the Show Device Counts check box at the top of the screen to identify which patches arecurrently outstanding.

Outstanding patches are those that have an Existing Approval status ofNo Approval. Patcheswith No Approval are patches for which no approval decision has been made.

Note: Some patches with an Existing Approval ofApproved for Install,Mixed, orDeclinedmay have some devices still needing those patches listed underneath them that have notbeen approved. UsingShow Device Counts will clarify this situation.

4. On the right-hand side of the screen, select Show Filter. You can use the filter to identifypatches by classification that may not have automatic approval, such as Drivers, for example. Formore information, refer to Filtering in the Patch Approval Wizard on page 32 at the bottom of thistopic.

5. In the filter, select the Classification andStatus. For example, "Drivers" and "Needed".

6. For the Approval status, select both Mixed andNot Approved patches.

Mixed includes the following:l Approved for Install + Approved for Removall Approved for Install + Declinedl Approved for Removal + Declined

7. If you think you or a technician might use this filter again, click Save and type aName for the fil-ter. The filter will be available in the drop-down for future use.


- 31 -

8. ClickNext for Approvals.

a. To change the approval for all patches for an SO or customer, in theNew Approvalcolumn, click the pencil icon to select the new approval property.

b. To change the approval at a more granular level, expand the node to reveal the allpatches under the SO or customer. This will allow you to set approvals for only thosepatches.

Select New Approval from the options:

l Not Approvedl Approved for Installl Approved for Removall Declinedl No Approvall Revertl Revert Childrenl Revert Current Node and Childrenl Clear and Re-evaluate Device Level Approvalsl Preserve Device Level Approvalsl Apply to Children

Warning! Third party software patches are not incremental. This means that configuring a thirdparty patch asApproved for Removalwill remove the entire application from thedevice and not just the software patch itself.

Note: Perform Action Immediately is not recommended as it will start patching immediatelyand ignore your patching schedule which should have been set up through Profiles tominimize daytime bandwidth load. Use this option only if you are approving one or twocritical patches.

9. ClickNext.

10. If applicable, the EULA screen will open.

a. In the EULA column, click Read to review the End User License Agreements for applic-able software patches.

b. When the EULA is displayed, click Accept orDecline in the dialog box to indicate accept-ance or refusal of the agreement. You can also select the check box next to the patch (orpatches) to accept a EULA without displaying it.

Tip: You can select the check box next to Patch Name to indicate acceptance of theEULAs for all of the patches.

11. ClickNext for the Confirmation screen.


- 32 -

12. Review the list of approvals to confirm that the configuration is correct.

13. Click Finish in the Confirmation screen.

Filtering in the Patch Approval WizardWhen you are on the Patches screen in the Patch Approval Wizard, you have the option to filter yourview using the fly-out filter in the right hand side of the screen.

You can filter on sections or you can filter on text to create searches. You can save your searches forfuture use.

Filtering on sectionsl Devicesappears only when you are approving or declining by patch. It allows you to search ondevice categories and classes.

l Status allows you to search on patch status and approval statuses.l Products allows you to search on applications.

Example: Filtering on Sections.If you have automatic approval rules set up for Critical Updates and Security updates, you do not need toselect them.What you might be interested in approving here are things like Definition Updates, Drivers,Feature Packs, Service Packs, Third Party and so on.

A Classification of "Drivers", a Status of "Needed" andApproval status of "Mixed" and "NotApproved" will display all driver patches neededwith no approval or not approved.

Filter using text

1. In the Enter search criteria field, type free form text. Remember to turn off any filters by click-ingReset Filter. For example, to find Internet Explorer patches, type "explorer" in the searchfield.

2. Click Search Patches.

3. Optionally, you can name and save your search with the Saved Search Option.


- 33 -

Automatic Approval to Rules

Adding Automatic Approval to Rules is one of the first things you should do after setting up PatchManagement. After adding automatic approval for patches to rules, patching can take place withoutfurther input from you. Patches can be approved based on your specifications without waiting for yourreview.

For example, you may want to automatically approve all Microsoft Critical and Security Updates forlaptops andworkstations, or you may want to automatically decline all Driver-type patches.

When Automatic Approval Rules are created following the instructions below, new patches coming intothe system for devices will be applied according to your specifications and existing patches that havebeen waiting for approval can be applied to existing patches through Run Rule Now.

Warning! Using Run Rule Now will apply your selected automatic approvals to all existing patches. Thiswould include previously configured Declined states and Device level approvals. Use withcaution.

