The Labtech 11 New Patch Manager: A No-Nonsense Guide to the Basics
Ok, so you have upgraded to Labtech 11, installed the new patch manager, and want to get it configured. There's just one problem, You don't know how and the documentation isn't making much sense. Well here is one method for getting things up and running that I've found to work nicely. We'll walk you through step by step. Bear in mind that this example may not be perfect for everyone but will hopefully help you better understand how the pieces fit together.
Step 1: Have a Plan
I highly recommend that you decide on your patching strategy before beginning. I typically put together a speadsheet that looks something like this:
I typically recommend being granular with your groups and how you break it out because it makes adjusting later much easier. It takes more time, but being thorough is always better.
For each group (IE Client1\servers, Client1\workstations) make the following decisions:
- Is the Windows Update Interface going to be available when you log in?
- What day and window should it patch in?
- When should it reboot? Should it reboot at all or create a ticket?
- If you're using a Test and\or Pilot stage (more to come on that), which machines in that group should be in those stages?
- Of all of the patch categories, which can automatically be approved, which should be ignored or denied, and which do you want to handle manually?
So for the sake of example lets say we've decided client1\workstations are going to be patching on Tuesdays 2:00 AM - 4:00 AM, Rebooting on Sundays from 12:00 AM to 2:00 AM, the Windows Update UI will be disabled, we've defined our auto approvals, and WKS 1 will be in the Pilot Stage of deployment.
Step 2: Organize the Group
I prefer and recommend to create a group outside of the patch manager that we will import. By doing this we can also monitor patching differently per group should we want to as well as any other sort of automation.
- Create your search
Create a saved search that encapsulates the machines you want in the group and save it.
- Create a Custom Group and populate it using the Saved Search we just created:
For more information on creating a custom group reference this article:
http://www.comprehensivemsp.com/single-post/2016/09/27/How-to-Create-and-Populate-Custom-Groups-in-Labtech
3: Import the Group into the Patch Manager
- Open the Patch Manager and click on configuration in the top right hand side:
- Once in configuration click the group button and choose "Add Existing Group"
- Choose the Appropriate Group and Click OK
Now that you have your group, it needs 3 things, all of which once created can be applied to multiple groups:
4: Create a Microsoft Update Policy
- Click Microsoft Update Policies
- Click the plus button to add a new policy. In this scenario we will do the following:
1: Name the Policy
2: Select the Windows Update Agent Mode. In this case Managed Mode which uses Labtech for Patching and disables the Windows Update UI.
3: Select the patching day
4: Select the start and end time
5: I usually select create windows system restore point as well
6: Click Save
5: Create a Reboot Policy:
- Click Reboot Policies
- Click the plus symbol to add a new policy in this instance we will do the following:
1: Name the Policy
2: Select Scheduled as the Reboot Behavior
3: Select the Day
4: Select the Start and End time
5: Select the Patch Reboot Method (Now in this instance)
6: Set a maintenance mode if desired
7: Click Save
6: Set up your approval policy
For this example we will edit the default approval policy and presume most computers are going to get the same patches in the same fashion. Note that it is possible to create any number of approval policies which will treat patches differently.
1: Click Approval Policies
2: Select the Default* Policy
3: Enable a Stage Delay if desired. This will allow you to have patches applied to a test machine prior to deploying for all. A Patch will cycle through these stages only installing on machines in that phase (we'll cover how to set that in a moment)
4: Choose your automatic approvals and ignores, etc. Here we take the list we made earlier (by the way this where to get the list of categories to decide on) and we select the categories under the appropriate heading.
5: Click Save
7: Apply the Policies to the Group
Now all we have to do is go back to groups and set the policies. Just click the "Not Set" link under each heading:
Congratulations you've set a group of computers to patch :)
Approving Updates Manually That You Didn't Auto Approve
To Approve updates manually click Approvals button:
Select the Approval Policy on the Left. From there you simply select an update under "Discovered Patches" and choose the appropriate button to approve, ignore, deny, etc
Placing a machine in a different Patching Stage:
This is easily adjusted. Simply Open up the agent in the navigation tree in Labtech that you would like to put into a different stage by double clicking it and go to the patching data tile. Just click "Begin" and type in "Patching" and it will display as a choice.
On the bottom left under "Patching Stage" click the current stage and select a new one:
And there you have it. That is the basic structure of patching and will atleast get you going. You ofcourse can customize much further but the intention of this post was to give the basics and show you where the various pieces are.
Happy Labteching!
