Providing Patch Management with N-central. Version 10.0

Transcription

1 Providing Patch Management with N-central Version 10.0

2 Contents Patch Management Overview 3 N-central Patch Management Architecture 4 Monitoring for Missing Patches 7 Viewing Installed Patches 7 Limitations and Restrictions Affecting Patch Management 8 Microsoft Patch Management 8 Third Party Patch Management 9 Configuring Devices for Patch Management 11 Caching Patch Installers 14 Patch Management Profiles 15 More about Patch Management: 15 Recommended Best Practices 15 Patch Management Profile Settings 17 Configuration Settings for Profiles 18 Approving and Declining Patches 22 Automatically Approving Patches 28 Patch Management Reporting 33 N-central Reports 33 Report Manager Reports

3 Patch Management Overview N-central offers a very flexible and powerful patch distribution and management solution by providing different features for specific patch management functions. This allows you to tailor your services offerings to the needs of your clients by organizing patch management functions into the following: Setting up Patch Management in N- central Configuring Devices for Patch Management on page 11 Caching Patch Installers on page 14 Patch Management Profiles on page 15 Approving and Declining Patches on page 22 License Feature Description Patch Monitoring Identifies any software patches that are missing on devices. This feature is available at no extra cost on both Essentials and Professional nodes. Microsoft Patch Management for Essential Mode devices Allows for the approval or declining of Microsoft software patches on devices with Essential licenses. Microsoft Patch Management for Professional Mode devices Allows for the approval or declining of Microsoft software patches on devices with Professional licenses. This feature is not a separate license and is included with the Professional license. Third Party Patch Management Allows for the approval or declining of the following non-microsoft software patches: Adobe Acrobat X Adobe Acrobat XI Adobe Air Adobe FlashActiveX Adobe FlashPlugin Adobe Reader Adobe Reader MUI Adobe Shockwave Foxit Reader Personal Google Chrome Google Earth Free itunes (32-bit/64-bit) Java 6 (32-bit/64-bit) Java 7 (32-bit/64-bit) Mozilla Firefox Mozilla Thunderbird Notepad ++ Opera (32-bit/64-bit) QuickTime Safari SeaMonkey Skype VLC Media Player (32-bit/64-bit) WinRAR (32-bit/64-bit) WinZip (32-bit/64-bit) Refer to the Limitations and Restrictions list below for specific information about Third Party software patches

4 Note: For specific information about limitations on Patch Management, refer to "Limitations and Restrictions" in the N-central online help. N-central Patch Management Architecture There are two aspects to N-central's patch management module: managing Microsoft Windows updates and managing Third Party software patches. Managing Microsoft Windows Updates For Microsoft Windows updates, the process is as follows: 1. The Windows Agent communicates with Microsoft Windows Updates and requests the list of available updates. 2. The Windows Agent then transmits this metadata to the N-central server. 3. You, as the N-central administrator, then configure the approvals for the list of available updates. You can also configure the installation schedule for when updates will be applied. 4. The Windows Agent communicates with the Probe and requests the approved updates. 5. Upon receiving the request, the Probe downloads the updates from Microsoft Windows Updates. 6. The Windows Agents then downloads the updates from the Probe. 7. The Windows Agent then applies the schedule for installing Windows updates that you configured in step

5 Managing Third Party Updates For Third Party software patches, the process is as follows: 1. The Windows Agent downloads a list of Third Party applications from the Probe and compares that list to the Third Party applications that are installed on the device. 2. The Windows Agent then transmits to N-central a list of the Third Party applications that could be updated on the device

6 3. You, as the N-central administrator, then configure the approvals for the list of available patches. You can also configure the installation schedule for when patches will be applied. 4. The Windows Agent communicates with the Probe and requests the approved software patches. 5. Upon receiving the request, the Probe downloads the patch from the software producer (for example, from for Adobe Reader patches). 6. The Windows Agents then downloads the patch from the Probe. 7. The Windows Agent then applies the schedule for installing software patches that you configured in step

