Patch Management

[CoachIT]

Has anyone within this forum group deployed a patch management solution like BigFix or KACE? I've started looking into these vendors and want from feedback from real users.

[Infiltrator]

I've never really used it and the company I work for deploys the patches via group policies, when they are available.

[CoachIT]

I've never really used it and the company I work for deploys the patches via group policies, when they are available.

I'm using WSUS within my GPOs, however I would like to deploy a patch management solution for my non MS applications from adobe, apple, java... etc

[digip]

From my understanding, if the software in question has an msi alternative installer, or uses one by default, you can push them out with GPO/Active Directory. If the programs only use .exe's, then you can use something like LanGaurd : http://kbase.gfi.com/showarticle.asp?id=KBID003162

I think BigFix still requires the user to update the files manually, and only notifies you of updates, as where with LanGaurd it will do the installs silently and also you can use PsExec and some scripting to push updates as well. I've never done this myself or used LanGaurd, but I've come across the same question before and picked up the tips reading somewhere before.

[dongle]

I used to use WSUS but It's a pain configuring the group polices to work on both XP and Vista in a mixed environment. Plus I didn't like the fact that it's 'pull' rather then 'push' management.

I've been using GFI LanGaurd for 2 years now and I really like it. You can asses clients security (patches, open ports, miss configured polices) no matter the OS, and deploy patches via Push. You can also retract patches and sofware which is great for rollbacks.

One other thing I like is you can also deploy non MS software, basically any .EXE. You can add custom switches to the installation allowing for silent installs are custom package configuration.

http://www.gfi.com/lannetscan

[kickarse]

I've demo'd Languard (great price) but use PatchLink (very expensive) and WSUS. I find that Patchlink is very thorough but the agents sometimes go corrupt. WSUS works find but only for MS patches (although Eminentware has software that will addon to it so you can install third party software).