KACE Systems Management Appliance 14.0 Common Documents - KACE Service Desk Administrator Guide

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Security, then click Patch Management.

On the Patch Management panel, in the Subscriptions section, click the Define available patches link .

The Patch Status tab provides several details about the latest patch download and appliance disk space. Here you can also determine if newly downloaded patches should be marked as active or inactive by default.

Option	Description
Activate New Patches	Mark new patches as Active. This setting enables patches that match your subscription settings after every download. If this option is not selected, new patches are marked as Inactive. This enables you to test patches before they are deployed.

Specify the settings in the Subscription tab. The operating systems and locales specified in the subscription control the patches that are downloaded.

Option	Description
Windows Operating Systems	Download patches for the selected Windows operating systems. Click the edit button to manage the list of operating systems: . Select All Windows in Inventory to select the Windows operating systems based on managed devices. To ignore Windows operating system patches, select Disabled. Or, select the check boxes next to one or more Windows operating systems. Selected items are displayed after you save the settings.
Mac Operating Systems	Download patches for the selected Mac operating systems. Click the edit button to manage the list of operating systems: . Select All Mac in Inventory to select the Mac operating systems based on managed devices. To ignore Mac operating system patches, select Disabled. Or, select the check boxes next to one or more Mac operating systems. Selected items are displayed after you save the settings.
Locales	Download patches for the selected languages. Click the edit button to manage the list of locales: . Select All Locales to download patches regardless of the locale or select the check boxes next to one or more locales. Selected items are displayed after you save the settings.

NOTE: At least one operating system and one locale must be selected for a patch subscription.

Specify the Application Patches settings. These settings are used to determine the patch status once the patch files are downloaded. This can be active, inactive or disabled.

Option

Description

Publishers

Subscribe to applications patches based on its vendor. Click the edit button to manage the selected types: . Select All Publishers to select patches from all available publishers. Or, select the check boxes next to one or more publishers.

Selected items are displayed after you save the settings.

Specify the subscription's Advanced Options.

Option

Description

Classification

Click and select a type of this subscription. You can choose to select All Classifications, to make it Disabled, or click Select Classification, and choose one or more of the existing values, as applicable: Critical Updates, Definition Updates, Feature Packs, Full Software, Hotfix, Security Updates, Service Packs, Tools, Update Rollups, Updates, and Upgrades.

Severity

Click and select a severity of this subscription. You can choose to select All Severities, to make it Disabled, or click Select Severity, and choose one or more of the existing values, as applicable: Critical, Important, Low, Moderate, and Recommended.

Labels

Download only those patches that match the selected labels. Click Manage Associated Labels to select the labels.

This refinement is important when disk space is limited. If the total disk space required for selected patches exceeds the space available on the appliance, patches cannot be downloaded.

NOTE: Appliance disk space information appears in the Patch Status section at the top of the page.

Disable Windows Embedded Patches

Identify and disable any embedded Windows patches. When this option is selected, the signatures for embedded patches are downloaded, but they cannot be deployed unless they meet the subscription criteria.

Inactivate Superseded Patches

Mark patches that have been superseded to the Inactive state after every download. Inactive Superseded Patches are identified with Inactive on the Patch Catalog page.

Detect Disabled Patches

Enable the appliance to identify disabled patches when it runs a Detect job. If this option is selected, the signatures for disabled patches are downloaded for detection purposes only. Patches cannot be deployed unless they meet the subscription criteria.

Click Save.

Selected patches are downloaded automatically at the next scheduled download time. If a patch does not match the subscription settings after download, it appears as Disabled. If a patch matches the subscription settings but it is either superseded or manually set to inactive, the state appears as Inactive.

Select patch and feature update download settings

The patches and Widows Feature Updates you subscribe to are downloaded to the appliance according to the settings you choose.

Be aware that the first patch download might use a large amount of network bandwidth.

Go to the Patch and Feature Update Download Settings page.

◦

If the Organization component is not enabled on the appliance, on the left navigation bar click Security.

◦

If the Organization component is enabled on the appliance, log in to the appliance System Administration Console, https://appliance_hostname/system, or select System in the drop-down list in the top-right corner of the page, then select Settings > Control Panel.

In the Patch and Feature Update Download Settings section, click the Configure File Downloads link.

In the Configure File Downloads tab, select the following options.

