About the patch quality assurance process
Quest provides Patch Management customers more value through the content development and quality assurance processes. The quality assurance teams verify the patch install and uninstall processes as well as the patch metadata produced by the content development team. Providing quality content to our customers is a high priority. To ensure successful delivery of content, Quest executes test cases covering the following test components.
Quest invests heavily in testing infrastructure. The content development and quality assurance teams have access to a virtual enterprise environment representing nodes of various configurations. Quest uses a mix of virtual desktops and servers in addition to custom physical bench testing to ensure that our testing infrastructure is state of the art.
Quest tests with various applications as necessary to ensure the requirements of the patch are satisfied.
Quest uses the following types of testing:
Quest processes are designed and implemented to maximize global availability through a secure content distribution network. All communications with Quest are conducted through encrypted, secure channels to ensure the integrity of security content.
Using a best practice approach, critical security patches are automatically downloaded to customer locations, based on their subscription options. Additional security patches may be downloaded, as necessary, to create a customized version of the KACE Patch Content Repository within the customer’s own secure enterprise environment.
Best practices for patching
Best practices for patching devices include testing patches, using labels to organize devices and patches, and notifying users when systems are being patched.
Test patches on selected devices before deploying them to all devices. This testing ensures that patches do not break anything before they are widely deployed.
When choosing test devices, look for these characteristics:
For a thorough test, devices should function normally for at least a week after being patched. If no problems are reported after a week, the patch can be deployed to the remaining devices on the network.
You can use Smart Labels to automatically group devices by type, such as laptop, desktop, and server. In addition, you can use Smart Labels to automatically group patches by importance, such as critical operating system patches and lower priority patches for other applications. You can then create patching schedules to match each type of device and patch.
See:
There are two options for patching Windows devices:
|
◦ |
Use Windows Feature Update: Windows Update is a Microsoft feature that downloads and installs updates to Windows operating systems. If you enable Windows Update on managed devices, use Patch Management on the appliance only to detect Windows operating system patches, not to deploy them. Patches will be deployed by Windows Update. |
|
◦ |
Use the Patch Management: You can download and deploy patches for Windows operating systems using Patch Management. If you use Patch Management on the appliance, disable Windows Update on managed devices, because patches will be deployed by the appliance. |
Schedule patch deployment during periods when device use is lower to minimize downtime. Keep in mind that device use varies depending on the device type:
|
◦ |
Servers: These require careful and well-publicized upgrades. When patching servers, you might need to plan ahead by several weeks. |
|
◦ |
Desktops: These have more flexible options for patching, because they are often left running when they are not in use. |
|
◦ |
Laptops: These are the most difficult to patch, because they are often only available to patch while being used. |
For more information about creating patch schedules for each type of device, see:
Be sure to notify users when the devices they use are being patched. This is especially important if devices need to be restarted as part of the patching process. There are several ways to inform users of patching schedules:
|
◦ |
Send email or use other messaging systems: Notify users in advance through email and other messaging systems outside the appliance Administrator Console. This notification is especially useful when patching might prevent access to critical systems, such as servers, for a time. |
|
◦ |
Send an alert message from the appliance: Use the appliance Administrator Console to create an alert and broadcast it to all devices or to selected devices. These broadcast alerts can be used to remind users that patching is about to start. |
• For more information on creating alerts, see Broadcasting alerts to managed devices.
For more information about scheduling patching for various devices, see:
Patching jobs can require extensive bandwidth and resources. To reduce the impact on users, you can set time limits on patching jobs. For example, you could configure patching jobs to start at 04:00 and stop at 07:00. Any patching jobs that are in progress at 07:00 are suspended. Jobs resume where they left off when the next scheduled patching job begins. See Configuring patch schedules.
Use Replication Shares to optimize network resource requirements and download time. Replication Shares are devices that keep copies of files for distribution, which can be useful for managed devices that are deployed across multiple geographic locations. For example, using a Replication Share, a device in New York could download patch files from another device at the same office, rather than downloading those files from an appliance in Los Angeles.
For more information on setting up and using Replication Shares, see Using Replication Shares.
Quest Support has a Knowledge Base of articles about the appliance, which you can access at https://support.quest.com/kace-systems-management-appliance/kb. The Knowledge Base is continually updated with solutions to real-world appliance problems that administrators encounter. To view patching articles, go to the Knowledge Base and search for Security.
Subscribing to and downloading patches
To enable patching, you need to subscribe to patches and schedule patch downloads to the appliance.
About patch subscription and downloads
Patch subscription is the process of selecting the operating systems and applications for which you want to receive patches.
If the Organization component is enabled on your appliance, you select subscription settings for each organization separately.
After you subscribe to patches, the appliance downloads them according to the schedule you set. When patches are downloaded, you can test and deploy them. You can choose to automatically deploy patches as well, but such deployment is recommended for low-risk or time-important patches only. See:
When downloading patches using HTTPS, the NTP (Network Time Protocol) service must be running on the appliance. The NTP service is required because the secure protocol uses the current date stamps from the appliance to ensure certificate validity. If the NTP service is not running, patch download failures, suggesting invalid certificates, might result.
