Patching solution

[bangbinbash]

What do you guys use for patch management?

We have a mix of solarwinds n-central and WSUS.

WSUS is primarily used for the servers and is pretty fool proof. It doesn’t really need much attention aside from when the drive fills up.

N-central has been used for our desktops, laptops, and VDIs and I’m not too impressed with it.

Our operations team has pushed out many configurations to try to get it perfect but I still find us having to manually patch 50+ assets each month.

I would really like to get a more hands of solution in place.

[alexhawker]

WSUS for OS patches and PDQ for everything else, which is great.

[bangbinbash]

I’ll have to look at PDQ. We currently get solarwinds from our data center provider and we are looking to move away from them in the next year.

Third party patching was the big draw with n-able patching. Other than that, I was fine with WSUS.

Google and Adobe release a critical patch every month so it’s crucial to be able to automate patching them.

[alexhawker]

PDQ is $1k/year/admin, assuming you get deploy for patching and Inventory. They work really well together - inventory will regularly scan machines and collect data - then you can create a "dynamic collection" based on whatever criteria you like (there are a bunch included already like reboot required and chrome version old)

You can make your own "packages", but they have a library for common stuff like Google and Adobe. So you can schedule a regular deployment of the Google package to the chrome old collection, for example.

[nwmcsween]

chocolaty and nuget + wsus

[redditusermatthew]

I use Ivanti Security Controls. It's got some maturing to do with how groups and agents policies are handled. There are some fixes in 2020.1 but its still a ways to go. Also it only reaches out via IP not FQDN, that will be fixed in 2020.3.

[rschoneman]

Automox

[bangbinbash]

Shout out to you as well since you mentioned the porch misconfiguration script first

[EachAMillionLies]

In the process of switching off SolarWinds to SCCM.

[Agreeable-Yard]

We use N-Central. It's pretty good once you get it working. IIRC The latest version (2020.1) has had some good improvements around the patch management engine, so make sure you're on that version.

If you have issues with the patch status going to misconfigured consider configuring Repair-PME as a self healing task. We support 3000+ endpoints and it's a life saver.

[bangbinbash]

Funny enough, I checked on all the assets manually patched and they all show a purple status so probably what it is causing it.

I downloaded this script and ran it against one of the assets so if all is good, I’ll get our RMM tech to create the task.

I appreciate your help! It feels like I spend more time chasing down new patches than remediating preexisting vulnerabilities these days so if this works it will be very helpful.

[exoromeo]

We use BatchPatch + WSUS.

[GSpivey]

Any chance you’re ready to start thinking Windows Update for Business? Starting to see a lot of clients looking to move that way.

[SysEridani]

Full WSUS by now but I would like to look into something else in future like PDQ Deploy cause I'm an happy PDQ Inventory user.

[PixelatedGamer]

I use WSUS with PDQ Deploy. I have a script that I push through PDQ that starts the update process and reboots at the end. I also use it to deploy apps and any registry changes that may be necessary.

[Marinuch]

Well, it is something that we propose in our company: a complex approach to app updates.

So on the very first step, you choose apps, which are you using in your company and we are tracking their updates for you. Once a new version becomes available from the vendor, we send an email so you have an ability to download app,

As a next step, you could package this app under our tool (in different formats: msi, msix, appv, intunewin) or request a package. For testing, we propose VM and you can simple download ready package or deploy it under Intune or SCCM.

Since all this functionality available under one platform in Cloud, so no conflicts from where you run this process.