Option

Description

Patching

•

Disabled: Prevents the downloading of patch packages. This prevention includes the installers that are required to install the patches.

•

All subscribed files: Maintains a full cache of subscribed packages on your appliance. This option downloads all deployment packages to which you subscribe, without checking to determine whether they are required for your environment. It is important for some environments to maintain a full cache. For example, if you select the Offline Target or Online Source option, full caching is required.

•

Files detected as missing: Allows the appliance to determine which packages to download based on the results of Detect jobs. If a patch detection signature has been detected as Not Installed on any managed device, the patch package is downloaded. If no managed devices are detected as Not Installed, no packages for this patch are downloaded.

Feature Updates

•

Disabled: Prevents the downloading of Windows Feature Updates. This prevention includes the installers that are required to install the patches.

•

Files detected as missing: Allows the appliance to determine which packages to download based on the results of Detect jobs. If a Feature Update signature has been detected as Not Patched on any managed device, the Windows Feature Update package is downloaded. If no managed devices are detected as Not Updated, no packages for this Windows Feature Updates are downloaded.

Delete unused files after __ days

Deletes patches and Windows Feature Updates that have not been deployed in the specified number of days. Patches and Windows Feature Updates that are marked as Inactive or Disabled are automatically deleted during the patch download process.

In the Configure Offline Update tab select the following options.

Option	Description
Offline Update	The action to take if the appliance is offline when the update process is scheduled to start. Clear the Offline Update option if the appliance is expected to be connected to the internet and can download patches or Windows Feature Updates directly.
Offline Target	The Offline Target to use if the appliance is not connected to the internet, and you want to upload the patch and Windows Feature Update files from a local directory. If you have a appliance that is connected to the internet, you can configure that appliance as an Offline Source. Then you can manually copy the patch files from the Offline Source Patches file share to the following directory on the Offline Target: \\appliance_host\patches. Click Upload to load patch TAR files.
Online Source	Whether the appliance is used as a source for a different appliance. When this option is selected, patch files are downloaded to the appliance’s Patch and Windows Feature Update file share.

In the Actions tab, select the following options.

For each type of updates (Signature, Feature Update Files, Patch Files), it provides a description and access to the available actions:

•

Check for Update: Click to download patch signature files.

•

Delete: Click to immediately remove all patches or Windows Feature Updates from the appliance. This can be useful if you no longer need any patches and you want to quickly reclaim the disk space that they used.

•

Run Now: Click to immediately download the patches or Windows Feature Updates to which you have subscribed, regardless of the subscription schedule.

Select schedule options for patch and Windows Feature Update signatures in the Schedule section. File signatures include the security bulletins and other files that define patches and Windows Feature Updates downloaded from Quest.

Option

Description

Signature Download

Select None to prevent the downloading of patch and Windows Feature Update signatures.

Every __ hours

Downloads signatures at a specified interval. Use caution when specifying frequent intervals (4, 8 or 12 hours), because this can increase bandwidth requirements.

Every day at the specified time

Select day to download patch or Windows Feature Update detection signatures every day, or select a day of the week to download once a week.

Select the time to start the download. Time is displayed in 24-hour clock format, where 0 is midnight, 1:00 a.m. is 1 and 11:00 p.m. is 23.

NOTE: When setting up patch or Windows Feature Update downloads, timing is important. The appliance activity log is created at 1:30, and maintenance tasks occur between 01:00 and 01:30. Quest recommends that you schedule downloads to occur after the log and maintenance tasks are complete, which is about 3:00.

On the nth of every month or on a specific month at HH:MM

Select the day of the month to download patch or Windows Feature Update detection signatures on a monthly basis.

Set the Schedule options for feature update and patch files.

Option	Description
After signature download	Downloads packages after the signatures have been downloaded. This option is not available if Patching is disabled in the Configure File Downloads section.
Every __ minutes	Specifies the frequency with which packages are downloaded. This option is available only if Files detected as missing in the Configure File Downloads section is selected.
Download Blackout: Start __ End __	Specifies a time period during which files cannot be downloaded. For example, use an early morning stop time to prevent the process from using a large amount of network bandwidth during regular working hours. If you select this option, the appliance stops file downloads at the specified time. It does not start file downloads again until the next specified download time. When the download resumes, it starts up where it left off. Downloads that are incomplete might not appear on the Patch Catalog or Windows Feature Update Catalogpage.