Novell ZENworks®
Patch Management

Geoff Gilbert

Engineering Manager, Novacoast, Inc

ggilbert@novacoast.com

John Vindiola

Engineering Manager, Novacoast, Inc

jvin@novacoast.com

http://www.novacoast.com/brainshare

Agenda

Novacoasts Methodology to Patch Management

Design Considerations

Patching Methodologies

Optimizing Deployments

Demonstration

Questions and Answers

Novacoast, Inc.

Company Facts

Founded in 1996

Based in Santa Barbara, California

Professional Services company with practice areas that have been built around key engineers who specialize in a given technology

Additional offices in Oregon, Utah, Arizona, Nevada, and throughout California

Named Novell “Partner of the Year” for 2003 and 2004

Receiving our fifth Service Excellence Award

ZENworks 6.5 Patch Management
Novacoasts Methodology to Patch Management

Patch Management is not Desktop Management

Don't Replace Desktop Management with a Patch Management solution

Manage Desktops with ZENworks Desktop Management

Use ZENworks Patch Management to keep Operating Systems current

Subscription Service stops you from creating scripts to deploy updates 2 or more times a week.

Cross Platform so you can keep multiple operating systems up to date.

ZENworks 6.5 Patch Management
Novacoasts Methodology to Patch Management

Deploy Patches that meet your business needs and concerns

Not all Patches need to be applied

You control your environment

ZENworks 6.5 Patch Management
Design Considerations

Basic Design

Single Site < 8000 nodes

Tiered Design

< 8000 Nodes

Multiple Sites high Bandwidth Connections

Multiple Sites low Bandwidth Connections

Multiple ZENworks Patch Management Server Design

> 8000 Nodes

Multiple Sites

ZENworks 6.5 Patch Management
Design Considerations – Basic Design

ZENworks

Patch Management

Server

ZENworks Patch Managemtent

Single site < 8000 Workstations

100MB Environment

Types of Business

Privite, Public, Government, etc

Patch Agents

ZENworks 6.5 Patch Management
Design Considerations – Tiered Design – High Bandwidth

Types of Business

Privite, Public, Government, Educational, etc

Main Corporate Site

ZENworks Patch

Management

Server

WAN/Campus Site

WAN/Campus Site

Patch Agents

Patch Agents

100MB Link

ZENworks 6.5 Patch Management
Design Considerations – Tiered Design – Low Bandwidth

Types of Business

Privite, Public, Government, Educational, etc

Main Corporate Site

ZENworks Patch

Management

Server

WAN/Campus Site

WAN/Campus Site

Patch Agents

Patch Agents

1.4MB Link/VPN

Distribuiton

Point / Cache

Distribuiton

Point / Cache

ZENworks 6.5 Patch Management
Design Considerations – Multiple Patch Management Servers > 8000 nodes / Site Management

Types of Business

Privite, Public, Government, Educational, etc

Main Corporate Site

ZENworks Patch

Management

Server

WAN/Campus Site

WAN/Campus Site

Patch Agents

Patch Agents

1.4MB Link/VPN

ZENWorks Patch Management Server

ZENWorks Patch Management Server

ZENworks 6.5 Patch Management
Patching Methodologies

Most mistakes are made in deciding how you are going to deploy your patches

What criteria will you use to group workstations for deployment?

Business Group

Workstation Role

Ability to reboot workstation/server

Minimum Requirements

ZENworks Patch Management Server Platform

ZENworks 6.5 Patch Management
Hardware/Software Requirements

Server Recommendations

Distribution Server

Database

Hardware

# of

Agents

CPU

# of CPUs

RAM

Network

HD

CALs+

Database+

CPU+

RAM+

Network+

<1000

<200

<3000

<5000

<8000

2.4Ghz

1.4 Ghz

XEON 2+Ghz

XEON 2+Ghz

XEON 2+Ghz

1

1

1

2

4

1GB

.5GB

2GB

3GB

4GB

100Mb

100Mb

100Mb

2100Mb

1GB

PLUS 60 GB

PLUS 40 GB

PLUS 100 GB RAID 5

PLUS 120 GB RAID 5

PLUS 200 GB RAID 5

Per Proc.

5

Per Proc.

Per Proc

Per Proc.

SQL Server

MSDE

SQL Server

SQL Server

SQL Server

1.4Ghz

1.4Ghz

2.4Ghz

2.4Ghz

2.4Ghz

256MB

256MB

512MB

512MB

1GB

100MB

100MB

100MB

100MB

100MB

Windows Server 2000 or 2003 Standard or Enterprise Edition

Server must not be a DC and may or may not be a part of the Primary Domain

IIS with .NET and ASP Installed

ZENworks 6.5 Patch Management
Discover Applicable Updates (DAU)

3 Scans

How often will it run?

Scheduled every day

Will schedule itself after successful deployment

This updates system to show update actually installed

Manual run

How long will it take?

Can I shorten it up?

ZENworks 6.5 Patch Management
Agent Installation

Manual

Ideal for Lab

Deployment

Login Script

Users must have local Administrative rights

Domain Deployment

Windows Domain (not local administrator user)

Agent Management Center

Domain Wide deployment wizard

ZEN Application Deployment

ZENworks 6.5 Patch Management
Agent Installation - Manual

ZENworks 6.5 Patch Management
Agent Installation

Agent Management Center

Domain Wide Deployment Wizard

ZENworks 6.5 Patch Management
Deployments

Preferred Deployment Method

Group Deployments

Never deploy with Build in OS Groups

Deployment Scenario

Receive Notification of new Package

Check to see if it is a package you want to deploy

Deploy to test computer (ensure no blue screen)

Deploy to test group (real users)

Deploy to distribution groups / Add to Mandatory Base Line

Single Workstation Deployment

ZENworks 6.5 Patch Management
Deployments

ZENworks 6.5 Patch Management
Deployments

ZENworks 6.5 Patch Management
Deployments

Chain Deployments

With or Without Reboot

Monitoring if a workstation has restarted

Manditory Base Line

Filter packages

Without Reboot / With Reboot when you want it

Controlling Notifications – Setting Proper times

Other Options -PLNP How to disable windows notification of package

Controlling Workstation Reboot

Reboot at end of day

ZENworks 6.5 Patch Management
Chain Deployments

Use the chain deployment to deploy multiple packages before reboot

Suppress Final Reboot if users restart computers daily

If you do not Suppress Filan Reboot, set reboot options on all packages

ZENworks 6.5 Patch Management
Manditory Base Line - Filter

Filter Brings up only packages needed in that group

ZENworks 6.5 Patch Management
Notification Settings

If the user does nothing it will take 4 hours 10 minutes before the deployment takes place.

If the workstation is at a login screen it will take 4 hours and 10 minutes for the deployment to take place.

ZENworks 6.5 Patch Management
Reboot Settings

After deployment if nothing is done it will be 4 hours and 10 minutes before workstation is restarted

If the user restarts the workstation, that clears the reboot status

Is you cannot have workstations restart during the day set the settings to wait 10 hours after the deployment

Take into account agent communication times

ZENworks 6.5 Patch Management
Demonstration (cont.)

Advanced Features

Patchlink Distribute Point

Creating your own packages

Deployments

Single workstation deployments

Chain deployment

Mandatory Base Line

Maintenance

Server Maintenance

Database Maintenance

Workstation Maintenance

Demonstration

Questions

Novell Corporate Presentation Template 2005

2003-12-08T12:43:39