/build/static/layout/Breadcrumb_cap_w.png

Patching - Computers built after a patching window

Hi, quick question on patching.

I'm currently testing KACE patching to replace WSUS but one thing that has occured to me is this: in WSUS you can set patch deployment deadlines and this is how I ensure that PC's built between patching windows are kept up to date. I set the deadline of approved patches to the day of the patching window, then any PC's that are built after that are immediately updated as they are detected as missing patches with an expired deadline.

I don't want PC's built between windows to go un-patched until the next window so how can I ensure freshly built PC's are updated as soon as they finish building? I know the K1000 has "Run on next connection if offline" but to me that will only cover PC's that KACE already knows about, i.e. has checked in before but is offline at time of patching.

So to summarise my questions:

1) Does checking "Run on next connection if offline" cover freshly built PC's?

   a) If not, is there a way to get KACE to deploy patches the same way WSUS deadlines does?

Thanks.


0 Comments   [ + ] Show comments

Answers (2)

Posted by: tshupp 11 years ago
3rd Degree Black Belt
1

I think the simplest answer to your question is that KACE only patches PCs that it can target via inventory. If you build a PC, but do not install the KACE agent, KACE cannot patch it, as that PC would lack the agent and associated patching processes that are installed alongside the agent. The agent software fascillitates the patching, so without it, and without an inventory item for the PC, it can't patch.

Once the PC has checked in (after the Agent is installed), then it gets evaluated. If you set the "Run on next connection if offline" to yes, then it should check-in and run the detect or deploy schedule you have setup with the "Run on next connection" option set.

Depending on how you have your patch windows setup (with prompted/forced reboots or notifications), you might look into have a separate patch schedule which only targets newly-built PCs. You can create a smart label which only applies to "new" machines, and target those machines with a detect/deploy patch cycle with no notifications/forced reboots to get those PCs patched as quickly as possible.


Comments:
  • Hi, thanks for the response. My KACE client is installed by Group Policy so for this exercise you can assume the client is always installed. You said you can "create a smart label which only applies to "new" machines". That was my thinking as well, but how to do that is the hard part - do you have any ideas? Best I could come up with and am testing now is 'where CREATED < 120' apply "LabelX". I've guessed that Created is the right field and that its calculated in minutes haha. Then the next problem is getting those machines targeted for patching instantly. Again, best idea I have is to deploy every hour to this label, with the label being removed after PC has existed for more than 120 minutes. - twit 11 years ago
    • How often do you run patching? - chucksteel 11 years ago
    • For the "New PC" smart label SQL, look at dugullett's advice. You can set your "New Machine Patch Schedule" to run once a week, with the "Run on next connection if offline" trigger active.

      For example, you schedule the "New Machine Patch Schedule" (with RONC active) to run every Monday at 8:00 am. When you build a new PC on Tuesday, the PC will check in and should trigger the patch schedule. - tshupp 11 years ago
Posted by: dugullett 11 years ago
Red Belt
1

Add

OS_INSTALLED_DATE > DATE_SUB(NOW(), INTERVAL 2 DAY)

 to your machine label. Call it something like new_imaged_machines. Create a patch schedule to run at a higher interval, and apply this label to that schedule. After those two days these machines will automatically drop out of this label, and continue on a regular patch schedule.


Comments:
  • Thanks heaps for this dugullett! Works perfectly, except for I changed it to INTERVAL 2 HOUR. Just want to be able to tell clients that their PC might patch/restart within the first couple hours of use should it be provided to them that soon after building. Tested this and it works perfectly. - twit 11 years ago

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