Windows deployment/patch management that doesn't cost an arm & a leg?

[misterfriendly]

I need a deployment & patch management tool for a small group of Win7 PC's (about 80). I've been imaging them with FOG which works fine, but it's monolithic and I need something more flexible that can do scheduled deployments, driver & BIOS upgrades, 3rd-party app installs, printer settings, etc. Reporting capabilities (including software metering) would be handy as well.

 

There are a ton of options out there, and many of them are probably overkill for an installation of our size. What do people like for this? SCCM, LanDesk, WinInstall, etc?

 

thanks,

 

Luke Jaeger | Technology Coordinator

Pioneer Valley Performing Arts Charter Public School

PVPA Charter Public School - About PVPA

[SYNACK]

Wds, mdt and wsus on a single server would do this fine.

[plexer]

@SYNACK would do most of it not sure about bios upgrades?

 

Ben

[SYNACK]

Didn't see about the bios updates, you can package some depending on the vendor.

[free780]

Pdqdeploy and pdq inventory should work. You can script Intel bios updates.

[misterfriendly]

Ability to push BIOS upgrades isn't a dealbreaker but it would be helpful. More concerned about the other stuff.

[ADMaster]

MDT, WDS, and WSUS will handle the imaging and microsoft updates, you can also push some software updates with group policy.

 

+1 for PDQ with the pro version you can schedule deployments, and have multi step installers. PDQ is also not limited to MSI, if you can do it silently from the command line, PDQ will do it.

[mattianuk]

Apparently the new Impero does most of that, getting it Wednesday. Will let you know.

[plexer]

d/l and installed pdq and even in the free version I have to say it's a very handy tool.

 

The firewall requirements for printer and file sharing on the workstations is a bit of a worry but as long as the exceptions are deployed with relevant controls i.e access from specific ip's only it's not so bad.

 

Ben

[MordyT]

Apparently the new Impero does most of that, getting it Wednesday. Will let you know.

 

Public release or private?

[gshaw]

There's a real gap in the market for something that could do Adobe, Java etc patches slickly and not at a mammoth price. If I could code I'd love to do something that mimics the update servers for said evil products but caches the updates locally... then you just repoint your DNS records to the local server rather than Internet... patching sorted

 

So many solutions want to cover the MS patches (why put all that effort in when WSUS does it fine?) then charge an arm and a leg for the small bit of functionality you do want. Problem is they spend so much time working on the MS side that the 3rd party stuff is done badly (Java, Flash updaters not checking for open browsers and so on) and doesn't end up offering much more value than doing it manually yourself :-/

[sparkeh]

There's a real gap in the market for something that could do Adobe, Java etc patches slickly and not at a mammoth price.

You looked at Local Updates Publisher? Local Update Publisher

Also if you are using SCCM you can use SCUP System Center Updates Publisher

[gshaw]

You looked at Local Updates Publisher? Local Update Publisher

Also if you are using SCCM you can use SCUP System Center Updates Publisher

 

Ye one of our techies found it, looks like it hasn't been developed in a while though...

 

We're on Zenworks which makes things more interesting, they do a patch management solution but it ain't cheap (MS bribery works wonders for their market share )

[russdev]

Public release or private?

 

Hopefully we are releasing public version of 4 this week (if nothing major happens today).

 

Russell

[misterfriendly]

WinInstall may be the thing I need - testing it this week. $24 / seat which isn't too bad.

[russdev]

There's a real gap in the market for something that could do Adobe, Java etc patches slickly and not at a mammoth price. If I could code I'd love to do something that mimics the update servers for said evil products but caches the updates locally... then you just repoint your DNS records to the local server rather than Internet... patching sorted

 

So many solutions want to cover the MS patches (why put all that effort in when WSUS does it fine?) then charge an arm and a leg for the small bit of functionality you do want. Problem is they spend so much time working on the MS side that the 3rd party stuff is done badly (Java, Flash updaters not checking for open browsers and so on) and doesn't end up offering much more value than doing it manually yourself :-/

 

 

One of the main issues about patch management software of any kind is that reason they tend to cost more is that creating the technology is the easy part. The biggest cost is creating the back end things to test a patch and turn it around within hours even if just took adobe, java and major browsers that is lot of work per month (remember most them release at least once a month). Then forgetting that the technology you write has to work on about million different setups..

 

Hopefully we are doing it right we support ms updates but also support an ever expanding list of third party software.

 

Russell

[MordyT]

Will imperos patch management use impero provided patches or can we add our own?

[gshaw]

One of the main issues about patch management software of any kind is that reason they tend to cost more is that creating the technology is the easy part. The biggest cost is creating the back end things to test a patch and turn it around within hours even if just took adobe, java and major browsers that is lot of work per month (remember most them release at least once a month). Then forgetting that the technology you write has to work on about million different setups..

 

Hopefully we are doing it right we support ms updates but also support an ever expanding list of third party software.

 

Russell

 

Tbh if Adobe made a local caching server that downloaded one copy of their updates and distributed over a LAN (yes basically Adobe WSUS) they could either make admins happy or lots of money, either way it's odd they haven't done it for Flash \ Reader as there's something similar for the CS suite (AUSST)

 

Same for Chrome and Java, the auto update technology is there and works well on a 1:1 download basis, just make it work on a 1:many from a central server et voila problem solved, but that's far too simple isn't it

Edited April 15, 2013 by gshaw

[russdev]

Impero in first release of patch man version can't use own patches we have a list of supported software.

 

As for vendors doing own server roll out reason is most of them know how much of a pain it is to do. Massive difference between one to one update and one to many updates.

 

Russ

[caffrey]

Has anyone tried this ? I'm just looking at it now

Wsus Package Publisher - Home

[seawolf]

WSUS Package Publisher

 

http://wsuspackagepublisher.codeplex.com/

 

Puppet

 

https://puppetlabs.com/puppet/what-is-puppet/

[tmcd35]

@misterfriendly, you Edu? If so then SCCM as all but built into the price of EES licensing. A bit of b**ch to set up and needs a beefy server but, so far, I've not used better.