7 Monitoring for Missing Patches When an N-central 10.0 Windows Agent is installed on a device, the Patch Status service is automatically added to that device. The Patch Status service queries the Windows Update Agent (WUA) on the device to determine the Microsoft and Third Party application patches that are missing. The Patch Status service returns key information including: the total number of missing patches the number of patches installed with errors missing patches by category (Security Updates, Critical Updates, Service Packs, Update Rollups, Feature Packs, Updates, and Software Driver Updates) missing patches (of specific categories) older than a user-specified number of days. Viewing Installed Patches The Agent will automatically discover all installed patches on the device when the Agent is first installed as well as when the Agent runs its daily asset discovery. This includes information such as patch details, installation date, and installation status. This information is then made available in the N-central UI on the device's Asset tab and is also included in the Missing Patches (Detailed) Report and Patch Installation Status Report

8 Limitations and Restrictions Affecting Patch Management The following limitations and restrictions may affect your Patch Management capabilities in N-central. Warning! You must upgrade both your N-central server and your Windows Agents to a minimum of Version 9.2 or later in order to perform Patch Management through N-central. The Patch Status, CPU, Memory and Process services will report a Misconfigured status if you have not upgraded. As Windows, Mac and Linux agents are automatically updated, the Patch Status, CPU, Memory and Process services will automatically transition from a Misconfigured state to a Normal/Warning/Failed state. After you have upgraded to N-central 9.2 or later, please review any Patch Management Profiles (available under Configuration > Patch Management > Profiles) that you had previously configured, as there are new settings in those Profiles that must be configured before Patch Management will function properly. If you absolutely need to approve or decline patches but the devices that you wish to target have not yet upgraded their Agents to Version 9.2 or later, please sign in directly to the appropriate WSUS server and approve or decline patches from that application. Microsoft Patch Management N-central does not support uninstalling Microsoft patches for Windows Vista and Windows Server For devices using either Microsoft Windows 8 or Microsoft Windows Server 2012 operating systems, Flash ActiveX is no longer treated as a Third Party software patch but is considered to be a Windows Feature Update. As a result, use Microsoft Patch Management to approve or decline Flash ActiveX updates for these devices. If Internet Explorer updates and Windows Updates are not current on devices using Microsoft Windows XP Service Pack 3, the reporting of updates to N-central can take excessive amounts of time and system resources. WinZip is no longer supported on devices using either Microsoft Windows XP or Microsoft Windows Server 2003 as their operating system. As a result, Third Party patch management will no longer be able to update WinZip on those devices

9 Third Party Patch Management For Third Party Patch Management to function properly, your network firewall must be configured to allow access to the following web sites: If a Probe has patch caching enabled When patch caching is enabled, the Probe must have full access to web sites so that it can download installation software. In this configuration, Agents only require access to the Server In The Sky. Device Type Vendor - Web Site URL Device with Probe Server In The Sky (SIS) - Adobe Acrobat - Adobe Reader - ftp://ftp.adobe.com/ Adobe Air - Apple Products - com Flash - Foxit - Google Products - Java - Mozilla Products - Notepad Opera - Shockwave - Skype - WinRAR - WinZip - VLC - Device with Agent Server In The Sky (SIS)

10 If no Probes have patch caching enabled Device Type Vendor - Web Site URL Device with Agent Server In The Sky (SIS) - Adobe Acrobat - Adobe Reader - ftp://ftp.adobe.com/ Adobe Air - Apple Products - com Flash - Foxit - Google Products - Java - Mozilla Products - Notepad Opera - Shockwave - Skype - WinRAR - WinZip - VLC - Third party software patches are not incremental which means that configuring a third party patch as Approved for Removal in N-central will remove the entire application from the device and not just the software patch itself. Some software patches require that the target device be re-started in order to complete the installation of the patch. Until the target device is re-started, these patches will be reported as Approved but not installed even after the patch has been installed. Software patches cannot be installed on the following Third Party applications if the application is currently running: Chrome Java (both 32-bit and 64-bit) Opera Safari Skype To avoid the failure of installing Third Party software patches because of this issue, log out the local users before attempting to install the patches. For example, you could use the "Log Off Current User" Automation Manager Policy. For more information, refer to "Log Off Current User" in the N-central online help

