Patch management using altiris




















With Click-to-Run, you download a single executable program that lets you initiate Click-to-Run streaming and application start processes. You can start using the product while the rest of it is being downloaded in the background to a network or HTTP share the default location is Microsoft CDN. When you open an application that is not yet downloaded and installed, Click-to-Run immediately downloads it from there and installs it to the client computer.

By default, Click-to-Run products are updated automatically on client computers. You can disable automatic updating or invoke updating manually in Office menu.

During the update process, the Office updater service ClickToRunSvc connects to the network location that stores the full image of the latest version of Office, and then downloads only the updates for the Office components that are installed in your environment. Thus the download size depends on the number of the installed Office components and the number of the Office files to be updated. For more information, see the following Microsoft articles: Overview of update channels for Office ProPlus Version and build numbers of update channel releases for Office clients Patch Management Solution provides the software bulletin for all supported Microsoft update channels.

The software product that corresponds to the specific update channel. Before you deploy Microsoft Office updates with Patch Management Solution, consider the following: Ensure that you have imported the latest patch management metadata for Windows. By default, when you check the Microsoft bulletin on the Import Patch Data for Windows page, all Microsoft software is selected. If you want to exclude Microsoft Office updates from the patch management metadata import for Microsoft software, on the Import Patch Data for Windows page, under Vendors and Software , check and expand Microsoft , scroll down the list, uncheck all software releases for Microsoft Office Click to Run , and then click Save changes.

For example, if you want to deploy only Microsoft Office updates, you may exclude Microsoft Office updates that are stored in the same bulletin. If you deploy only specific channels of Microsoft Office , on the Import Patch Data for Windows page, under Vendors and Software , check and expand Microsoft , scroll down the list, uncheck Microsoft Office Click to Run , check only the channels that you want to update for example, Microsoft Office Click to Run Office Monthly Channel , and then click Save changes.

If you have updated the list of available software products manually by clicking Update on the Import Patch Data for Windows page, under Vendors and Software , ensure that you have imported the latest patch management metadata for Windows before you change the selection of Microsoft Office software products.

Otherwise the existing Microsoft Office advertisements may be deleted or disabled if the option Delete previously downloaded data for vendors, software and languages that are now excluded is checked on the Import Patch Data for Windows page. This happens because after the software products list is updated, the new software products are available in patch management metadata but have no associations with Microsoft Office updates.

After you select a subset of Microsoft Office software channels on the Import Patch Data for Windows page, Microsoft Office installations of other channels will not be reported in compliance reports. For more information about staging a specific channel for Microsoft Office , see the KB article If you deploy Microsoft Office in multiple languages in your environment, you must select all the languages you need during the patch management metadata import on the Import Patch Data for Windows page, under Languages.

Otherwise, the update process fails on the client computers that use Microsoft Office with the unselected language. Note that selecting each new language increases the size of the update package. The update process for Microsoft Office does not succeed on the client computers where the software is currently running.

The error is typically Exit Code After the user closes the software, Microsoft Office will be updated according to the enabled automatic updating schedule or after the computer restart. Microsoft Office update may fail if the download of update files to endpoint requires more time than the default Office timeout settings allow usually because of network throttling or low network speed.

You have configured the targeted site settings policy to limit the number of outbound data transfers from a site to which the Symantec Management Agent belongs.

The number of outbound connections has exceeded the limit configured in the other site. The update installation process is as follows: Click to Run performs 3 connection attempts in less than a minute, and then update installation fails. Click to Run repeats update installation attempts 3 times with 1h intervals. The repository provides comprehensive data on software bulletins, software updates, installation requirements, and software releases.

A centralized aggregate view of all available patches allows you to easily identify open vulnerabilities ranked by severity. Automatic e-mails alert you when new bulletins are released, so you can identify new vulnerabilities. Some patches can cause system or application instability, so you need to test or stage patches before deploying them. Start the scan immediately when a new or updated policy is received: This setting controls only when a new Windows System Assessment Scan policy targets the Client e.

Disabled: All targeted clients will return all Patch Inventories regardless if they have already been received and processed to the database. Resulting in unnecessary processes for the Management Server. Ensure the targeted count is the proper number of clients that have Patch installed, for there may be a problem regarding the Software Update Plug-in Install or Upgrade policies.

There is no need to add to, or remote from, the targeted filter for this policy. Advisory 2 : When cloning a DSUP policy; always ensure the clone is of the original DSUP policy, for cloning a clone of that policy has been found to cause corruption in the code and database resource associations. Advisory 3 : At least one DSUP policy will need to be enabled to ensure resource associations are established during Patch Package creation process.

Ensure one policy is enabled at all times. The schedule may be deleted altogether if needed; review the behavior of this configuration in HOWTO Installation Schedules tab: Software Update Installation: Schedule : Best practice is to run the Software Update Cycle on a daily repeating schedule to ensure updates install soon.

Windowed Schedule: Also a good practice, for the Software Update Cycle can repeat as needed during a windowed timeframe. Additionally, confirm that the Software Update Policy is not configured to run the Software Update Cycle and leave all Package Options disabled on the Software Update Policy, for that will ensure the packages are merely deployed to the clients and will wait in a 'Scheduled' status until the far future date.

Restart Defaults: Best practice is to configure the reboot at the end of the Software Update Cycle, for that will refresh the client's registry following the update. Some Microsoft Updates will affect the registry in a manner that a reboot is required to install more updates. Setting the Windowed Schedule to run for 4 hours and setting the 'During window, check every' to a 1 hour interval will assist with this, for the Software Update Cycle will execute every 1 hour for 4 hours, and reboot at the end of the Software Update Cycle.

Maintenance Windows: Maintenance Windows override DSUP policy schedules and trigger all patches to immediately install once the window opens. If Maintenance Window Schedules are to be used as the start of the Software Update Cycle; ensure the start date on this schedule is configured to far in the future. Example: Set start date to begin in the year or later, for the product has been designed to ensure that any missed schedules will run ASAP. Also, any further action taken following the download will not be immediate, for it will be queued behind the previous download action.

Staging one month's released updates at a time is generally safe.



0コメント

  • 1000 / 1000