Windows server patch management support

SA patch management for Windows enables you to identify, install, and remove Microsoft® Windows patches and maintain a high level of security across managed servers in your organization.

SA Windows Server patch management support is compatible with a mixed-version multimaster mesh (where both patched and unpatched cores co-exist). Windows platform patch management includes the following supported functions:

• Windows Server patches appear under Library after the patch database is imported.
• Select the specific Windows Server version under Administration >> Windows Patch Downloads > Patch Products to specify whether to import Windows Server patch metadata.

• To manage Windows Server patches you can:

  • Invoke a patch browser to edit patch properties, descriptions, and reboot/install/uninstall flags.

  • See the following patch views when a Windows Server server is selected.

    • Patches Needed
    • Patches Recommended By Vendor
    • Patches with Policies or Exceptions
    • Patches Installed
    • Patches with Exceptions
    • All Patches
• You can import patch binaries from the vendor using the SA Client or from a file.
• You can attach Windows Server patch policies to servers and server groups.
• You can define patch policy exceptions for Windows Server patches on servers and server groups.

The populate-opsware-update-library script

The populate-opsware-update-library script automates the download of Microsoft patches from the vendor and the import of these patches into SA. The populate-opsware-update-library downloads the patch offline catalog from Microsoft (wsusscn2.cab) and imports its contents (hotfixes, service packs, and update rollups) into SA.

For more information about running the script and the available options, see Downloading the Microsoft patch database from the Command Line .

Policies and exceptions for Windows server patches

SA provides a recommended patch policy for Windows Servers. You can also define additional custom patch policies in the same way as described in Application Deployment in the SA 10.5 Developer Guide.

Remediate and ad-hoc install/uninstall

You can remediate Windows Server patch policies and perform ad-hoc Windows Server patch installations and uninstallations. Windows Server patches can be remediated in software policies and ad-hoc installations using install/uninstall software. However, software compliance does not account for applicability.

Patch compliance

You can perform patch compliance scans on Windows Server servers to determine compliance relative to attached policies and exceptions. Patch compliance is based on patch applicability on the selected server(s).

The Compliance view in the SA Client displays compliance details for Windows Server servers.

Known limitations

• The Install/Uninstall Patch window typically allows you to specify install/uninstall flags when a patch is selected for installation/uninstallation. The patch must be in an .EXE file format. Microsoft delivers Windows Server patches in both .EXE and .CAB format. In SA, if a patch is in .CAB file format, you cannot specify install/uninstall flags in the Patch, Install Patch, and/or Uninstall Patch windows because command-line arguments are not supported for .CAB format patches.

• If you add install or uninstall flags using the Windows patch browser, any flags that SA would otherwise have used are overwritten.

  Therefore, if you must use additional flags in a Windows patch browser, you must specify the -q flag with your additional flags. For example, if you want to log the install/uninstall process and do not want to override the default flags, specify the following:

  /log:c:\mylog.txt /q /z