11 Configuring Devices for Patch Management Patch management for your managed devices is performed primarily through Probes and Agents. It can be configured by editing devices, or by configuring Patch Management options through a Rule. To edit devices for Patch Management Note: The following procedure can only be performed at the Customer or Site-level. Select the appropriate Customer or Site in the View Selection Menu to continue. 1. Click All Devices view in the navigation pane. 2. In the All Devices view screen, perform the following: For a single device, click the device that you would like to edit in the Name column. For multiple devices, select the checkbox beside each of the device names you wish to edit and click Edit. 3. Under Patch Management, select Enable Patch Management. 4. From the Select Patch Management Configuration Profile drop-down list, select the profile that you want to be applied to the device (or devices). Note: You can Add a new profile or View/Edit profiles to ensure that the correct one is selected. 5. Select Enable Third Party Patching to manage non-microsoft software patches. 6. Click OK. The device properties are updated and the All Devices view screen appears. Note: You can click Save to apply the settings and remain on the current screen

12 To enable Patch Management using Rules Note: The following procedure can only be performed at the Service Organization or Customerlevel. Select the appropriate Service Organization or Customer in the View Selection Menu to continue. 1. In the navigation pane, click Configuration > Monitoring > Rules. 2. In the Name column of the Rules screen, click the Rule that you would like to edit. 3. In the Edit Rule screen, select the Network Device Configuration Options tab. 4. Under Patch Management, select Enable Patch Management. 5. From the Select Patch Management Configuration Profile drop-down list, select the profile that you want to be applied to the devices associated with the folder template. 6. Select Enable Third Party Patching to manage non-microsoft software patches

13 7. Click Save. Note: This operation can also be carried out at the Customer level for individual Rules

14 Caching Patch Installers To display the patch caching properties of a Probe 1. In the navigation pane, click Configuration > Patch Management > Caching. If a Probe has patch caching enabled, the column. icon will be displayed in the Patch Caching 2. To display the Maximum Patch Cache Size and Cache Location for a Probe, hover your mouse pointer over the icon. To enable or disable caching of software patch installation files on a Probe 1. In the navigation pane, click Configuration > Patch Management > Caching. 2. In the Probes list, select the check box of the individual Probes for which you want to enable or disable caching of patch installation files. Tip: You can select the check box next to the column title to select all of the Probes. 3. Click Patch Caching. 4. Perform one of the following: To enable patch caching 1. Click Enable. 2. Select the Maximum Patch Cache Size. 3. Select the Cache Location. 4. If a Custom cache location is selected, you must type the path to where the software patch installation files will be stored. If the path is to a network shared drive, this must be configured as a UNC path (for example, \\Shared1_ svr\shared1\cache). 5. Click Enable. To disable patch caching 1. Click Disable. 2. Click OK to confirm

15 Patch Management Profiles N-central's Patch Management is configured and enabled through Patch Profiles. Profiles can be applied to individual devices or can be applied and controlled in bulk using a Rule. Recommended Best Practices Create a minimum of three patch profiles: one for laptops, one for Workstations and one for servers. Configure the default Patch Management Profile at the Service Organization level. Disable any group policy objects that configure Windows Update as they will conflict with the N-central settings. To avoid performance issues, do not associate individual Profiles with very large numbers of devices. Associating a Patch Management Profile with more than 1,000 devices, for example, will cause significant performance problems. More about Patch Management: Patch Management Overview on page 3 Configuring Devices for Patch Management on page 11 Patch Management Profile Settings on page 17 Approving and Declining Patches on page 22 Automatically Approving Patches on page 28 Caching Patch Installers on page 14 Limitations and Restrictions Affecting Patch Management on page 8 Editing a Patch Management Profile on page 16 Adding a New Patch Management Profile N-central provides a default Patch Management profile. Depending on your needs, however, it may be necessary to create additional profiles. 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click Add in the Profiles screen. 3. Define the profile settings as required in the Add Profiles screen. For more information, refer to Patch Management Profile Settings on page Click Save. Cloning a Patch Management Profile You can also copy a profile by using the Clone feature to create a new profile that has a similar configuration to an existing one but with minor differences. This can make the task of creating multiple profiles faster and easier. Note: Cloning a profile will include both its settings and its associated devices

