In-Depth

Keep Patches up to Date

Ecora Patch Manager 2.0 enables you to keep critical patches for Microsoft products up to date, now and into the future.

• By Joel Semeniuk
• 08/01/2003

There's no doubt that patch management has joined the ranks of backup management and virus protection as a mandatory operational task for the modern enterprise. However, the process of downloading, testing, and distributing the ever-increasing number of patches for every computer in the enterprise is extremely time-consuming, even when compared with executing backup and virus protection. Ecora is trying to change all that with Patch Manager 2.0

Patch Manager provides facilities for patching virtually all major Microsoft products, including Windows NT, Windows 2000, Exchange 5.5/2000, Office 2000/XP, MSDE 1.0/2000, SQL Server 7.0/2000, Internet Information Services 4.0/5.0, Internet Explorer 5.01/6.0, and even Microsoft Media Player 6.4/9.0. With Patch Manager you can discover computers on your network automatically though Active Directory, NetBIOS, or IP addresses and ranges. This enables you to group them into manageable units—such as File Servers, Desktops, or Domain Controllers—that you can use to apply patches. However, before you can begin deploying patches, you must ensure that each computer you wish to patch has a C$ share available, the Microsoft Task Scheduler installed, and the Remote Registry Service enabled and running. Once you meet this set of criteria, you can begin scanning your computer group for missing patches.

To keep up-to-date, Patch Manager regularly downloads patch information it uses during a patch scan to discover which patches each computer requires. Once Patch Manager determines which patches are needed, you can push the changes to the clients in the order you choose, manually or as scheduled. As you would expect, all activity is logged for later review and reporting. The product can also generate alerts based on certain triggers you define. So you can receive e-mail if a scheduled scan fails or after a patch push failure.

I installed Patch Manager on a Windows XP computer that was a member of an Active Directory and was prompted immediately to check for updates to the patch database and to the application itself. After a quick and seamless update, I was ready to start scanning, beginning with a discovery of all my servers using a NetBIOS scan. I decided to examine a subset of the computers on my network so I used the tool to set up a group of computers to make this easier. After completing the scan, Patch Manager presented me with a summary of its findings, highlighting the patches I had already installed along with missing patches, as well as providing me with patch and configuration warnings and notes (see Figure). From here I was able to select the patches I wanted to distribute and begin the patch push.

I had no problems using Patch Manager and was surprised by the number of patches my systems required—I had thought everything was up-to-date. Patch Manager was easy to install, configure, and use, allowing me to get my systems up-to-date quickly. However, I would have liked to see the ability to log my patch activity in a database accessible across the enterprise, as well as the ability to produce customized reports. All in all though, if you don't have an enterprise software distribution solution such as Microsoft Systems Management Server (SMS) installed already, you should seriously evaluate Patch Manager.