Agentless Patch Management

The fastest way to get Security Controls configured and patching machines is to do so agentlessly, as described in Best Approach for Applying Patches in an Agentless Environment. Once the console is installed it can take as little as a few minutes to setup machine groups to scan an environment. The time to configure will be based on the complexity of the environment and the range of maintenance windows.

Example

An office that contains three floors, with approximately 500 end users per floor as well as a data center with 200 servers, could be broken out many ways. You might create a separate machine group for each floor based on the IP range of the workstations. Servers might be broken down into three more groups: Test, Development, and Production. You might consider breaking the Production department into separate groups such as domain controllers and Exchange / SQL Servers to allow flexibility in scheduling jobs.

Time to Implement

It will take approximately five minutes to create three groups covering the three floors of workstations. Plan on 10-30 minutes to create the server groups; they can be created by OU, by browsing and selecting machines, or by importing identities from a file. Plan on another 15 minutes to schedule the jobs that will scan and optionally auto deploy patches.

The overall time to configure the machine groups and to schedule the scans in this example environment is approximately 45 minutes. Once this is done we are configured and ready to go.

Port Requirements

For agentless scans you will need to be able to resolve the machine by the method you used to create the machine group. You must also be able to access TCP ports 137 - 139 or port 445 on the target machine. File and print sharing and remote registry must be enabled in order to perform the scan. For added security, firewall rules can be applied between vLANs or on the local machine firewall that restrict port access to all but the console’s IP. Depending on the environment, complexity, rules, and change control requirements, the amount of time this will add to the initial configuration may vary.

Related Topics