16 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Select the profile you want to duplicate in the Profiles screen. 3. Click Clone. 4. Type a descriptive Name to identify the profile. 5. In the Description field, type additional information about the profile. 6. Click Save. Editing a Patch Management Profile Any Patch Management Profile (including the default profile provided by N-central) can be modified. When a Profile is modified, any changes made will be applied to all of the devices that use the Profile. If you try to edit a Profile that was created at a higher account level, N-central will automatically create a copy of the Profile at the level that it is being edited (including the associated devices) and save it at that level. This will disconnect the association to the Profile that was created at a higher account level. For example, an SO Admin attempting to edit a Profile created at the System level will create a new copy of the Profile within their respective Service Organization. 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click the name of the profile that you would like to edit in the Name column of the Profiles screen. 3. Update the profile settings as required in the Edit Profiles screen. For more information, refer to Patch Management Profile Settings on page Click Save. 5. Click Save to confirm the modifications when prompted. Viewing the Rules and Devices Associated to a Patch Management Profile You can view the associations a Patch Management Profile has to Rules. 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Click the name of the profile for which you would like to view all associations in the Name column of the Profiles screen. 3. Click the Associated Rules tab in the Edit Profiles screen

17 Note: At the Customer or Site level, a list of SO Level Rules is also displayed. Click Clone beside the appropriate Service Organization Rule to create a duplicate for your own use. Deleting Patch Management Profiles You may want to delete one or more Patch Management Profiles as your patch deployment policies evolve. Be cautious when you do this as devices will need to use an existing Profile if they are to receive deployed patches. If you try to delete a Profile that is currently being used by one or more devices, you will be warned that it is an active Profile. You may then either cancel the deletion or specify a replacement Profile to be applied to those devices that are using the Profile. Tip: You can delete multiple Patch Management Profiles simultaneously. To delete a Patch Management Profile 1. In the navigation pane, click Configuration > Patch Management > Profiles. 2. Select the check box next to the profile (or profiles) that you want to delete in the Profiles screen. Tip: You can select the check box next to the Name column to select all of the profiles. 3. Click Delete. 4. When prompted, click Delete to confirm the removal of the selected profiles. Patch Management Profile Settings Patch Management Profiles have a number of different properties that will affect how patches will be deployed. 1. Specify a descriptive Name for the Patch Profile. 2. If required, specify a Description that provides additional user-defined information about the Patch Profile which will be displayed in the Profiles table. 3. Configure the following settings for the Patch Profile. 4. Click Save

18 Configuration Settings for Profiles General Property Description Pop-up Messages You can configure whether or not the Windows agent will display a message to the user to let them know that patches will be installed at a certain time. You have the options to not show a message at all, display only a message to Administrators or to display messages to all user accounts. You can also configure how much time before the patch is scheduled to show the message, and if the user dismisses the message, how often to repeat the message. This message will not delay the patch. Show messages to Administrators Show messages to Users Show messages before the patch is scheduled to be installed Repeat messages if dismissed every Configures the Agent on the device to display messages related to patch management for logged-in users with Administrator privileges. Configures the Agent on the device to display messages related to patch management for logged-in users with standard user privileges. Installing updates - Installing <x> updates. Configures messages to be displayed prior to the scheduled installation date and time of software patches. The user will have the option to install the patches immediately instead of waiting for the scheduled date and time. New updates are ready to install - There are <x> updates scheduled to be installed on dd/mm/yyyy hh:mm. Click here to install updates now. Selects a time interval (in minutes) during which patch management pop-up messages will be displayed. Communicate with Windows Update This feature is very useful for mobile devices like laptops that are frequently outside the corporate network and can't access the probe. Through this feature, you can ensure that roaming devices can still download and install patches. By default this is turned off

19 Property Description Communicate with Windows Update if the Windows Probe is inaccessible Configures the Agent on the device to download software patches directly from Windows Update if it is unable to connect to the Windows Probe. For example, if the device is a laptop computer and is in a different location. Wait (minutes) before communicating with Windows Update Selects a time interval (in minutes) before the Agent will attempt to download software patches directly from Windows Update. Windows Update Access Windows Update access is Select one of the following settings to restrict Windows Update access to the device during patch installation: Allowed for all User accounts and Applications This setting is the default setting. It will allow device access to Windows Update for all account levels and applications. Limited to Administrators and Applications only This setting will restrict device access to Administrator-level accounts and applications. Restricted to N-central activity only This setting is the most restrictive. This blocks device access 97% of the time if you are using a typical weekly patch schedule. It opens for the following N-central activities: It will open briefly to allow access to Administrators and applications when N- central performs patch-related tasks such as installations and new patch detections. It will also open during daily asset scans. Depending on the activity, access to the device may be allowed for 5 minutes or up to an hour. Best practice: As much as possible, patch activity should be scheduled outside of customer core hours

20 Property Description Download Before Scheduled Installation Download and wait for scheduled installation Configures the Profile to download software patches immediately but only install the patches according to the configured Patch Installation Schedule. This feature is only available when installation of software patches is scheduled to be performed at a specific date or time. Installing Patches When the Device is Powered Off Automatically wake up system for patch installation This option allows you to power on the machine if it is asleep or in hibernation in order to "wake up" a Windows device (even if it is in hibernation) in order to install software updates. Patch Detection Schedule This allows you to detect what could be installed and report back to N-central. This is where you can identify how often you want the device to talk to Windows Update or other third-party vendors and to figure out what patches can be installed. Property Description When to check For patches Configures the date and time interval when the Agent on the device will check for available software patches from one of the following: Custom Every {x} Minutes Hourly Monthly Start Time Selects when the Agent will check for software patches. Use repeat every <x> hours to define an interval when the Agent will again check for patches. Days of the Week The days in each week on which you would like the Agent to check for software patches. Days of the Month The days in each month on which you would like the Agent to check for software patches. Months of the Year The months in which you would like the Agent to check for software patches

21 Patch Installation Schedule This feature allows you to specify when to install patches on the system. Property Description If a device must be restarted following the installation of a software patch, the Maintenance Windows configuration for the device will be applied. For more information, refer to "Maintenance Windows" in the N-central online help. Enable Scheduled Patch Installation Configures the Agent on the device to install software patches from one of the following: Install the patches as soon as they are approved Install the patches only at a scheduled time Patch Installation Schedule Configures the date and time interval when the Agent on the device will install available software patches from one of the following: Custom Every {x} Minutes Hourly Monthly Start Time Selects when the Agent will install software patches. Use repeat every <x> hours to define an interval when the Agent will again check for patches. Days of the Week The days in each week on which you would like the Agent to install software patches. Days of the Month The days in each month on which you would like the Agent to install software patches. Months of the Year The months in which you would like the Agent to install software patches

22 Approving and Declining Patches After enabling patch management on your devices and configuring Patch Management Profiles, you can begin approving software patches for deployment. In N-central, patches can be deployed using one of two methods: automatically using Automatic Patch Approval rules (for more information, refer to Automatically Approving Patches on page 28), or the Patch Deployment Wizard. Current Status and Approval Reported for Patches The list of available patches displayed during completion of the Patch Deployment Wizard includes specific information for each patch including: KB (Knowledge Base) Number Patch Name Date Classification Severity Status Approval Clicking on the name of the patch will display additional information such as the Description, whether it has been Superseded or not, if the patch is Removable, the Restart Behavior, and other pieces of information that are relevant to the patch. The Status of each patch will be a combination of the individual Status values of that patch across all applicable devices. The combined Status value can be one of the following (listed in order of importance): 1. Failed 2. Needed 3. Installed 4. Not Needed The highest-ranked of these statuses found on any applicable device will be reported as the combined Status for the patch. For example, if one device had a status of Failed for this patch, while two other devices have a status of Needed for this patch, the patch would have an overall combined Status of Failed. The Approval value of each patch will be a combination of the individual Approval values of that patch across all computer groups. The Approval values are combined as follows:

23 Approved for Install + Approved for Removal = Mixed Approved for Install + Declined = Mixed Approved for Removal + Declined = Mixed Approved for Install + Not Approved = Approved for Install Approved for Removal + Not Approved = Approved for Removal Declined + Not Approved = Declined Through the Patch Deployment Wizard, N-central allows you to efficiently deploy patches across a number of Windows devices (regardless of the Customer or Site to which they belong). Note: Patch removal cannot be performed on Windows devices that use Windows XP, Windows Vista, Windows 2003, Windows 2008, or earlier versions of the Windows operating system. Patch removal can be performed on Windows devices using Windows 7, Windows 8, Windows 2008 R2, Windows 2012, or later versions of Windows. To approve or decline patches 1. In the navigation pane, click Configuration > Patch Management > Approve/Decline Patches. Note: This feature may also be accessed through the Actions menu. 2. Select whether you wish to approve patches By Device or By Patch

24 3. If By Device was selected, select the check box beside each of the Device Names to which you want software patches deployed. If By Patch was selected, skip to step 4. Tip: You can select the check box next to the Device Name column heading to select all of the devices. 4. Click Next (or Patches at the top of the screen). 5. If necessary, filter the list of displayed patches in the Select Patches screen as described below: To filter the list of patches Depending on your configuration, the list of available patches can be quite long and may require filtering in order to provide a manageable amount of patch information. a. Click the Show Filter tab at the right side of the screen to display the Filter panel. b. Type the information to be used to filter the patch list in the Enter search criteria field (including the name of the patch, Knowledge Base number, or other criteria). c. Click Search Patches. Note: You can use Reset Filter to undo any selections you have made and display the entire list of available patches. d. In the Patches screen, click Show Filter. e. Select the classification of patches you want to display from the following in the Classification section: 3rd Party Critical Updates

25 Update Rollups Updates Feature Packs Definition Updates Security Updates Service Packs Drivers Tools f. Select the current status of patches you want to display from the following in the Status section: Failed Installed Needed Not Needed g. Select the current approval setting of patches you want to display from the following in the Approval section: Approved for Install Approved for Removal Declined Mixed Not Approved h. Select the severity rating of patches you want to display from the following in the Severity section: Critical Important Low Moderate Unspecified i. Select the relationship to previous patches for which you want to display patches in the Supersession section: Patches Superseding Others Patches Marked as Superseded

26 6. Select the check box next to the patch (or patches) that you would like to deploy. Tip: You can select the check box next to the KB Number column to select all of the patches in the list that is currently displayed. 7. Click Next (or Approvals at the top of the screen). 8. Select Perform Action Immediately to have the configured action carried out for the software patches right away

27 9. In the New Approval column, click the pencil icon ( ) or right-click the current approval property to select the new approval property from one of the following: No Approval Approved for Install Approved for Removal Declined Revert Revert Children Revert Current Node and Children Clear and Re-evaluate Device Level Approvals (only displayed if approving By Patch) Preserve Device Level Approvals (only displayed if approving By Patch) Apply to Children Same as Parent Note: Third party software patches are not incremental which means that configuring a third party patch as Approved for Removal in N-central will remove the entire application from the device and not just the software patch itself. 10. Click Next (or EULA at the top of the screen if applicable). Note: If applicable, the EULA screen will appear. If no EULAs are provided for the accepted patches, skip to step In the EULA column, click Read to review the End User License Agreements for applicable software patches. When the EULA is displayed, click Accept or Decline in the dialog box to indicate acceptance or refusal of the agreement. You can also select the check box next to the patch (or patches) to accept a EULA without displaying it. Tip: You can select the check box next to Patch Name to indicate acceptance of the EULAs for all of the patches. 12. Click Next (or Confirmation at the top of the screen). 13. Review the list of approvals to confirm that the configuration is correct. 14. Click Finish in the Confirmation screen. Note: At any time during the Patch Deployment Wizard, you can click Previous to review previous stages of the procedure. To start the wizard over again and remove all current settings, click Start Over

