On-PremisesCloud

These are the questions asked during Patch Management Training

  • If Microsoft "pulls" a bad patch, in the new distributed model, how can Patch Manager Plus remove it?It is recommended to use "Test and Approve" feature, which can test the patches on lab machine and then approve it automatically before deployment. We also have patch removal/roll back option, which can be used to handle these situations.
  • Can I schedule a reboot for a specific time after patches are installed? For servers as well as desktops?We do not have an option to schedule the reboot, however, you can customize the deployment to a specific time interval and configure a reboot to meet your requirement.
  • Is there a way to be alerted about when zero day patches become available to download so we can ensure to get those pushed instead of having to wait for the scheduled policy?You can create a separate "Deployment Policy" for such requirements and get them deployed automatically.
  • How often should the patch scan be ran, is there a manual setting?It depends on the number of computers. Usually in an enterprise, it is done at least once in a week using Automated Patch Deployment (APD) task.
  • Should the computer need to be connected to admin account, for getting the patches deployed? Or can it be regular user account?Managed computers can be use regular user account, since the agent is running in the system account it would have the privilege to install the patches.
  • How to specify languages for patches? Patch Manager Plus will automatically detect the language based on the operating system.
  • What will happen when the patches was installing and user accidentally turns off the computer? Patch Manager Plus will retry to install the patch during the subsequent deployment window and the installation status would be updated.
  • I didn't catch the part about, patch approval. Is there a way to automatically approve patches or you have to approve the patch manually? It is about testing the patches before deployment. You can choose to approve the patches automatically or manually. We also have the feasibility to test the patches before approving them automatically. The tested patches can be approved automatically after specified number of days if no failures found. Alternatively, you can manually approve it based on the result.
  • The patch management solution that we are using currently tells us what we need to download and then we manually download the patches. After the patches are deployed we can remove the downloaded patches which we no longer need. But this is manually done. How Video Patch Manager Plus handle this requirement.? Patch Manager Plus will allow you to automate the complete process. You can create an APD task, which will automatically scan computers, detect missing patches, automatically download the required patches and deploy it to the target computers. You can configure "Patch Clean up settings, to automatically delete the unwanted patches.
  • Can you limit patches to just laptops or desktops?Yes, you can. You can target machines based on system type such as laptops and desktops. You can also create a custom group with system type as criteria.
  • Do we have the feasibility to split the scan & download from the patch deployment? You can create separate APD task for scanning and downloading the patches. You will find four different options such as scan, download, draft and deploy. You can choose any of them based on your requirement
  • When there are patches in "yet to apply" status, is there a way to get notified about the patches, after deployment/failure? You can configure notification settings for the APD task which can send you the status report multiple times based on the different status including scanning, downloading and deployment of patches Yes, Patch Manager Plus supports them
  • When you initiate patch scanning, does it start scanning all the computers at a same time or does it scan them incrementally? Scanning will be initiated incrementally in order to avoid bandwidth bottlenecks.
  • Is it possible to schedule the patches to be installed and then the computer rebooted and then shut down after the reboot?Deployment Policy can be used to schedule the patch and reboot/shutdown. However, if you want to shut down after reboot, you can use the remote shutdown/reboot tool to perform this operation.
  • Right now we use WSUS for MS patches. What is the best way to switch over to Patch Manager Plus?You can disable auto-updates from WSUS and install Patch Manager Plus agent on the computers to be managed, scan the computers and start deploying the patches.
  • I need to deploy the newest Mozilla updates to certain computers but exclude some, how do I do this?You can create a custom group with the computers which you wanted to exclude. Decline the application from, Patch Mgmt -> Decline Patch -> Decline Patch for Group -> specify the application.
  • How would I automatically download and deploy the latest flash updates as they are released?You should configure “Automated Patch Deployment Task” and ensure that the schedule is run every day to keep your computers up-to-date.
  • How to ensure the individual computers do not download patches from the Internet? I do not want any 3rd party application in our organization to take the updates from the Internet? You can see the “Installed Time”, against the patch, if it is installed using Patch Manager Plus. If you do not find the “Installed Time”, then it could be patched using automatic updates. In such cases, you will have to disable auto-updates from, Configurations -> Script Repository ->Templates tab -> Search for AutomaticUpdates.exe -> add to repository. Create a configuration, select the target computers and deploy it.
  • Will there be a feature to pull local logs of failed deployments from the Patch Manager Plus site? Yes, you can pull local agent logs from remote computers and upload it to support for analysis from, Support -> Create Support File.
  • Is the ability to create a test group of several computers and giving them patches before they are made available to all the computers in company? You can create a custom group and test the patches before deploying them to all computers in the company. Ability to "Test and deploy" patches, will be available at the end of this quarter.
  • Is there a way to configure the lists of computers, etc., permanently display more than 25 at a time? You can customize the count of computers, displayed. The changes you make will persist only for the technician and the view.
