Questions tagged [patch-management]

Patch Management refers to updating and patching systems, and particularly to tools and systems which automate this process for a large number of systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

WSUS GPO - Specific week specified, but ignored

I have configured a GPO to force updates via GPO in a scheduled maintenance window since these boxes were previously getting updates and just rebooting outside of active hours. I would prefer that ...
0
votes
1answer
18 views

How often to apply windows updates on High Availability servers?

We have a couple of windows servers (2019) that will be running High Availability services (redis, sql server, in-house software etc). Currently don't have the budget to go for clustering, so need to ...
0
votes
0answers
14 views

Using SCUP to Deploy Java

I'm using SCUP to create Java updates to deploy to our client computers through SCCM. I have followed the guide below: https://blog.techygeekshome.info/2013/07/java-client-updates-deployment-using-...
1
vote
1answer
121 views

How to update Windows 10 Pro Endpoints remotely?

Here is the scenario, We have Windows 10 Pro (100 end points) all physical. It is a MS Windows AD environment. What is the best solution to update these end points remotely? Looking for something ...
0
votes
0answers
40 views

“Simple” (w10) desktop provisioning

I run the ICT for our local little NFP MakerSpace/Community-centre & have been tasked with finding a way that the dozen or so laptop we use for workshops be maintained. The basic gist of it is ...
1
vote
1answer
48 views

How to have a reproducible security patching procedure on CentOS 7

TL;DR : How to make sure a list of package updates can be made in a reproducible way on many servers, even if newer security updates are available before the patching campaign is over? In a company ...
0
votes
1answer
59 views

Unable to build initscripts package

I have some patches that I added in spec files and after adding those patches I am unable to build the rpm package. Obsoletes: hotplug <= 3:2004_09_23-10.1 Processing files: debugmode-9.03.61-1.0....
0
votes
1answer
57 views

How to findout what pre-requisite MS patches are?

TL;DR: install MS patch requires previous patches, how to determine needed patches in an isolated network? I have this Windows 2008R2 SP1 machine in a isolated network, the machine hasn't been ...
0
votes
1answer
176 views

Do we need to reboot RHEL Servers, after making changes for control-alt-delete override?

We are planning on disabling the RHEL Server reboot triggered by control-alt-delete. for which we are going to follow the Steps mentioned here. However, that link does not say whether we need to ...
1
vote
1answer
542 views

Why is Windows Server 2012 not patchable for meltdown, when Windows Server 2008 R2 is?

Just curious, but does anyone know why Windows Server 2012 R1 server isn't patchable for meltdown/spectre? Windows 2008 R2 (2009) is patchable, but 2012 (2012) isn't? What was added in the R2 ...
0
votes
2answers
759 views

OS patches list

How can I check installed list of patches on OS separately for critical security plugins and all other updates. I tried "rpm -qa --last" and "yum list installed" but didn't get the desired output.
0
votes
1answer
254 views

Using salt-ssh for Ubuntu/Debian patching (dialog frontend is not usable)

I'm looking into replacing a Linux based home-grown patch management solution with salt-ssh. The current system uses a shell script to iterate through a list of hosts and copies a script named apt-...
2
votes
1answer
918 views

Passing Remote Client IP to WSUS Server behind Reverse Proxy Server

We have an internet facing WSUS server for our remote windows clients (laptops, remote users, etc..). As an extra layer of protection, we have placed the WSUS server behind a Reverse Proxy server ...
0
votes
0answers
102 views

How to audit Windows patch level off-site?

I would like to audit different Windows servers and desktop machines off-site using configuration output generated previously on the machines (e.g. output of the systeminfo command). Previously I ...
0
votes
2answers
264 views

Installing previous month's cumulative update

For some of our production systems we like to wait a few weeks to apply updates so that they've "baked" in the public a bit. We then wait a little longer after before patching backup systems lest we ...
0
votes
1answer
119 views

.NET 3.5 SP 1 and Web Platform Installer

I manage a Windows Server 2008 R2 box which has a .NET Framework related security issue that showed up in a recent security scan. Below are the security scan results: The following Microsoft .NET ...
0
votes
2answers
877 views