28 Automatically Approving Patches Creating Patch Approval Rules allows N-central to automatically approve patches for you that meet specific criteria saving you and your technicians time and effort. Automatic Patch Approval Rules can be created at the Product Administrator, Service Organization and Customer levels. Editing and deleting Rules is restricted by the level at which they are created: Rules created at a higher level can be used but not edited or deleted by lower level accounts. Rules created at a lower level can be edited or deleted by higher level accounts. Software patches with End User License Agreements (EULAs) will now be approved automatically by Automatic Patch Approval Rules. In previous releases of N-central, patches that required EULA consent could not be approved using Automatic Patch Approval Rules but this has been changed with N-central 9.2. Rules can be enabled or disabled to allow further temporary suspension. N-central also allows you to run a Rule on-demand. The Rule status will be indicated by one of the following icons: Enabled Disabled Warning! Configuring automatic Third Party software patch approval for devices that use Windows XP for their operating system may result in an excessive amount of time being taken before the patches are approved. This is due to an issue with how Microsoft manages patch approval for Windows XP devices. For more information, refer to Note: Patch removal cannot be performed on Windows devices that use Windows XP, Windows Vista, Windows 2003, Windows 2008, or earlier versions of the Windows operating system. Patch removal can be performed on Windows devices using Windows 7, Windows 8, Windows 2008 R2, Windows 2012, or later versions of Windows. To add an Automatic Patch Approval Rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Click Add in the Automatic Patch Approval Rules screen. 3. Configure the properties of the Rule in the Add Automatic Patch Approval Rule screen:

29 Name A unique identifier for the Rule. Description A personalized summary of the Rule that should identify what it does. Products and Classificatio ns Used to configure the patches that will be targeted by the Auto Approval Rule. a. Under The following classifications, select the type of patch in the lefthand column from one or more of the following: Third Party Critical Updates Definition Updates Drivers Feature Packs Security Updates Service Packs Tools Update Rollups Updates b. Click > to move the selected classifications to the right-hand column. Tip: Click >> to move all of the items from the left column to the right or << to move all of the items from the right column to the left. You can also use Ctrl-click to deselect an item from either column. c. Under The following products, right-click on the property displayed in the Selected column for individual products within the publisher, product name and version categories. d. In the drop-down menu, select: Select - the product will be associated with the Rule. Unselect - the product will not be associated with the Rule. Apply to Children - the product and all of its related subsidiary products will be associated with the Rule. Same as Parent - the product will either be associated with the Rule or not associated with the Rule depending on what the setting is for the parent application

30 Targets Within the appropriate Customer or Site, select the Rule to be applied to associate devices with Automatic Patch Approval. Select the Rule to be applied to associate devices with Automatic Patch Approval. Select Perform Action Immediately to do the following: if a software patch is Approved for Install, it will be installed immediately, or if a software patch is Approved for Removal, it will be removed immediately. The Patch Installation Schedule configured for the selected devices will be ignored if this option is selected. If a software patch is Not Approved or Declined, it will not be installed. 4. Click Save. 5. Click Yes - Run the Rule Now or No - Do Not Run the Rule Now in the Do you Want to Run this Rule Now? prompt based on your current needs. If you select Yes, the Rule will be applied and software patches approved. If you select No, the Rule will not be applied. Note: If you choose to run the new Rule immediately, it will be applied against all of the software patches that are currently managed as well as any new software patches received from this point on. If you choose not to run the new Rule immediately, it will only be applied to future software patches. To delete an Automatic Patch Approval Rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box next to the Rule that you would like to delete in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column heading will select all of the Rules. 3. Click Delete. 4. Click Delete in the Confirm Delete prompt. To edit an Automatic Patch Approval Rule Note: Modifications made to existing Rules will only be applied to new software patches that are downloaded after the changes have been made

31 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Click the Name of the Rule that you would like to modify in the Automatic Patch Approval Rules screen. 3. Modify the properties of the Rule as needed in the Edit Automatic Patch Approval Rule screen. 4. Click Save. To enable an Automatic Patch Approval Rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the Rules that you want to enable in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the Rules. 3. Click Enable. 4. Click Enable in the Confirm Enable prompt. Note: A will appear in the Enabled column beside the name of the Rule (or Rules) that has been enabled. To disable an Automatic Patch Approval Rule 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the Rules that you want to disable in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the Rules. 3. Click Disable. 4. Click Disable in the Confirm Disable prompt. Note: An will appear in the Enabled column beside the name of the Rule (or Rules) that has been disabled

