KACE Systems Management Appliance 13.2 Common Documents

Configure patch schedules

You can create and configure patch schedules and set a time for them to run. Patching schedules do not interfere with Managed Installations or other distributions.

Start the Schedule Detail wizard:

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Security, then click Patch Management.

On the Patch Management panel, click Schedules.

On the Patch Schedules list page, do one of the following:

▪

To create a new patch schedule, click Choose Action > New (Wizard).

▪

To edit an existing schedule, click the schedule name in the list, then on the Patch Schedule Summary page that appears, click Edit.

The Schedule Detail wizard appears, as selected. The same options are available on the Schedule Detail page. You can switch between the page and wizard by clicking Classic View or Wizard View in the top-right corner, as applicable.

In the Schedule Detail wizard, on the General Information page, specify the general details for this schedule.

Option	Description
Name	A name that identifies the schedule. This name appears on the Patch Schedules page.
Description	A brief description of the patch schedule.

Click Next.

On the Action page, select the action that you want to associate with the schedule.

The action associated with the patch schedule.

The patch action behavior is dependent on the combination of reboot, detect, deploy, and rollback selections you make. Whenever a patch action does both a Detect pass and something else, as is the case with Detect and Deploy and Detect and Rollback, the action is repeated cyclically until the Detect action finds no further patches to deploy or roll back. This behavior might result in multiple Reboot actions for a single scheduled run. In addition, the type of device you are patching affects the type of patch action to use.

The following actions are available:

◦

Detect: Detects patches that are installed on, or missing from, managed devices. Detect-only actions are recommended when the Patch Download Settings are configured to download only . Running a detect-only action before the deploy creates a list of patch files to download before deployment begins.

◦

Detect and Stage: Detects patches that are installed or missing from managed devices, and downloads patch files to the agent device for later deployment.

◦

Detect and Deploy: Detects and deploys patches to managed devices. These types of actions are used when managing desktops and servers. Detect and Deploy patching jobs require a connection between the device and the appliance; they do not run offline. For more information about messaging protocol connections, see Configure Agent communication and log settings.

◦

Detect, Stage and On-demand Deploy: Detects patches that are installed or missing from managed devices, downloads patch files to the agent device, and causes the Windows system tray on the agent device to alert the user that the patches are ready for deployment. The user can then initiate the deployment process at their convenience.

▪

These schedules are only available for Windows devices with agents version 11.0 or later.

▪

The Agent Status Icon On Device option must be enabled in the agent communication settings. You can find these settings on the Organization Detail page, under Communication and Agent Settings (if one or more Organization components are enabled), or on the Communication Settings page (if you do not have an Organization component). For more information, see Configure Agent communication and log settings.

◦

Deploy: Deploys applicable patches to managed devices. This is useful when you know that specific patches need to be deployed to managed devices. A final Detect job runs either after the patch is deployed or, if a reboot is required, after the device reboots and the Agent reconnects to the appliance.

◦

Detect and Rollback: Detects and removes unwanted patches from managed devices. Rollbacks may not be available for some patches. See Determine whether a patch can be rolled back.

◦

Rollback: Removes unwanted patches from managed devices. Rollbacks may not be available for some patches. See Determine whether a patch can be rolled back.

Detect, Detect and Stage, Detect and Deploy, Detect, Stage and On-demand Deploy, Detect and Rollback schedules only. On the Action page, in the Detect section, specify the detection options for the schedule.

Option

Description

All Patches

Detect all available patches. This process can take a long time. Also, it might detect patches for software that is not installed on, or required by, managed devices. For example, if managed devices use anti-virus applications from only one vendor, you might not need to detect patches for all anti-virus vendors. All Patches, however, detects all missing patches regardless of whether they are required by managed devices. To refine patch detection, set up labels for the patches you want to detect, then use the Patch Labels option.

Patch Labels

Restrict the action to the patches in the labels that you select. This is the most commonly used option.

Click Manage Associated Labels.

In the Select Labels dialog box that appears, drag one or more labels (as applicable) to the Limit Detect to area, then click OK.

To use this option, you must already have Smart Labels for the applicable patches. See Using Smart Labels for patching.

Select from suggested criteria

Select a patch using a pre-defined criteria. This allows you to focus on a specific type of patches based on your OS. For example, you can choose the critical Windows patches issued in the past 30 days.

