Wsus for remote vpn and on-premise users
-
@fredtx said in Wsus for remote vpn and on-premise users:
@irj said in Wsus for remote vpn and on-premise users:
95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.
That's another topic I want to get to as well. The topic of when and how to schedule/approve patching for your business in a Windows environment? And what is best practice? That may need to be a different post though.
Unless your company really is prepared for you and others to spend days testing all new patches before deploying them - then the best practice is to deploy ASAP after MS releases them. Zero and near zero day exploits start hitting within hours of updates being released.
-
An option that nobody has mentioned is doing split-brain dns for your WSUS.
Assuming that you've got a domain, setup something like updates.company.com with the appropriate security and forwarding externally and the necessary entries on your internal Windows DNS. Make sure that everything is setup with SSL and you're golden. So if the folks are out of the office, they'll still be pulling updates from your WSUS server, under your control. Hell, depending on how your firewall handles hairpinning, it might be best to forget about the entries in the internal DNS and just have everyone connect to the public IP, eliminating any instances of it having to deal with VPNs.
-
@fredtx said in Wsus for remote vpn and on-premise users:
I've been tasked with implementing patch management for our company. I worked at an MSP prior to this role (sys admin), and we handled patch management through our RMM agents. My current company does not have rmm agent/management, so I'm looking at implementing WSUS.
Why not add an RMM?
-
@irj said in Wsus for remote vpn and on-premise users:
@pete-s said in Wsus for remote vpn and on-premise users:
If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?
If that is the case, what functionality does WSUS bring to the table?
95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.
Yup, I'm a huge opponent of WSUS. Most of the time (nearly all of the time) it consumes huge resources, wastes ITs time, puts patching at risk, breaks things in dangerous ways, undermines security, and makes what should be simple hard and often generates more licensing needs for no reason.
It has its place, but it is so rare that it is actually beneficial. It has so many cons and effectively no pros. And only an organization with such insane scale could ever possibly truly test patches, WSUS is basically zero benefits with a HUGE invitation to problems.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@irj said in Wsus for remote vpn and on-premise users:
95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.
That's another topic I want to get to as well. The topic of when and how to schedule/approve patching for your business in a Windows environment? And what is best practice? That may need to be a different post though.
Best practice (which is in my book that just came out, by the way) is ...
If you don't have a huge testing environment where you can test patches within ~24 hours of release, to patch blindly without delay.
If you create any delay, hesitation, or opportunity to not patch, you have a big problem. WSUS represents all of these. Basically, if you are asking the question, it means WSUS is wrong for you and you need immediate patching.
If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.
-
@dashrender said in Wsus for remote vpn and on-premise users:
@irj said in Wsus for remote vpn and on-premise users:
@pete-s said in Wsus for remote vpn and on-premise users:
If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?
If that is the case, what functionality does WSUS bring to the table?
95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.
I agree 99.9% of the time - the other .1% is what bites - when you have a bad patch and have to uninstall it.
WSUS doesn't fix the .1%. It just delays it, which doesn't help things.
-
@scottalanmiller said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
@irj said in Wsus for remote vpn and on-premise users:
@pete-s said in Wsus for remote vpn and on-premise users:
If you are considering having clients download updates from Microsoft directly then that means that you are going to apply all updates, doesn't it?
If that is the case, what functionality does WSUS bring to the table?
95% of WSUS administration is blindly approving updates anyway. Just let them auto update and be done.
I agree 99.9% of the time - the other .1% is what bites - when you have a bad patch and have to uninstall it.
WSUS doesn't fix the .1%. It just delays it, which doesn't help things.
WSUS can uninstall the patch - so sure, not fix it, but help with removal.
-
@scottalanmiller said in Wsus for remote vpn and on-premise users:
If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.
With me being in this new role for 2 weeks (first system admin role), and the majority of the computers/servers on Windows, I will have to stick with this solution for now.
Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@scottalanmiller said in Wsus for remote vpn and on-premise users:
If you have any hesitation to that policy, it means you are running a platform you don't trust in production. That's valid as a concern. But your IT has committed its trust to Windows, so either you need to embrace that decision or you need to convince them to change.
With me being in this new role for 2 weeks (first system admin role), and the majority of the computers/servers on Windows, I will have to stick with this solution for now.
Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
-
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
-
@pete-s said in Wsus for remote vpn and on-premise users:
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
Exactly my point - I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
-
@dashrender said in Wsus for remote vpn and on-premise users:
I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.
-
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
I'm guessing at least some if not all of your servers will still be manual - and are you really looking at having WSUS push to workstations? If you are because you want to know their patch status because of reports from WSUS - great (hope there is budget for someone to manage this) if not, then just turn on automatic updates and be done with it.
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
And yes, I'm looking at getting the report features for patch status for workstations, and was hoping for servers too.
This is a great question to which I have zero answers.
I'm sure you can run update via PowerShell - so for 100's of servers, I'm guessing that's how they would do them. Additionally, if uptime is that big of deal - then it's likely they have multiple servers running the same loads allowing them to take some of those servers offline while not affecting the service in general.
-
@fredtx said in Wsus for remote vpn and on-premise users:
Currently there is no central management for patching, and currently they are logging on each server and running updates that way and hope that workstations are getting patched through the GPO they have in place.
I'm not sure that I follow. If WSUS isn't in place today, and RMM isn't in place today... seems like you are at a decision point that both are equally new and untried. Why go down the path of something bad instead of something better?
-
@fredtx said in Wsus for remote vpn and on-premise users:
I will have to stick with this solution for now.
Because it's a mandate from before you started that they just didn't get around to yet?
-
@fredtx said in Wsus for remote vpn and on-premise users:
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
Sure, but our point in the thread is that WSUS isn't a good means to that end. If anything, the purpose of WSUS is to avoid that goal (not exactly, but in practice.)
-
If you're starting from scratch I'd suggest taking a serious look at leveraging TacticalRMM (or something paid if you really want to spend money) instead of WSUS. (As mentioned by others)
If you do have to go the WSUS route for whatever reason(s) make sure to automate the maintenance scripts that microsoft references / provides in their online documentation. Why they don't integrate those scripts into the core product is something that I'll never understand but hey, they're making $$$ and I'm just a sysadmin.
-
@pete-s said in Wsus for remote vpn and on-premise users:
@fredtx said in Wsus for remote vpn and on-premise users:
@dashrender said in Wsus for remote vpn and on-premise users:
What is the goal here? to keep the servers up to date? Do you really want WSUS to update your servers 'whenever'? Most people don't, could lead to an unexpected reboot in the middle of the day.
Of course I would not want the servers to reboot in the middle of the day. I would have to discuss with management on maintenance windows of downtime, since this is a manufacture business where some sites run 24/7.
The goal is to improve and simplify how patching is handled for both servers and workstations. Currently there is no kind of process in place.
We do some of that and the most mission critical servers are handled manually. Patched, rebooted and verified that everything works.
Basically there are different categories of servers and workstation and each category is handled differently depending on how mission critical it is.
Agreed. Critical servers we tend to do by hand, and often.
-
@fredtx said in Wsus for remote vpn and on-premise users:
Is logging in the console of windows servers the best way to install patches? What if there was 100 servers? That seems like a lot of overhead.
If they are critical, yes it is. In most cases.
But in one post you said that "best" had no place and WSUS, even though it is bad, HAD to be used as you didn't have the option to do something better (or even good.) Is "best" really on the table as a concern? At this point "adequate" is really the point to strive for (I'd consider WSUS the worst case scenario short of just giving up on updates.)
