Patch management suggestions

[robjduk]

Morning all,

Just looking for opinions on patch management (not Windows as that's taken care of). Currently, I have PDQ pushing out updates to software from its repository (VLC, Notepad++ etc...) and bits like Chrome set to auto-update however I used to have Malwarebytes patch management and even though I outed it due to it being slow and failing more often than not, it still alerted me to a ton of software needing updates.

 

My options as I see them are....

 

1: Buy Action 1 to manage patching. It's within budget and seems to be a good product.

2: Buy PDQ Connect. This won't patch everything however it will update remote laptops which don't come in often enough to be fully patched.

3: Deploy winget tasks to update anything in its repository.

4: Sit back and know staff don't have Admin rights, we have a good AV and the chance of some random software being compromised which isn't on the PDQ list already is so low, I'm worrying about nothing.

 

Even though it's within budget, I don't want to spend out on Action 1 just to tick a box.

 

What are your opinions and approaches to patch management?

 

Thanks all

[ThatBoringBloke]

PDQ here. Athough they have increased pricing recently its still value for money for us IMO.

[jthompson]

I was looking into this a little while ago, specifically at whether winget would do the job. It doesn't really, since winget runs under the end user context and can't be run by the system to install/update apps for all users or during startup, etc.

 

I'm planning on sorting out a Chocolatey setup at some point, with an internal repository for clients to work against (avoid using the public repo as that may allow end users to install whatever they want from there). The internal repo would still need app updates to be manually packaged up by an admin each time before they can be deployed, but at least that brings some homogeneity to proceedings. I know that @mavhc has done a fair amount of work on that stuff, and has previously shared a solution - https://github.com/mavhc/choco-school.

Edited January 8, 2024 by jthompson

[pete]

I'm trialing Action1 (still within the free tier atm) for our primaries.

 

It's got a few annoyances (still waiting on the "only reboot once for patches, not per-patch" feature request) but it's being actively developed and they're responsive to suggestions.

[mavhc]

I was looking into this a little while ago, specifically at whether winget would do the job. It doesn't really, since winget runs under the end user context and can't be run by the system to install/update apps for all users or during startup, etc.

 

I'm planning on sorting out a Chocolatey setup at some point, with an internal repository for clients to work against (avoid using the public repo as that may allow end users to install whatever they want from there). The internal repo would still need app updates to be manually packaged up by an admin each time before they can be deployed, but at least that brings some homogeneity to proceedings. I know that @mavhc has done a fair amount of work on that stuff, and has previously shared a solution - https://github.com/mavhc/choco-school.

 

Only issue is doing it for people who are at home, either you'd want to switch them back to public repo, or host your own publicly, which isn't as simple as I expected it to be

[jthompson]

Only issue is doing it for people who are at home, either you'd want to switch them back to public repo, or host your own publicly, which isn't as simple as I expected it to be

 

Worth knowing, thanks. Given that we're currently deploying apps updates via Group Policy app management, this wouldn't be any kind of backwards step.