Introduction to Patch Manager

Explore Patch Manager, a patch management solution designed to protect against vulnerabilities, improve application performance, and boost overall patch compliance.

Download the PDF: Patch Manager Product Guide (formerly known as Administrator Guide)

Administrator Console and functions

The Patch Manager Administrator Console is a Microsoft Management Console (MMC) integrated with Windows Server Update Services (WSUS) that is used to view, manage, and deploy Microsoft and third-party updates while performing additional administrative functions as needed.

From the navigation pane, you can access various action categories (or nodes), including Enterprise, Administration and Reporting, and Patch Manager System Configuration. Once you have selected an item from the navigation pane, the data grid pane displays information about the selected item and gives you access to reorganize, sort, and filter data.

The Task Options Wizard is integrated into several Patch Manager procedures and can be used to select additional options when completing a task. These options vary and can be configured by selecting from the three dialog boxes that display in the Task Options Wizard: Computer Selection, Scheduling and Notification Options, and Summary.

As tasks are created to perform procedures within your deployment, an administrator will need to manage various functions and settings to ensure each task is completed successfully. To maintain your Patch Manager environment as an Administrator, see Administrator functions and settings.

Configuration

The Primary Application Server (PAS) serves as a communication hub for your Patch Manager deployment and allows you to configure a variety of different resources to best fit Patch Manager to your organizations needs.

Managed resources are servers and workstations updated by Patch Manager. A collection of these resources in a specific location can be grouped together to form a management group. To form and modify your management groups, follow the steps detailed in Configure the managed resources. A credential ring can then be used to map a users credentials to managed resources and security settings and user preferences can be adjusted with Configure credentials and credential ring rules.

Email notifications can be set up to alert you when a task in Patch Manager manager has been completed. This configuration is enabled on the Application Server settings of the Patch Manager server and defines the email and Simple Mail Transfer Protocol (SMTP) server settings.

Depending on your environment and organization's needs, administrative settings can be configured utilize a proxy server and create a third party updates view. These configurations are optional and can be modified with Configure the administrative settings.

Managed clients can be configured using either Group Policy or the Patch Manager Console. By configuring clients, you can provision the WSUS publishing certificate to any client you want to manage. See Configure the managed clients for more information.

During standalone configuration, the Patch Manager Administrator Console is installed on a server hosting the Primary Application Server role. If you are in an instance where you cannot access this version of the Patch Manager Administrator Console, you can download an additional console on a remote server in your environment. See Install the Patch Manager Administrator Console on a remote system for Administrator Console download instructions and Configure additional Patch Manager servers for more information about server roles on remote systems.

Users and security

Credentials are pairs of user names and passwords assigned to credentials rings that grant Patch Manager access to managed resources. From the Patch Manager Administrator Console, you can add, change, and delete a users credentials as needed. A credential ring maps user credentials to managed resources and is used by Patch Manager to identify which credentials should be used to perform certain tasks on a specific managed system. You can add an administrator's credentials to the credential ring with Populate the default credential ring.

Security roles are used to grant or deny console users access to specific application functionality. Users can be added to or removed from default, operational, or special security roles as needed to fit the needs of your organization and access preferences.

Utilize the User Preferences tab in Security and User Management to create and manage profiles for Microsoft® Windows® users with access to the Patch Manager Administrator Console. For a breakdown of the Preference Settings and how to modify them, see User preferences.

A 2048-bit security certificate is used to encrypt all communication between Patch Manager servers and console sessions. There are two types of certificates employed by Patch Manager: Code-signing and SSL. To learn more about certificates and how to delete or deploy one in Patch Manager, see Server certificates.

The Patch Manager Web Console implements a separate user account and password from the Patch Manager Administrator Console. To add the Web Console to your deployment, add a user account, and define the user's setting, see Web Console user accounts.

Third-party updates

To enable a managed computer to receive third-party updates from the WSUS server, you will need to export the software publishing certificate from the WSUS server to a certificate file. Then, you can configure the Group Policy Object (GPO) and import the certificate file and supporting Windows® Update policies. For a step-by-step guide, see Configure the group policy to enable third-party updates.

You can push third-party update packages from the WSUS server to client systems, including updates for Adobe Reader, Java Runtime, and Adobe Flash. Once you have approved the update, WSUS will push the update to the targeted group. The Update Management task is then used to install the updates on a WSUS server to the approved target systems.

PowerShell scripts can be used to execute a portion of the Update Management task to push updates to your managed systems. To utilize PowerShell scripts for updates, see Create PowerShell scripts for third-party updates.

