Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Microsoft has WSUS which is great for the Microsoft products it supports (and it doesn't support all Microsoft products), but in reality companies have many applications from other vendors.

Is there a patch/update management server similar to WSUS, but that works with lots of vendors or developers?

Some good soul decided to change the server tag to a Windows tag - Note that this is NOT just for Windows. If you know a good patch server that runs on Linux or Apple then those are perfect too.


locked by sysadmin1138 Aug 22 '12 at 0:35

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

12 Answers 12

up vote 5 down vote accepted

Shavlik's NetChk Protect could be a good option for you. The company has a close relationship with Microsoft and its underlying technology powers Microsofts own Baseline Security Analyzer product. Whilst Microsoft's MBSA only supports patching Microsoft products NetChk Protect support products from many other vendors.


There are quite a few products out there which support this LanDesk, Altiris and PatchLink to name a few.

To the best of my knowledge all the products out there are walled gardens.

Just an anicdote: I've had a lot of good experiences with PatchLink. – Nalandial Jun 18 '09 at 5:24

BigFix enterprise is also quite a good patch management system, and has a lot of "third party" patches as well as all the normal MS patches.

I think conceptually it's better than WSUS as well - you tell the clients when to update, rather than the clients checking back to see if any updates are needed.


We use Lumension's (formerly Patchlink) Patchlink software for updates.

Works well, lots of reporting capabilities via Patchlink Enterprise Reporting Server, which takes advantage of SQL Reporting Services. Worked well for us thus far and with SQL backend lets me roll my own reporting solutions if needed.


I'm sure it's not the best but HP System Insight Manager looks after hardware alerts etc. and also can manage updates. Like I say it may not be the best but at least you have another option to investigate.


WPKG can be used this way. The process will be rather manual, but it is open source so there's no reason why you can't write a script to monitor the sites you want to download patches from and roll them in. I bring WPKG up because it's just too easy to get running.

WPKG with wsusoffline works great: – menko Nov 22 '09 at 8:34

Since you seem to like WSUS, you can consider the WSUS + EminentWare's WSUS Extension Pack. The WSUS Extension Pack provides additional update management control, scheduling, machine selection, etc. and excellent reporting capabilities. More importantly, it allows you to extend WSUS to deploy and manage 3rd party or non-Microsoft patches and applications. Essentially you create packages that allow you to extend WSUS to deploy any MSI, MSP or EXE.


You can also use a applications like Server Automation from HP, who can patch and install OS/applications, on Windows/Linux/AIX/Solaris/HP-UX and so on..

But that a really expensive product and usefull only starting with at least 1000 servers growing to 15k servers.

PS: I am working for HP.


I've used Numara Patch Manager, and it supports a ton of Microsoft apps as well as a few other smaller utilities from Adobe, Apple, Mozilla, etc. They do offer a trial download.


IBM Tivoli Provisioning Manager (formerly called Tivoli Configuration Manager) is multi-platform and can deploy patches, applications, system changes, etc. It can also be configured to remove applications.

There are two catches. First is complexity. Second is cost.

Because it is multi-platform and is extremely customizable, it doesn't do a lot out of the box. It also carries a price tag that would make a small-to-medium sized company clutch its chest.


If you'd like a free, open solution, there's a plug-in to the linux-based firewall IPCop ( called Update Accelerator ( It currently supports updates from Adobe, Apple, Avast, Linux (.deb and .rpm), Microsoft, Symantec, and Trend Micro, and supports to ability to add custom sources.

A branch of my organization has been using it for about a quarter with great results (and, may I add, much needed results, as there isn't a ton of bandwidth available to us in Africa). If you like the plug-in but could care less about IPCop, I would just implement IPCop with Update Accelerator, yet neuter the IPCop configuration to the point where it doesn't do anything except direct updates through Update Accelerator.


WSUS is the way to go no doubt. It's simple, easy to administer, and you can have nodes on each satellite network to help distribute the updates if needed.

Not to mention if you have a problem, it's all Microsoft. Who are they going to point the finger at? ;)

-1 for not reading the fact I stated WSUS in my question and why it isn't suitable. – Robert MacLean Jun 27 '09 at 10:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.