32 To manually run an Automatic Patch Approval Rule Creating an Automatic Patch Approval Rule will affect all subsequent software patches but will not be applied to software patches received by N-central prior to the creation of the Rule. The Run Rule Now feature allows you to have the Rule applied to these existing patches so that those which meet the criteria configured in the Rule are approved. 1. In the navigation pane, click Configuration > Patch Management > Automatic Approvals. 2. Select the check box beside each of the Rules that you want to run in the Automatic Patch Approval Rules screen. Tip: Selecting the check box at the top of the column will select all of the Rules. 3. Click Run Rule Now. 4. Click Run Rule Now in the Confirm Run Now prompt

33 Patch Management Reporting A key element of the Patch Management feature is the ability to provide effective reporting. N-central and Report Manager provide reports that are designed to be highly flexible in order to support a variety of use cases. Leveraging these reports, Report Manager and N-central can support a wide range of needs including: helping a technician understand the software patches that need to be deployed or the devices on which a bad patch needs to be rolled back, showing a customer their patch status, showing a customer the work that was done, needs to be done, or demonstrating to an auditor that patch management SLA s are being met. N-central Reports For high-level analysis commonly used for internal review, N-central provides the following reports. Missing Patches (Summary) This report provides a cross-customer summary of how many devices are being monitored for patches per customer, as well as a count of how many devices are missing Security, Critical and Definition patches. For information, refer to Missing Patches (Summary) Report on page 1. These reports are in N-central: Missing Patches (Summary) Report Patch Approvals and Installations Report on page 1 Patch Installation Status Report Patch Status (Detailed) Report Patch Approvals and Installations This report shows the number of patches by installation Status for each Approval Status. A detailed list of patches associated with these counts can also be viewed in this report, if required. For information, refer to Patch Approvals and Installations Report on page 1. Patch Installation Status This report allows you to see which devices are missing a specific patch, or which devices are missing patches that belong to a specific patch category. For information, refer to Patch Installation Status Report on page 1. Patch Status (Detailed) This report provides a breakdown of the patches missing on one or more devices, as well as bar graphs that display missing patches by workstation/server and missing patches by patch classification. For information, refer to Patch Status (Detailed) Report on page

34 Report Manager Reports For advanced reporting, Report Manager's brandable reports can be scheduled, exported and directly ed to customers to provide details on patching status and the work you have done for them. Patch Status This report provides a summary of patch status for one or more customers as of a period end date. Run this report to determine if customer environments are up-to-date and see patch counts for each device. Patch Details This report provides detailed patch information for one or more customers within a specified time period. You can group the report to list patches for each device or devices associated with each patch. Using Report Manager Reports If you have Report Manager (N-able's advanced reporting solution) you can fin it under "Reports" in the left pane of N-central. Within the search box in the top right, type the term "patch" and all reports that include details about patch management will be returned in a list. For more information, refer to About Report Manager. Patch Approval and Installation This report provides a summary of patch counts, by approval and installation status for one or more customers. Run this report to show how patch installation statuses compares to what has been approved. Executive Summary The Executive Summary report also includes patch information in its Security Monitoring

35 2015 N-able Technologies, Inc. All rights reserved. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of N-able Technologies, Inc. ( N-able Technologies ). All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of N-able Technologies and its respective licensors. N-ABLE TECHNOLOGIES DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL N-ABLE TECHNOLOGIES, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The N-ABLE TECHNOLOGIES and N-CENTRAL marks are the exclusive property of N-able Technologies and its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other N- able Technologies trademarks, service marks, and logos may be common law marks, registered or pending registration in the United States or in other countries. All other trademarks mentioned herein are used for identification purposes only and may be or are trademarks or registered trademarks of their respective companies. Feedback SolarWinds N-able (formerly known as N-able Technologies) is a market driven organization that places importance on customer, partner and alliance feedback. All feedback is welcome at the following address: n-able-feedback@solarwinds.com. About SolarWinds N-able SolarWinds N-able is the global leader in remote monitoring and management software for managed service providers and IT departments. SolarWinds N-able s award-winning N-central platform and complementary toolsets, backed by best-in-class business and technical services, are proven to reduce IT support costs, improve network performance and increase productivity through the proactive monitoring, management and optimization of IP-enabled devices and IT infrastructure. SolarWinds N-able is 100% channel-friendly and maintains operations in North America, the U.K., the Netherlands and Australia.