Click Select from suggested criteria.

In the Select Suggested Criteria dialog box that appears, click Select Suggested Criteria, then click Save.

Detect Timeout

The amount of time, in hours, for the patching action to complete.

Detect and Deploy, Detect, Stage and On-demand Deploy, and Deploy schedules only. In the Deploy section, specify the detection options for the schedule.

Option

Description

All Patches

Deploy all patches to the selected devices.

Patch Labels

Restrict the action to the patches in the labels that you select. This is the most commonly used option.

Click Manage Associated Labels.

In the Select Labels dialog box that appears, drag one or more labels (as applicable) to the Limit Deploy to area, then click OK.

To use this option, you must already have Smart Labels for the applicable patches. See Using Smart Labels for patching.

Select from suggested criteria

Click Select from suggested criteria.

In the Select Suggested Criteria dialog box that appears, click Select Suggested Criteria, then click Save.

Maximum Deploy Attempts

The maximum number of attempts the appliance deploys or rolls back the patch. Specify a number between one '1' and ten "10". If you specify zero '0', the deployment or rollback does not run. A value higher than ten "10" results in an error message.

As a last step in patch deployment or rollback, the appliance verifies whether the patch was deployed or rolled back successfully. If a deployment or rollback fails, the appliance attempts to deploy or rollback the patch again until one of the following occurs:

•

The deployment or rollback succeeds.

•

The maximum number of attempts is reached.

•

The scheduled deployment or rollback period ends and patching is suspended.

Deploy Timeout

The amount of time, in hours, for the patching action to complete.

Detect and Rollback and Rollback schedules only. In the Rollback section, specify the rollback options for the schedule.

Option

Description

All Patches

Roll back all patches on the selected devices.

Patch Labels

Restrict the action to the patches in the labels that you select. This is the most commonly used option.

Click Manage Associated Labels.

In the Select Labels dialog box that appears, drag one or more labels (as applicable) to the Limit Rollback to area, then click OK.

To use this option, you must already have Smart Labels for the applicable patches. See Using Smart Labels for patching.

Select from suggested criteria

Click Select from suggested criteria.

In the Select Suggested Criteria dialog box that appears, click Select Suggested Criteria, then click Save.

Maximum Rollback Attempts

The maximum number of attempts, between 0 and 99, to indicate the number of times the appliance tries to deploy or rollback the patch. If you specify 0, the appliance attempts to deploy or rollback the patch indefinitely.

•

The deployment or rollback succeeds.

•

The maximum number of attempts is reached.

•

The scheduled deployment or rollback period ends and patching is suspended.

Deploy Timeout

The amount of time, in hours, for the patching action to complete.

Detect, Stage and On-demand Deploy schedules only. In the OnDemand Deployment Timeout Settings section, specify the deployment timeout option for the Detect, Stage and On-demand Deploy schedule.

Option	Description
Automatically Deploy After	The amount of time after which the deployment takes place if the agent device does not receive any input from the user.

Click Next.

10.

On the Devices page, specify the devices you want to associate with this schedule.

Option

Description

All Devices

To apply this schedule to all managed devices, select this options. Clear the check box to limit the patch acton to specific labels or devices.

Device Labels

Restrict the action to the patches in the labels that you select. This is the most commonly used option.

Click Manage Associated Labels.

In the Select Labels dialog box that appears, drag one or more labels (as applicable) to the Limit Run to area, then click OK.

To use this option, you must already have Smart Labels for the applicable patches. See Using Smart Labels for patching.

Devices

Run patch actions on the devices that you select.

•

To search for devices, begin typing in the field.

•

To remove all specified devices and start again, click Remove All.

•

Scoped users can see only those devices that are associated with their role, when the role is assigned a label. For more information about user roles, see Add or edit User Roles.

Operating Systems

Select the operating systems of the devices that you want to patch. The default is all operating systems. When this option is configured, the schedule only applies to devices with the selected operating systems.

Click Manage Operating Systems.

In the Operating Systems dialog box that appears, select the OS versions in the navigation tree, as applicable.

You have an option to select OS versions by their family, product, architecture, release ID, or build version. You can choose a specific build version, or a parent node, as needed. Selecting a parent node in the tree automatically selects the associated child nodes. This behavior allows you to select any future OS versions, as devices are added or upgraded in your managed environment. For example, to select all build current and future versions associated with the Windows 10 x64 architecture, under Windows > Windows 10, select x64.