  • If I want to schedule patches to run in the next 20 minutes, is there a way to force the Patch Manager Plus agent on client machines to talk to the server, thus getting that task quicker than the 90 minute policy refresh? (Example - McAfee anti-virus has a feature called "wake up agent" that tells the agent to pull down fresh You can achieve this by using “deploy immediately option”, whenever you deploy a patch configuration. This will wake up the target computer on-demand, to perform the task initiated by Patch Manager Plus.
  • When viewing the results of an "Automate Patch Deployment", is there a way to see the history of what patches were installed by previous runs of this task?You can view the status of the “Automate Patch Deployment Task” from, Patch Mgmt -> Automated Patch Deployment Tasks. You can also generate reports of these tasks and schedule it.
  • I do not see where I can push Anti-virus definitions using Patch Manager Plus. Yes, you can deploy definition updates using Patch Manager Plus from, Patch Mgmt -> Automate Patch Deployment -> Schedule Anti-Virus Task
  • Java updates -- is it possible to allow update for compatibility with app X and preserve legacy version for compatibility with app Y or app Z? You can create a dynamic custom group and choose to decline the patches for the specific application like JRE. By doing this, you can maintain multiple versions of the JRE in your network.
  • What changes should I do, in my firewall and proxy to patch computers?Refer this article to find the list of domains , which need to be excluded https://www.manageengine.com/products/desktop-central/patch-download-failure-error-403.html
  • I have the patches set to automatically deploy how can I check the deployment since it is not making a configuration deployment?Automated patch tasks are not regular configurations. You can view the status of the You can view the status of the "Automate Patch Deployment Task -> System View". You can also configure notification settings, Patch Mgmt -> Automate Patch Deployment -> Notification Settings, to receive email updates, whenever there is any change in the status of the task.
  • How do you make a separate policy that is specifically for server OSs and does not automatically restart the server? This can be achieved by configuring the deployment policy and excluding servers from reboot, Patch Mgmt -> Deployment Policies -> Create Deployment Policy ->Deployment Window -> Reboot Policy -> Exclude Servers from Reboot
  • We currently use McAfee encryption on some of our devices. We are trying to figure out how to continue auto deployment after hours once everything is encrypted. Does Patch Manager Plus have a method of handling this? This can be achieved by configuring the deployment to happen after the encryption time window. You can configure it from, Patch Mgmt -> Deployment Policies -> Create Deployment Policy -> Deployment Window
  • I want to patch computers which are not live. How does "wake-up & deploy" work?You can wake up the computers and deploy the patches by configuring, Patch Mgmt -> Deployment Policies -> Create Deployment Policy -> Turn on computers before deployment.
  • Under all patches, I don't have "filter" option, decline patch option is shown , install patch, download patches, decline patch are the only options. there is no "mark as option" Nor "filter". How do I approve patches? “Mark As” - option, will be available only when you choose to approve patches Manually, Patch Mgmt-> Settings -> Approval settings - > Approve Patches -> Manually. If you have chosen to approve all patches automatically, all the patches will be marked as approved by default.
  • How come I have not seen updates for Windows 10 or MS 2016? Both Windows 10 and Microsoft Office 2016 are supported by Patch Manager Plus. You should ensure that your Patch Database is successfully synchronized in the recent past. Verify it from, Patch Mgmt -> Update Vulnerability DB -> Last update time.
  • Can I use Patch Manager Plus to manage 3rd Party applications? Yes, Patch Manager Plus supports managing 3rd party applications. Find the list of supported 3rd party applications: https://www.manageengine.com/products/desktop-central/patch_management_supported_application.html.
  • Can I create a report for systems that need patches older than 30 days? You can, create a report from, Patch Mgmt -> All Patches -> Missing Patches Tab -> Computer View and create a filter based on the “Release Date”
  • Can you install the Patch Manager Plus server in the cloud and have remote clients grab updates from that server to conserve bandwidth at the home office? Yes, you can sign-up, create an account and start using Patch Manager Plus Cloud version.
  • Is it possible to set patch deployment Policy schedule to run every 3rd Sunday of the month? Yes, when you create an APD task, under scheduler select Monthly option and choose 3rd Sunday
  • Why are dynamic custom groups not always available? Dynamic custom groups are evaluated on the client side during deployment based on the criteria you have defined.