How To Patch Server running WSUS Without Shooting Yourself In The Foot

I'm starting to use WSUS for patch management and I'm a little light in the experience department. Our requirements are simple in that we want to make sure every server we have is up, on and ready ...
1
vote
1answer
153 views

rsync for software update / multiple clients

I'm building a game launcher / updater and need to make clients download the last game version if an update is avaiable or if there is a problem with files integrity. I need something able to produce ...
5
votes
3answers
759 views

Replicating patch level from one server to another without WSUS/patch management

The scenario is: Server1 and Server2, both running Windows Server 2012 R2 at the same patch level, are currently in a load-balancing cluster. Server1 has application issues and advice is to replace ...
0
votes
1answer
350 views

Remotly obtain an application's Windows Installer patches via WMI or Powershell

I'm working on a remote administration app which needs to be able to obtain a list of patches which have been applied to an application. This Support article suggests there are two ways they could be ...
1
vote
1answer
72 views

Doubtes in MS KB Numbers

I am having some doubtes in MS KB numbers, For Example MS16-103 (KB 3182332) - under this we have two different KB nos like 3176492, 3176493. My doubts is which one we should apply in the server. in ...
1
vote
1answer
126 views

Using WSUS to patch multiple environments

We set up Windows domains from scratch and then all servers (2003, 2008 R2, 2012, etc) sit offline (including DC's) for months before being used again. This causes a nightmare when trying to patch the ...
2
votes
1answer
2k views

Confused on BigFix relevance - x64 files

I am using BigFix in an Enterprise Environment and noticed a recent round of Microsoft patches for 2016 have failed on a small group of assets. I was able to work around this by creating Custom Copy ...
0
votes
1answer
88 views

linux + yum update - what this command covers?

we have red-hat version 6.x machine, I verified what are the missing security patches as the following: yum updateinfo list security available Loaded plugins: product-id, rhnplugin, security, ...
0
votes
1answer
2k views

SCCM Server 2012 WMI Query For Missing Microsoft Patches On Specific Host

What is the appropriate WMI query to ask a 2012 SCCM server for a list of missing Microsoft patches on a specific host that the SCCM server manages. For example, say I want to check which patches are ...
3
votes
1answer
65 views

Windows post-patching monitoring

We currently provide patch management as a service to a large number of servers. Historically, we have had tier 1 type technicians RDP to each machine after the patching window to verify they are ...
1
vote
0answers
52 views

Ubuntu, determine urgency of kernel patches to better control when systems need reboots

I'm using Ubuntu 14.04 I'm currently using unattended-upgrades to apply security patches to my systems. I've found that kernel patches are pretty frequent -- roughly 1 - 2 per week -- and of course ...
1
vote
0answers
28 views

Patching product configuration files that may contain custom settings

I'm curious to know if anyone has any suggestions on the best way to patch configuration files for software products that may contain custom settings. I'm familiar with diff, patch, diff3, etc... ...
2
votes
0answers
150 views

Speeding up years of Windows patch backlog

In a 200 Windows server estate there are years of missing patches. What is the quickest way to patch those? Is WSUS smart enough to batch-install maximum patches to minimise reboots? Servers are ...
0
votes
1answer
99 views

Best practices on patching build servers

We have a set of Linux servers that our developers use to compile software for our products we sell. We are currently in a stand off between our network security people saying the servers need to be ...
15
votes
5answers
2k views

How can we remotely administer our “fleet” of Windows 7 laptops?

I'm working with a startup that's teaching kids to program. We've just obtained our first "fleet" of laptops - half a dozen refurbished thinkpads running Windows 7 - and I'm looking for the best way ...
0
votes
1answer
770 views

Patch Management — KPI Dasboard

Good day fellows, I'm looking to build a centralised dashboard to track the patch management KPI from our organisation, including workstations (Windows) & servers (Linux/Windows). Basically, I'...
0
votes
0answers
108 views

up2date login & patch APIs for RHEL7

I am trying to achieve controlled patching of the RHEL machines in my network, for which I need to get the list of all patches onto a windows machine & distribute the missing ones. I have already ...
0
votes
1answer
156 views

Patching GHOST Vulnerability # CVE-2015-0235 SLES 11 SP3

I need to upgrade a SLES 11 SP3 server for the new ghost vulnerability that has been discovered. According to http://www.cyberciti.biz/faq/cve-2015-0235-patch-ghost-on-debian-ubuntu-fedora-centos-...
1
vote
2answers
1k views

