8
votes

Microsoft has WSUS which is great for the Microsoft products it supports (and it doesn't support all Microsoft products), but in reality companies have many applications from other vendors.

Is there a patch/update management server similar to WSUS, but that works with lots of vendors or developers?

Update
Some good soul decided to change the server tag to a Windows tag - Note that this is NOT just for Windows. If you know a good patch server that runs on Linux or Apple then those are perfect too.

12 Answers 12

5
votes
+50

Shavlik's NetChk Protect could be a good option for you. The company has a close relationship with Microsoft and its underlying technology powers Microsofts own Baseline Security Analyzer product. Whilst Microsoft's MBSA only supports patching Microsoft products NetChk Protect support products from many other vendors.

3
votes

There are quite a few products out there which support this LanDesk, Altiris and PatchLink to name a few.

To the best of my knowledge all the products out there are walled gardens.

1
  • Just an anicdote: I've had a lot of good experiences with PatchLink.
    – Nalandial
    Jun 18, 2009 at 5:24
3
votes

BigFix enterprise is also quite a good patch management system, and has a lot of "third party" patches as well as all the normal MS patches.

I think conceptually it's better than WSUS as well - you tell the clients when to update, rather than the clients checking back to see if any updates are needed.

2
votes

We use Lumension's (formerly Patchlink) Patchlink software for updates.

http://www.lumension.com/vulnerability-management/patch-management-software.jsp?rpLangCode=1&rpMenuId=150833

Works well, lots of reporting capabilities via Patchlink Enterprise Reporting Server, which takes advantage of SQL Reporting Services. Worked well for us thus far and with SQL backend lets me roll my own reporting solutions if needed.

2
votes

I'm sure it's not the best but HP System Insight Manager looks after hardware alerts etc. and also can manage updates. Like I say it may not be the best but at least you have another option to investigate.

2
votes

WPKG can be used this way. The process will be rather manual, but it is open source so there's no reason why you can't write a script to monitor the sites you want to download patches from and roll them in. I bring WPKG up because it's just too easy to get running.

1
2
votes

Since you seem to like WSUS, you can consider the WSUS + EminentWare's WSUS Extension Pack. The WSUS Extension Pack provides additional update management control, scheduling, machine selection, etc. and excellent reporting capabilities. More importantly, it allows you to extend WSUS to deploy and manage 3rd party or non-Microsoft patches and applications. Essentially you create packages that allow you to extend WSUS to deploy any MSI, MSP or EXE.

1
vote

You can also use a applications like Server Automation from HP, who can patch and install OS/applications, on Windows/Linux/AIX/Solaris/HP-UX and so on..

But that a really expensive product and usefull only starting with at least 1000 servers growing to 15k servers.

PS: I am working for HP.

1
vote

I've used Numara Patch Manager, and it supports a ton of Microsoft apps as well as a few other smaller utilities from Adobe, Apple, Mozilla, etc. They do offer a trial download.

0
votes

IBM Tivoli Provisioning Manager (formerly called Tivoli Configuration Manager) is multi-platform and can deploy patches, applications, system changes, etc. It can also be configured to remove applications.

There are two catches. First is complexity. Second is cost.

Because it is multi-platform and is extremely customizable, it doesn't do a lot out of the box. It also carries a price tag that would make a small-to-medium sized company clutch its chest.

0
votes

If you'd like a free, open solution, there's a plug-in to the linux-based firewall IPCop (http://sourceforge.net/apps/trac/ipcop/wiki) called Update Accelerator (http://update-accelerator.advproxy.net/). It currently supports updates from Adobe, Apple, Avast, Linux (.deb and .rpm), Microsoft, Symantec, and Trend Micro, and supports to ability to add custom sources.

A branch of my organization has been using it for about a quarter with great results (and, may I add, much needed results, as there isn't a ton of bandwidth available to us in Africa). If you like the plug-in but could care less about IPCop, I would just implement IPCop with Update Accelerator, yet neuter the IPCop configuration to the point where it doesn't do anything except direct updates through Update Accelerator.

-2
votes

WSUS is the way to go no doubt. It's simple, easy to administer, and you can have nodes on each satellite network to help distribute the updates if needed.

Not to mention if you have a problem, it's all Microsoft. Who are they going to point the finger at? ;)

1
  • -1 for not reading the fact I stated WSUS in my question and why it isn't suitable. Jun 27, 2009 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .