KACE SMA Patching - Best Practices and Recommendations (4360197)

Best practices for patching devices include testing patches, using labels to organize devices and patches, and notifying users when systems are being patched. This article provides recommendations to achieve best patching results and what are the requirements that need to be meet before testing and executing a patching activity using KACE SMA.

Recommendations when setting up and using KACE patching:

1.  Check Ports and URL’s 

Websites that must be accessible to the KACE SMA – Patch download requires ports and URL’s to be white-listed. For additional information and details review web resources listed below.

• Websites that must be accessible to the K1000 appliance
• Which network ports and URLs are required for the KACE SMA appliance to function? (4211365)

2.  Set up and review Patch-subscription workflow / Download settings

Patch-subscription allows selection of desired patches (based on publishers) prior proceed setting up patch downloads and downloading patches. For additional details see patch subscriptions and patch download settings.

Other useful resources, refer to the following articles:

Configuring KACE SMA Patch Subscription options (4284511)

KACE SMA patch status showing as “downloading” (4288925) (This article provides information about Patch Download settings and how each of its options operate)

3. Patch Smart Labels - Using Smart Labels for patching

• Use Patch Smart Labels to automatically group patches, patches are automatically applied and removed based on smart label criteria.
• Apply Patch Labels on Detect / Deploy respectively to address patching activities quicker;  it restrict patches to be detected / deployed based on Patch Label criteria

Note: Detect "All patches" will detect all available patches (Patches in available in catalog - Active Patches). This process can take a long time; detects all missing patches regardless of whether they are required by managed devices and Deploy "All Patches" deploy all patches depending on Detect Results.

How to create and use smart labels, see Using Smart Labels for patching .

Click To See Full Image.

4.  Test patches before deploying them 

This testing ensures that patches do not break anything before they are widely deployed. When choosing test devices, look for these characteristics:

• Devices whose users are technically sophisticated and can communicate problems effectively.
• Devices that have access to the systems and software that reflect the working environment.

For a thorough test, devices should function normally for at least a week after being patched. If no problems are reported after a week, the patch can be deployed to the remaining devices on the network.

5. Use labels to organize devices

• Use Device Smart Labels to automatically group devices by type, such as laptop, desktop, and server. 
• After Device Smart Label is created the appliance evaluates the information provided by the Agents when they check in (computers), and it applies device Smart Labels if the data matches the label criteria (Device Smart Label).

Additional information about Device Smart Labels, see Adding Smart Labels for devices.

6. Configuring patch schedules

• Detect, deploy and rollback task selection take place in patching schedule configuration; appropriate and balanced schedule configuration provide best patching results and faster patching completion time.
• When creating and/or using multiple patching tasks, it is recommended alternate patching schedules by 60 min to prevent handshake errors or delays deploying patching tasks.

Details about patch schedule configuration, see Configuration patch schedule.

7. Replication shares: .

Use Replication Shares to optimize network resource requirements and download time. Replication Shares are devices that keep copies of files for distribution, which can be useful for managed devices that are deployed across multiple geographic locations.

For example, using a Replication Share, a device in New York could download patch files from another device at the same office, rather than downloading those files from a KACE SMA in Los Angeles.

For more information on setting up and using Replication Shares, see Using Replication Shares . Other useful resources - How to create a replication share to save bandwidth on KACE SMA file transfer tasks (4304748).

8. Troubleshooting patching issues and errors - review following articles below:

• What items to check for when getting "HANDSHAKE error" during a scheduled patching job? (4293859)
• What does "Error (Log Upload Failed)" mean in the Current Phase of the schedule? (4293657)
• Error Message: Your patch subscription has expired. Please contact support for assistance. (4209672) - (Patch Subscription expired can affect patch downloads causing patching activities to be delayed or not complete)
• KACE SMA patch status showing as “downloading” (4288925)

For aditional questions or having issues with patches and need further assistance feel free contact us - KACE Support.