When a third-party update is downloaded and installed, the targeted system may display a certificate error. To resolve these errors and continue your download or installation, see Troubleshoot certificate errors during third-party updates.

In Patch Manager, you can also schedule WSUS updates, stop or delete an update assigned to managed systems, and check task history to verity update completion. For more information about each of these features, see Push, approve, and install third party updates.

Inventory

An inventory is a collection of system that receive patches and updates from Patch Manager. An inventory is created using an Inventory task, which pulls information from WSUS servers and managed computers to display patch status in the Patch Manager Administrator Console. You can configure WSUS, managed computer, additional inventory, and specific datasource inventory tasks to collect system information and compile it into a designated report.

Reports

WSUS reports offer information about your WSUS server performance and update packages installed on managed systems. You can use report viewer to customize your report layout and filter or sort the report results. Generate a Patch Manager report to learn more about your managed systems and server performance.

Alternatively, the Report Definition Builder can generate a custom Patch Manager report or customize an already existing report to refine or expand the results as needed.

An inventory report is generated to catalog the status of Windows upgrade packages installed on managed systems. When an inventory is complete, you can run an inventory report to determine which upgrade packages need to be installed and approved.

Installed Programs and Features are a set of configuration management reports that provide a list of clients and all third-party software installed on each clients computer. Services, Device Drivers, and Terminal Services are a set of configuration reports that create a Services Basic Information Report. This report provides a comprehensive list of services on all inventoried client computers.

Manage WSUS

You can manage your WSUS server using the Update Services node in the Patch Manager Administrator Console. After WSUS has successfully installed in the Windows Server operating system, you can add or remove a WSUS server to or from Patch Manager as needed to distribute updates and custom packages to managed systems.

Additional Microsoft product updates can be downloaded on your WSUS server as your organization's needs change. After synchronization completes, you can approve and push updates to your managed computers. To download additional products, see Select the Microsoft products on the WSUS server.

You can schedule the WSUS server to synchronize with the Microsoft® Update site while tasks run. While connected, The WSUS server retrieves the latest Microsoft updates and stores them to be applied to your managed systems at a later date.

If your managed systems are not governed by a Group Policy Object (GPO) or are outside of an Active Directory, you can configure your Windows update local policy to access the WSUS server and download any required updates.

For additional information and guidelines on managing WSUS, see Manage WSUS using Patch Manager.

WMI Connectivity

If you prefer not to use a Patch Manager agent, SolarWinds Client Components will be installed using WMI Providers. By default, Patch Manager deploys WMI Providers when necessary for specific configuration management asks and they run on the remote system.

WMI Providers offer additional management and inventory tools outside of what is offered within WSUS. To install WMI Providers and view these additional tools, see Install the SolarWinds WMI Providers.

Patch Manager agents

Patch Manager agents are great management solutions for environments where computers cannot be managed with WMI or computers are protected by stringent firewall rules or VPNs. Patch Manager agents can be deployed to both online and offline computers, multiple computers using WSUS, and computers already using the WMI Providers installer. Agents can be configured with policies and policy templates to best fit your organization's needs. To install and deploy agents on your managed systems, see Patch Manager agents.

Patch Manager and the SolarWinds Platform

If you use the SolarWinds Platform to manage your IT infrastructure, you can integrate Patch Manager with the SolarWinds Platform to create one, easy to access location for you data. Once integrated, you will be able to view a Patch Summary from the SolarWinds Platform Web Console to quickly identify vulnerabilities and resolve the issue.

You can Generate Patch Manager reports in the SolarWinds Platform Web Console from the predefined reports included in the console. You can also create a custom report that combines two ore more predefined reports to ensure you have all of the available information about your managed machines that you require.

Microsoft System Center Configuration Manager (SCCM)

The Microsoft System Center Configuration Manager (SCCM) is a systems management solution that manages Windows-based computers. To install Patch Manager on a SCCM server, see Integrate Patch Manager with SCCM.

If you have third-party updates configured, you will need to publish a few packages to the WSUS server to act as you SCCM software update point (SUP). There are a few methods you can follow to accomplish this, to determine which is best for you, see Publish third-party updates. Once published, you can manage your updates to fit the needs of your organization and managed systems.

You can manage WSUS servers in the SCCM console as you would in the WSUS console. From the SCCM console, you can synchronize, clean up, and repair the WSUS servers. For more information on server management, see Manage the WSUS servers using the SCCM console.

WMI Providers can be provisioned automatically or manually using the SCCM console. If you run into any connectivity issues, these can be quickly resolved and connection re-verified with your remote systems.