After automatic approval is set up, there will still be patches that are not covered by these Rules. On aweekly basis, you need to perform somemaintenance by manually approving and declining patches thatare not covered by the automatic rules. For more information, refer to Approving and Declining PatchesManually on page 27.

Warning! Configuring automatic patch approval for devices that use Windows XP® for their operatingsystem may result in an excessive amount of time being taken before the patches areapproved. This is due to an issue with how Microsoft®manages patch approval for WindowsXP devices. For more information, refer tohttp://tech.slashdot.org/story/13/12/16/1959259/exponential-algorithm-in-windows-update-slowing-xp-machines.

Note: Patch removal cannot be performed on Windows devices that use Windows XP,Windows Vista,Windows 2003,Windows 2008, or earlier versions of the Windows operating system. Patchremoval can be performed on Windows devices usingWindows 7,Windows 8,Windows 2008 R2,Windows 2012, or later versions of Windows.

To add Automatic Approval to Rules

1. Click Configuration > Patch Management> Automatic Approval.

2. Click Add.


http://tech.slashdot.org/story/13/12/16/1959259/exponential-algorithm-in-windows-update-slowing-xp-machines

http://tech.slashdot.org/story/13/12/16/1959259/exponential-algorithm-in-windows-update-slowing-xp-machines

- 34 -

3. Type a unique name for the Patch Approval Rule, for example, "Approve all Critical and SecurityPatches".

4. Optionally, add a description for the Rule.

5. Under Products and Classifications, select the classification of updates for the Rule, for example,Critical Updates and Service Packs.

Note: Almost all designations, such as Critical Updates or Service Packs, are Microsoft application-specific. The exception is Third Party. A Rule will not apply to Third Party applications unlessthe Third Party designation is selected.

6. Select products by clicking the pencil icon.

7. In the menu, click Selected.

8. Ensure that you select both the top level and the children under the top level. Click the pencil iconagain an click Apply to Children. The children of this product will also be included in the Rule.

9. Click the Targets tab. The Targets tab displays a list of SO and Customer-level Rules that includePatch Management devices.

10. Select the pencil icon for each Rule that you would like to automatically approve. While you canselect the top level to apply approvals across all Rules, a mass approval is not recommended.

11. For each Rule you are setting up, select the appropriate option from the list. Typically when you arefirst starting with Patch Management, you will have three rules you need to set up, one for Laptops,one for Workstations and one for Servers. For each of these Rules select Approved for Install.

Note: Not Approved andNo Approval are not the same thing.No Approval is the default stateassociated to all Rules, it means no decision has been made. This is the state that you wantto leave every Rule that you do not intend tomake a decision against.Not Approved is astate andwill potentially switch patches you have Approved or Declined to a Not Approvedstate, which may not be what you would like to do.

Note: It is recommended that you do not select Perform Action Immediately unless it is acritical update that you are concerned about, as this will install auto-approved patchesimmediately, ignoring the installation schedule.

If you use Run Rule Now it will apply against all patches at that level meaning if you have DECLINEDsomething from that level, it will be switched to whatever the auto approval asked for, unless you leftthat section as "No Approval" and it is ignored. This means some things set as "Declined" from that levelmay now switch to Approved for Install if your auto approval rule was set like that. Device level declineshowever will not change

12. Click Save.


- 35 -

13. On the Automatic Patch Approval Rules screen, select the newly created automatic patchapproval Rules.

14. Click Run Rule Now will execute that Rule against all existing patches that are waiting to beinstalled and patches will be installed according to the Rule.

To delete an Automatic Approval RuleNote: Patch removal cannot be performed on Windows devices that use Windows XP,Windows Vista,

Windows 2003,Windows 2008, or earlier versions of the Windows operating system. Patchremoval can be performed on Windows devices usingWindows 7,Windows 8,Windows 2008R2,Windows 2012, or later versions of Windows.

1. Click Configuration > Patch Management> Automatic Approvals.

2. Select the check box next to the Rule that you would like to delete in the Automatic PatchApproval Rules screen.

Tip: Selecting the check box at the top of the column heading will select all of the Rules.

3. ClickDelete.

To edit an Automatic Approval RuleNote: Modifications made to existing Rules will only be applied to new software patches that are

downloaded after the changes have been made.