11.

Click Next.

12.

Detect and Deploy, Deploy, Detect and Rollback, and Rollback schedules only. On the Notification page, configure the notification options for the schedule.

Option

Description

Options

The alerts displayed to users when patch actions run. To perform the action without notifying the user, leave the Options field blank.

•

OK: Run immediately.

•

Cancel: Cancel until the next scheduled run.

•

Snooze: Prompt the user again after the Snooze Duration.

Timeout

The amount of time, in minutes, for the dialog to be displayed before an action is performed. If this time period elapses without the user pressing a button, the appliance performs the action specified in the Timeout drop-down list.

Timeout Action

The action to be performed when the Timeout period elapses without the user choosing an option.

Snooze Duration

The amount of time, in minutes, for the period after the user clicks Snooze. When this period elapses, the dialog appears again.

Snooze Until Limit

Select the Snooze Until Limit check box to enable the user to Snooze the patch action a specified number of times. Specify the number of Attempts.

Initial Message

The message to be displayed to users before the action runs. To customize the logo that appears in the dialog, see Configure appliance General Settings with the Organization component enabled.

Progress Message

The message displayed to users during the patch action.

Completion Message

The message displayed to users when the patch action is complete.

13.

Click Next.

14.

In the Reboot section, specify the reboot options for the schedule.

Option

Description

Options

The options for rebooting the managed device:

•

No Reboot: The device does not reboot even though a reboot might be required for the patch to take effect. This option is not recommended because deploying patches without rebooting when required can leave systems unstable. Further, patches that require reboots are only shown as deployed after the reboot.

•

Prompt User: Waits for the user to accept the reboot before restarting the device. If the user snoozes or cancels the reboot, patching stops until a reboot occurs. Selecting a Snooze Duration in the agent dialog box that appears on the target device pauses the reboot prompt for the specified snooze interval.

•

Force Reboot: Reboots as soon as a patch requiring it is deployed. Forced reboots cannot be canceled. Force Reboot works well for desktops and servers. You might not want to force reboot on laptops. Force Reboot works well with servers because they usually have no dedicated users. However, it is important to warn users that services will not be available when servers are being patched and re-booted. See Best practices for patching.

Automatically reboot when no one is logged in

Automatically reboot the managed device if no users are logged in.

Message

The message to be displayed to the user before the device reboots. For information about adding a custom logo to the message dialog, see Configure appliance General Settings with the Organization component enabled.

Timeout

When Force Reboot is selected, the timeout behavior takes into consideration the KUSerAlert and global KACE Agent process timeouts. The global timeout, set through the Agent and Communication Settings section, always determines how long any agent-launched processes can run for, including the KUserAlert timeout. For example, if the KUserAlert timeout is set to two hours, and you set the global timeout to one hour, the agent will stop the KUserAlert because it runs too long. Therefore the global timeout must be set to the desired timeout that is longer than the KUserAlert timeout. This value must be set accordingly.

For more information about agent settings, see Configure Agent communication and log settings.

Timeout Action

The action to be performed when the Timeout period elapses without the user choosing an option.

Reboot Delay (countdown)

Postpone the reboot using a countdown. The countdown is in minutes.

Reboot Now

Reboot the device immediately.

Reboot Later

Reboot the device later.

Number of prompts

The number of prompts the user receives before the device reboots. For example, if you enter a value of 5, the device automatically reboots the fifth time the user receives the reboot prompt. In other words, the user can delay the reboot only four times if the Number of prompts value is set to 5.

Reprompt Interval

The time that elapses before the user is reprompted to reboot.

15.

Click Next.

16.

In the Schedule section, specify options for the schedule.

Option

Description

None

Run in combination with an event rather than on a specific date or at a specific time. This option is useful if you want to patch servers manually, or perform patch actions that you do not want to run on a schedule.

Every _ hours

Run at a specified interval.

Every day/specific day at HH:MM

Run daily at a specified time, or run on a designated day of the week at a specified time.

Run on the nth of every month/specific month at HH:MM

Run on the nth day every month, (for example, the first or the second) day of every month, or a specific month, at the specified time.