Puppet for Patch Management

I am thinking of using Puppet for massive patch management. The way to go with this, based on some research, is to create a class and apply it wherever you need, like in the following case: class ...
-4
votes
1answer
118 views

Apply patch to custom kernel manually [closed]

I compiled a RHEL based kernel with a script. I've come to know that our version of kernel is vulnerable to attack and we need to apply security patches. https://rhn.redhat.com/errata/RHSA-2014-1392....
1
vote
1answer
1k views

VMWare Tools. How often to update and how to handle it?

We have about 8 ESXi Servers (5.5) and about 100 VMs. I always try to keep the ESXi Servers up to date with the vmware patches. This seems to work more or less well for me. Sometimes i need some weeks ...
0
votes
1answer
151 views

Files listed on WinShock (KB2992611) what do the different file sizes for the same file name mean?

Lsass.exe.mui 6.0.6002.23498 10,752 20-Sep-2014 03:46 Not applicable Lsasrv.dll.mui 6.0.6002.23498 50,688 20-Sep-2014 03:33 Not applicable Lsass.exe.mui 6.0.6002.23498 10,752 20-Sep-...
5
votes
1answer
5k views

How to Configure A Software Update Baseline in SCCM 2012

I have a remote site that has about 70 systems that have not been patched for the last 4 months due to the WSUS server going down and I am now just getting around to deploying SCCM 2012 there. Can ...
1
vote
1answer
31 views

Microsoft updates feed [closed]

I'm trying to write a web scraper that will pull together information about security updates for various products but I cannot find one for microsoft products. As this is cross-platform and includes ...
-2
votes
2answers
95 views

Can I update Ubuntu with active users logged in? [closed]

I would like to run apt-get dist-upgrade, but I don't know how this will affect the currently logged in users. How can I find out: 1. will a restart be required 2. will the system be stable/...
1
vote
3answers
6k views

powershell check windows update on a server

We have some 1000 + servers, we are doing monthly patching activity. i need to check the patches are updated on the servers or not, is it possible to check based on the Microsoft Security Bulletin ...
2
votes
1answer
84 views

Hardened compiler flags VS automatic security patches?

I noticed that a few select pieces of software in the Long Term Support repository for my Operating System, have not been compiled with PIE, or Immediate binding (for example). In the opinion of ...
3
votes
1answer
102 views

Is there a different way to view the Windows Updates for a computer that summarizes what each is for?

When reviewing some of our Windows servers, it can be extremely tedious to tell whether a security update is relevant to our system. A patch to IIS is irrelevant if we use Apache; an exploit affecting ...
1
vote
1answer
3k views

(VMware) esxcli software vib update -n xxx, which vib version is selected for the module xxx

Although I have read VMware's official blog post http://blogs.vmware.com/vsphere/2013/10/are-esxi-patches-cumulative.html very carefully, there is still quite some mist. Now I ask one concise ...
2
votes
2answers
2k views

RHEL 5 list missing critical patches/packages

Im trying to figure out if there is an easy way to identify the missing critical patches/packages on my RHEL5 boxes. This is for audit purposes and was trying to figure out if there was an RPM command ...
-1
votes
2answers
2k views

Linux patch management [closed]

I'm doing a internship to setup a Linux patch management system. It's a IT infrastructure management company with focus on Microsoft systems. They currently have ~15 Linux servers to manage and ...
0
votes
1answer
161 views

Does MS notify when an OS patch is updated?

We know the drill, every Patch Tuesday MS releases a long list of MS13-xx patches. Those typically consist of KB items for individual configurations or servers. From time to time, though, Microsoft ...
4
votes
3answers
575 views

How important is patch management? [duplicate]

Problem I'm trying to sell the idea of organizational patch/update management and antivirus management to my superiors. Thus far, my proposition has been met with two responses: We haven't had any ...
18
votes
3answers
9k views

Is it usually safe to run “apt-get upgrade” (in terms of stability) on a production server?

I often log into my Ubuntu 12.04.2 server (with Postgres 9.2.4 running with live production data) and see something akin to: 4 packages can be updated. 4 updates are security updates. This happens ...