  • Can you disable windows automatic updates?Yes, under Patch Mgmt->Disable Automatic Updates, choose templates and disable
  • If I want to scan computer for missing patches during the day to approve the patches for deployment overnight, how would I schedule that? You might need to create 2 separate APD tasks as below to achieve this: • Create the first task to just scan the computers and schedule this at 10 AM. This will complete by 12 noon and you will get the list of missing patches, which you can choose and approve • Create a second task scheduled to run at 3PM (assuming that you would approve the patches by then). For this task, define a Deployment policy with o Deployment Window with start and end times as required, say start at 8 PM o Select this option “Download Patches/Software during subsequent Refresh Cycle”The second task will start at 3 PM and scan the computers again and download the necessary patches to the agents. Assuming that all the target computers are up, this will complete and keep things ready for deployment by 6 PM. The deployment will begin at the scheduled deployment window, 8 PM
  • We currently have a large number of Laptops which need to be updated. These laptops are rarely connected to the domain, and when they are it is via a VPN. How do we push patches to these laptops without impacting user experience or poking holes in our firewall?When these computers connect to the network via VPN, the deployment will be initiated during the next refresh cycle (90 minutes)
  • Are all patches released by Microsoft available for patching via Patch Manager Plus?Yes, almost all patches that have a download URL will be supported. You can get the list of patches that we support from here: https://www.manageengine.com/products/desktop-central/patch-management/microsoft-security-bulletins.html
  • What is the average turn around for patches to be updated by you guys. For instance the latest flash patch took until the next day to come out. We usually support within 24 hours
  • How much disk space does a Distribution Server need to have to cache patches?It depends on the number of systems and patches that are maintained, maybe up-to 1 GB. It is recommended to configure patch cleanup settings to remove older patches automatically. This will also cleanup the distribution server.
  • If you do the cleanup and then put a newer machine and it needs an older patch what will happen?It will automatically be downloaded and installed
  • How do I know which updates to run and the order to run them?Patch interdependencies and sequencing will be automatically be taken care by Patch Manager Plus.
  • After the initial agent deployment, will patch management scan subnets for new machines that do not have the agent going forward?No, agent should be deployed prior to scanning. You can define SoM Sync Policy to automatically identify new computers added to Active Directory and install agents on them.
  • Can you send a process on how to disable windows 10 creep update for Windows 7 computers?Under Configuration Templates, we have a template to disable windows10 creep update (Disable Windows 10 Notification.)
  • Can one distribution Server support multiple remote offices?Yes, it is technically possible if all the remote offices use the same agent and if all the remote office computers can reach the Distribution Server. However this is not applicable for Patch Manager Plus cloud, since every remote office needs a unique Distribution Server.
  • Is it possible to deploy patches to specific computers?Yes, the ideal way to do this is go to the All Systems View, select the computer and install all missing patches to this computer.
  • If distribution server is stopped so whether client will be able to communicate to main server?Yes, the agents will contact the server to post the failure messages. But, no deployment will happen
  • What happens when my trial expires? or What happens when I move from the Trial Edition to Free Edition?Once the 30-day trial expires, you can either extend you trial, purchase the product or move to Free edition. After the trial, you will be automatically moved to the free edition, where move to the Free edition, you are allowed to choose the computers(up to 25) that you want to manage.
  • How to purchase PMP cloud?On the PMP server, navigate to Admin tab and select Subscription, under Global Settings. Click Manage Plan, you will be redirected to. Zoho Store page. Purchase or Renew your license here. On successful completion, your PMP Cloud license will be activated immediately. In case the has expired, click on the Buy Now to proceed with the reactivation.
  • What are the types of payments supported by PMP Cloud?Payments are securely done using Zoho Store. PMP Cloud supports payment via Visa, MasterCard, American Express and PayPal. You can also purchase offline(Non-Store), by mailing to sales@manageengine.com.
  • How do I modify my PMP Cloud license?Modify your license by navigating to this link (sign up with the Zoho account, if need be). Click on Manage Plan, which re-directs you to Zoho Store. Hovering on the plan, lets you add/remove the number of computers to be managed. Similarly, hovering on technicians and multi-language support, lets you add/remove technicians and unsubscribe multi-language support respectively Assume you want to add more computers for management. Click on the plan and specify the number of devices you want to manage. On specifying the additional devices, the required cost to be paid is displayed. You can then continue with the payment and finish the purchase.
  • How to change payment method from offline(Non-Store) to online? On the PMP server, navigate to Admin tab and select Subscription, under Global Settings. Click Manage Plan, which redirects you to Zoho Store. Click Payment Method link. Provide credit card details and click on Update, to modify your payment method.
  • How do I add users(technicians) to manage devices? You can add users from Admin -> User administration -> Add user. You can associate users to either pre-defined roles or create roles and associate them. Additionally, you can modify the users, their roles and even delete them.
  • If distribution server is stopped so whether client will be able to communicate to main server?Yes, the agents will contact the server to post the failure messages. But, no deployment will happen
  • Why am I unable to sign up with PMP Cloud service?If you encounter an error stating that "you are part of another organization" such as "Access denied for this service. Please contact your Org administrator, it implies that you are already registered for Zoho Services. A super admin assigned for Zoho Services, is the only person/profile who can sign up for any additional Zoho service including PMP Cloud. You will have to request the super admin to add yourself as a technician to use PMP Cloud. In case you want create an independent account, or evaluate PMP Cloud, you can use an alternate e-mail address to sign up and use the service.