What What is Patch Management?
Patch management is the regular updating and patching of Operating Systems and applications. Keeping software up to date is important to protect users and their data.
...
Windows computers are configured to receive Microsoft updates from the WSUS server on campus. This server gets Windows Operating System operating system patches, as well as patches for IEInternet Explorer, Office, and other Windows application patches applications from Microsoft.
McAfee AntiVirus
McAfee AntiVirus Windows computers check for new updates at least once a day, and they usually find new updates to apply about twice a month, soon after the second and fourth Tuesdays of the month.
McAfee VirusScan
McAfee VirusScan software is set to automatically retrieve updates at least once a day, usually over the noon hour. Computers running Mac OS X get their updates from the McAfee servers on a regular basis. Carleton will be transitioning to an EPO server. An EPO server will allow for a brief testing period before releasing updates to campus computers.. Windows computers check for updates and policies from the Carleton McAfee ePO server every 10 minutes.
| Anchor | ||||
|---|---|---|---|---|
|
...
KBOX Patch Management
...
The KBOX receives patches from Lumension , a security company. These patches are then delivered to campus computers. Patches in the KBOX appear to be are security related patches only. Feature related patches for the applciations listed below and upgrades are not available in the from KBOX patch management.
How do I tell if my machine is on a patching schedule?
...
...
How do I join a KBOX patching schedule?
- Visit the KBOX user portal in your web browser
- Log in with your Carleton username and password
- Click the Software Library tab
- In the Search field, type Patch and click Search or scroll down the page until you see the entries beginning with Patch Schedule:
- Click on the desired Patch Schedule
- Read the Installation Instructions and click Install Now
- Note: If you have a VM, multiple Operating Systems, or multiple computers, you'll need to repeat this process from each VM/OS/computer
What patches are delivered by the KBOX?
The KBOX delivers security-based patches for the following applications:
- Adobe AIR
- Adobe Acrobat and Adobe Reader
- Adobe Flash Player
- Adobe Shockwave Player
- Some Adobe CS3-CS4 CS6 patches
- Citrix Receiver (Windows)
- Firefox
- Flash Player
- Google Chrome (Windows)
- Apple iTunes and QuickTime (Mac and Windows)
- JavaApple Safari web browser (Windows)
- Microsoft Silverlight and Remote Desktop (Mac)
- Microsoft Office (Mac)
- QuickTime Player (Mac and Windows)
- Safari (Mac and Windows)
- Shockwave Player
- Mozilla Firefox and Firefox ESR
- Oracle Java
- VLC media player (Windows)
- VMWare Fusion, Player, Workstation
- WinZip and 7-Zip (Windows)
...
When software vendors release patches, Lumension tests and KACE test them before making them available to the KBOX. This provides a second level more levels of review to catch any potential problems. The KBOX downloads patches on a nightly basis. Carleton computers are set to check for patches on one of the following schedules:
...
- this schedule is recommended for computers connected to the campus network at 5:55 am
- computers should automatically power on at 5:40 am (Wake on LAN)
- at 5:55 am the KBOX will detect and deploy patches
- the KBOX will suspend pending tasks after 3 hours
- if a patch is actively being installed at the 3 hour mark, it will continue installing
- if a reboot is required, users will be prompted to reboot. After 5 minutes a reboot will be forced and patching will continue
...
- This schedule is recommended for computers connected to the campus network on Tuesday/Thursday from 12-1 pm
- Tuesday at 12:05 pm the KBOX will detect which patches need to be deployed
- no patches will be deployed at this time
- the KBOX will suspend pending tasks after 50 minutes
- Thursday at 12:05 pm the KBOX will deploy patches
- based on the patch list compiled on Tuesdays
- the KBOX will suspend pending tasks after 30 minutes
- if a patch is actively being installed at the 30 minute mark, it will continue installing
- if a reboot is required, users will be prompted to reboot but a reboot will not be forced
...
- This schedule is recommended for highly-mobile computers, or computers that are rarely connected to the campus network
- Friday at 4:00 am the KBOX will detect which patches need to be deployed
- if the computer is not connected to the campus network at this time, a detect will run the next time it is connected
- no patches will be deployed at this time
- the KBOX will suspend pending tasks after 60 minutes
- Thursday at 12:05 pm the KBOX will deploy patches
- if the computer is not connected to the campus network at this time, a deploy will run the next time it is connected
- based on the patch list compiled previously
- the KBOX will suspend pending tasks after 30 minutes
- if a patch is actively being installed at the 30 minute mark, it will continue installing
- if a reboot is required, users will be prompted to reboot but a reboot will not be forced
...
- this schedule is recommended for computers connected to the campus network at 5:00 pm
- at 5:00 pm the KBOX will detect and deploy patches
- the KBOX will suspend pending tasks after 5 hours
- if a patch is actively being installed at the 5 hour mark, it will continue installing
- if a reboot is required, users will be prompted to reboot. After 5 minutes a reboot will be forced and patching will continue
...
- no patches will be deployed at this time
- the KBOX will suspend pending tasks after 50 minutes
...
new patch signatures and patch package files for the operating systems we have selected nightly. Then, Carleton computers use the available patches based on the patching schedule to which each computer is assigned. Some patch schedules check for ("detect") patches at one time, and then apply ("deploy") the detected patches at a different later time. Other patch schedules check for ("detect") patches and then apply them ("deploy") immediately thereafter.
There are 10 different patch schedules to which a computer can be assigned. Each computer, virtual machine (VM), and booting operating system (e.g., dual boot), should be assigned to one and only one patch schedule. Any VM or booting operating system on a computer should be assigned to a different schedule than the computer itself, so you can make sure the correct environment is running at the time of the schedule.
Which patch schedule should I pick?
It depends on when the computer (or VM or booting operating system) is active and on the campus network, and whether you want patching to compete with your work. In general, if you don't want to be interrupted, choose an "End of Day" or Overnight schedule, and leave your computer on and on the campus network. If you take your laptop computer home most nights, choose a schedule that runs during the day at a time when you may be away from your desk (e.g., Convo). If your laptop computer is seldom on campus at all, choose the Next Check In schedule which will try to run every time you are on the cmapus network.
Carleton computers are set to check for patches on one of the following schedules:
How do I tell if my machine is on a patching schedule?
- Visit the KBOX user portal in your web browser
- Log in with your Carleton username and password
- Click the My Computer tab
- Scroll down the page to the Activities section
- Click on the Labels link
- If you have a Label beginning with PatchSelf, your machine is on a patching schedule
- Note: If you have a VM, multiple Operating Systems, or multiple computers, you'll need to repeat this process from each VM/OS/computer
How do I join a KBOX patching schedule?
- Visit the KBOX user portal in your web browser
- Log in with your Carleton username and password
- Click the Software Library tab
- In the Search field, type Patch and click Search or scroll down the page until you see the entries beginning with Patch Schedule:
- Click on the desired Patch Schedule
- Read the Installation Instructions and click Install Now
- Note: If you have a VM, multiple Operating Systems, or multiple computers, you'll need to repeat this process from each VM/OS/computer
What if my software is already up-to-date?
KBOX patch management should not reinstall patches that are already applied or , nor should it downgrade your software.
Manual Updates
...