| Table of Contents |
|---|
What is Patch and Update Management?
Patch management and update management is are the regular updating and patching of Operating Systems and applications. Keeping software up to date is important to protect users and their data.
At Carleton, when talking about desktop/laptops, we use the term Patch or KPatch to refer to security patches for third-party applications delivered by the K1000's patching mechanism.
Updates, then, refer to Windows updates delivered by the WSUS server, or macOS updates delivered by the App Store. Also, you can update any of the third party apps listed above by setting their preferences to automatically check for updates or by selecting their check for updates feature. These application updates come directly from the vendor, not through the K1000.
How are Patches Delivered?
...
| Anchor | ||||
|---|---|---|---|---|
|
K1000 (KBOX) Patch Management
All About K1000 (KBOX) Patch Management
How are Updates Delivered?
Apple Software Updates
Updates for the macOS come directly from Apple via System Preferences. You should apply updates whenever they are available, and consider setting up automatic updates.
Windows Software Update Service (WSUS)
Windows computers are configured to receive Microsoft updates from the WSUS server on campus. This server gets Windows operating system patches, as well as patches for Internet Explorer, Office, and other Windows applications from Microsoft. Windows computers check for new updates at least once a day, and they usually find new updates to apply about twice a month, soon after the second and fourth Tuesdays of the month.
McAfee VirusScan
McAfee VirusScan software is set to automatically retrieve updates at least once a day, usually over the noon hour. Computers running Mac OS X get their updates from the McAfee servers. Windows computers check for updates and policies from the Carleton McAfee ePO server every 10 minutes.
...
KBOX Patch Management
...
| name | grey |
|---|
...
The KBOX receives patches from Lumension , a security company. These patches are then delivered to campus computers. Patches in the KBOX are security related patches only. Feature related patches and upgrades are not available from KBOX patch management.
What patches are delivered by the KBOX?
The KBOX delivers security-based patches for the following applications:
- Adobe AIR
- Adobe Acrobat and Adobe Reader
- Adobe Flash Player
- Adobe Shockwave Player
- Some Adobe CS3-CS6 patches
- Citrix Receiver
- Google Chrome (Windows)
- Apple iTunes and QuickTime (Windows)
- Apple Safari web browser (Windows)
- Microsoft Silverlight and Remote Desktop (Mac)
- Microsoft Office (Mac)
- Mozilla Firefox and Firefox ESR
- Oracle Java
- VLC media player
- VMWare Fusion, Player, Workstation
- WinZip and 7-Zip (Windows)
When are patches delivered?
When software vendors release patches, Lumension and KACE test them before making them available to the KBOX. This provides more levels of review to catch any potential problems. The KBOX downloads new patch signatures and patch package files for the operating systems we have selected nightly. Then, Carleton computers use the available patches based on the patching schedule to which each computer is assigned. Some patch schedules check for ("detect") patches at one time, and then apply ("deploy") the detected patches at a different later time. Other patch schedules check for ("detect") patches and then apply them ("deploy") immediately thereafter.
There are 10 different patch schedules to which a computer can be assigned. Each computer, virtual machine (VM), and booting operating system (e.g., dual boot), should be assigned to one and only one patch schedule. Any VM or booting operating system on a computer should be assigned to a different schedule than the computer itself, so you can make sure the correct environment is running at the time of each schedule.
| Panel |
|---|
| Note: We have found it is very difficult to explain these different patch schedules in writing, so please be patient in reviewing this section, and call the ITS Helpdesk at x5999 when you have questions. |
Here is a list of the different patch schedules each in a different color, and below that is a picture of when the different steps (detect or deploy) of each patch schedule runs:
| Section | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
What do I see when the patch schedule steps run?
Every patch schedule step has these characteristics:
- When starting, the KBOX displays an OK/Snooze choice to you for 15 minutes, then proceeds if there was no response.
- If you choose Snooze, the KBOX waits 5 minutes and asks again.
- The KBOX displays a Patching in Progress message continuously until this step is completed.
- If a reboot is needed, the KBOX displays a Reboot prompt to you for 5 minutes, and re-prompts every hour (unless auto-reboots).
This table lists the different patch schedules again with more detailed information:
Again, we know this information is hard to interpret. Please call the ITS Helpdesk x5999 for help.
Which patch schedule should I choose?
It depends on when the computer (or VM or booting operating system) is active and on the campus network, and whether you want patching to compete with your trying to get other work done. In general, if you don't want to be interrupted, choose an EndOfDay or Overnight schedule, and leave your computer powered on and connected to the campus network. If you take your laptop computer home most nights, choose instead a schedule that runs during the day at a time when you may be away from your desk (e.g., Convo). If your laptop computer is seldom on campus at all, choose the Next Check In schedule which will try to run every time you are back on the campus network if you miss the scheduled times. But Next Check In can be very annoying, so choose it only if none of the other schedules works for you.
A note about the NOJava schedules: ...
How do I tell if my machine is on a patching schedule?
- Visit the KBOX user portal in your web browser
- Log in with your Carleton username and password
- Click the My Computer tab
- Scroll down the page to the Activities section
- Click on the Labels link
- If you have a Label beginning with PatchSelf, your machine is on a patching schedule
- Note: If you have a VM, multiple Operating Systems, or multiple computers, you'll need to repeat this process from each VM/OS/computer
How do I join a KBOX patching schedule?
- Visit the KBOX user portal in your web browser
- Log in with your Carleton username and password
- Click the Software Library tab
- In the Search field, type Patch and click Search or scroll down the page until you see the entries beginning with Patch Schedule:
- Click on the desired Patch Schedule
- Read the Installation Instructions and click Install Now
- Note: If you have a VM, multiple Operating Systems, or multiple computers, you'll need to repeat this process from each VM/OS/computer
What if my software is already up-to-date?
KBOX patch management should not reinstall patches that are already applied, nor should it downgrade your applications.
Manual Updates Within Applications
...
Manual Updates Within Applications
Most applications on campus computers have automatic update checking turned on. Verify automatic update checking is enabled for Adobe Acrobat, Adobe Reader, Adobe Flash Player, Firefox, Google Chrome, Java, and Office for the Mac or contact the ITS HelpDesk (x5999). These applications also have an option to check for updates on demand.
What About Exceptions?
If there is a technical reason that your software cannot be updated, or a custom schedule is needed, contact ITS HelpDesk (x5999).