1. Click Configuration > Patch Management> Automatic Approvals.

2. Click theName of the Rule that you would like to modify in the Automatic Patch ApprovalRules screen.

3. Modify the properties of the Rule as needed in the Edit Automatic Patch Approval Rulescreen.

To enable an Automatic Approval Rule1. Click Configuration >Patch Management> Automatic Approvals.

2. Select the check box beside each of the Rules that you want to enable in the AutomaticPatch Approval Rules screen.

Tip: Selecting the check box at the top of the column will select all of the Rules.

3. Click Enable.


- 36 -

To disable an Automatic Approval RuleYou can use the Disable button to temporarily suspend patch approvals.

1. Click Configuration >Patch Management> Automatic Approvals.

2. Select the check box beside each of the Rules that you want to disable in the AutomaticPatch Approval Rules screen.

Tip: Selecting the check box at the top of the column will select all of the Rules.

3. ClickDisable.


- 37 -

Patch Management Reporting

A key element of the Patch Management feature is the ability to provide effective reporting. N-centraland Report Manager provide reports that are designed to be highly flexible in order to support a variety ofuse cases. Leveraging these reports, Report Manager and N-central can support a wide range of needsincluding:

l helping a technician understand the software patches that need to be deployed or the devices onwhich a bad patch needs to be rolled back,

l showing a customer their patch status,l showing a customer the work that was done, needs to be done, orl demonstrating to an auditor that patch management SLA’s are beingmet.

N-central ReportsFor high-level analysis commonly used for internal review, N-central provides the following reports.

Missing Patches (Summary)This report provides a cross-customer summary of how many devices are beingmonitored for patchesper customer, as well as a count of how many devices are missing Security, Critical and Definitionpatches.

Patch Approvals and InstallationsThis report shows the number of patches by installation Status for each Approval Status. A detailed list ofpatches associated with these counts can also be viewed in this report, if required.

Patch Installation StatusThis report allows you to see which devices are missing a specific patch, or which devices are missingpatches that belong to a specific patch category.

Missing Patches (Detailed)This report provides a breakdown of the patches missing on one or more devices, as well as bar graphsthat display missing patches by workstation/server andmissing patches by patch classification.

Report Manager ReportsFor advanced reporting, Report Manager's brandable reports can be scheduled, exported and directlyemailed to customers to provide details on patching status and the work you have done for them.

Patch StatusThis report provides a summary of patch status for one or more customers as of a period end date. Runthis report to determine if customer environments are up-to-date and see patch counts for each device.


- 38 -

Patch DetailsThis report provides detailed patch information for one or more customers within a specified time period.You can group the report to list patches for each device or devices associated with each patch.

Patch Approval and InstallationThis report provides a summary of patch counts, by approval and installation status for one or morecustomers. Run this report to show how patch installation statuses compares to what has beenapproved.

Executive SummaryThe Executive Summary report also includes patch information in its Security Monitoring.


© 2015 N-able Technologies, Inc.

All rights reserved. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, publishedor distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of N-ableTechnologies, Inc. (“N-able Technologies”). All right, title, and interest in and to the software and documentation are and shallremain the exclusive property of N-able Technologies and its respective licensors.

N-ABLE TECHNOLOGIES DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OROTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDINGWITHOUT LIMITATION THE WARRANTIESOF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL N-ABLETECHNOLOGIES, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT ORANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

The N-ABLE TECHNOLOGIES and N-CENTRAL marks are the exclusive property of N-able Technologies and its affiliates, areregistered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other N-able Technologies trademarks, service marks, and logos may be common law marks, registered or pending registration in the UnitedStates or in other countries. All other trademarks mentioned herein are used for identification purposes only and may be or aretrademarks or registered trademarks of their respective companies.

Feedback

SolarWinds N-able (formerly known as N-able Technologies) is a market driven organization that places importance on customer,partner and alliance feedback. All feedback is welcome at the following email address: [email protected].

About SolarWinds N-able

SolarWinds N-able is the global leader in remote monitoring and management software for managed service providers and ITdepartments. SolarWinds N-able’s award-winning N-central platform and complementary toolsets, backed by best-in-class businessand technical services, are proven to reduce IT support costs, improve network performance and increase productivity through theproactive monitoring, management and optimization of IP-enabled devices and IT infrastructure. SolarWinds N-able is 100%channel-friendly and maintains operations in North America, the U.K., the Netherlands and Australia.

mailto:[email protected]

Documents

Providing Patch Management With N-central · Providing Patch Management With N-central Technical documentation for using N-central to administer patch management