Run on the nth weekday of every month/specific month at HH:MM

Run on the specific weekday of every month, or a specific month, at the specified time.

Custom

Run according to a custom schedule.

Use standard 5-field cron format (extended cron format is not supported):

Use the following when specifying values:

•

Spaces ( ): Separate each field with a space.

•

Asterisks (*): Include the entire range of values in a field with an asterisk. For example, an asterisk in the hour field indicates every hour.

•

Commas (,): Separate multiple values in a field with a comma. For example, 0,6 in the day of the week field indicates Sunday and Saturday.

•

Hyphens (-): Indicate a range of values in a field with a hyphen. For example, 1-5 in the day of the week field is equivalent to 1,2,3,4,5, which indicates Monday through Friday.

•

Slashes (/): Specify the intervals at which to repeat an action with a slash. For example, */3 in the hour field is equivalent to 0,3,6,9,12,15,18,21. The asterisk (*) specifies every hour, but /3 restricts this to hours divisible by 3.

Examples:

•

15 * * * * Run 15 minutes after every hour every day

•

0 22 * * * Run at 22:00 every day

•

0 0 1 1,6 * Run at 00:00 on January 1 and June 1

•

30 8,12 * * 1-5 Run weekdays at 08:30 and 12:30

•

0 2 */2 * * Run every other day at 02:00

View Task Schedule

Click to view the task schedule. The Task Schedule dialog box displays a list of scheduled. Click a task to review the task details. For more information, see View task schedules.

Timezone

The timezone to use when scheduling the action. Select Server to use the timezone of the appliance. Select Agent to use the timezone of the managed device.

Run on next connection if offline

Run the action the next time the managed device connects to the appliance, if the device is currently offline. This option is useful for laptops and other devices that are periodically offline. If this option is not selected, and the device is offline, the action does not run again until the next scheduled time.

Delay run after reconnect

Delay the schedule by a specified amount of time. The time delay period begins when the patch action is scheduled to run.

End after

The time limit for patching actions.

For example, if you schedule patches to run at 04:00, you might want all patching actions to stop at 07:00 to prevent bandwidth issues when users start work. To do so, you could specify 180 in the minutes box.

When this time limit is reached, any patching tasks that are in progress are suspended, and their status on Security logs is Suspended.

These patching tasks do not resume on the next run and instead start from the beginning with each scheduled patching action.

17.

Click Save.

The Patch Schedule Summary page appears, displaying the newly created or updated schedule. For more information about this page, see Review patch schedule details. If you added any devices that match the Smart Label criteria, they are automatically included in the patching schedule.

Error codes caused by patching and scripting

The following Fail error codes that can be encountered during patching (Detection or Deployment phase only) or scripting.

Table 30. Error codes encountered during patching or scripting
Error code	Description
8001	The command sent to the plugin unrecognized by the KPluginsKacePatch
8002	Failure parsing the command sent to the plugin
8003	Failure downloading a Manifest file
8004	Failure to extract the downloaded Manifest file
8005	General failure while handling the PreDetect command (for example, invalid function inputs)
8007	Failure to generate PreDetect results
8008	General failure while handling the Detect command (for example, invalid function inputs)
8009	Failure parsing the Detect Manifest file
8010	Failure to generate Detect results
8011	A reboot is pending
8012	Failure to upload a results log
8013	General failure while handling the Detect file (for example, invalid function inputs)
8014	Failure downloading a patch Detect file
8015	Checksum mismatch between the patch Detect file and the detection Manifest record
8016	Failure to create a checksum file for the patch Detect file
8017	Failure to load the patch Detect file
8018	Failure to decrypt the patch Detect file
8019	Failure to unzip the patch Detect file
8020	Failure to parse the json in the patch Detect file
8021	Detection type in the patch Detect file not recognized as a valid detection method
8100	Failure parsing the Manifest file
8101	General failure while handling the Deploy command (for example, invalid function inputs)
8102	General failure while handling the Rollback command (for example, invalid function inputs)
8103	Invalid Handler Specific Data (HSD) type
8150	Checksum mismatch between the requested file and the Manifest record
8151	Failure downloading a requested file
8152	Failure to create a checksum file for a downloaded file
8200	Invalid command scalar operation
8201	Invalid command string operation
8202	Invalid command
8250	Invalid path to the results file
8251	Failure to create a results file