Symantec ALTIRIS INVENTORY 7.0 SP2 - FOR NETWORK DEVICES... User manual

Altiris™Patch Management
Solution for Windows from
Symantec User Guide
Version 7.0 SP2

Altiris™Patch Management Solution for Windows from
Symantec User Guide
The software described in this book is furnished under a license agreement and may be used
only in accordance with the terms of the agreement.
Legal Notice
Copyright © 2010 Symantec Corporation. All rights reserved.
Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the
product are trademarks or registered trademarks of Symantec Corporation or its affiliates
in the U.S. and other countries. Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO
BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL
OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED
IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software
as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19
"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in
Commercial Computer Software or Commercial Computer Software Documentation", as
applicable, and any successor regulations. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentation by the U.S.
Government shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
http://www.symantec.com

Technical Support
Symantec Technical Support maintains support centers globally. Technical
Support’s primary role is to respond to specific queries about product features
and functionality. The Technical Support group also creates content for our online
Knowledge Base. The Technical Support group works collaboratively with the
other functional areas within Symantec to answer your questions in a timely
fashion. For example, the Technical Support group works with Product Engineering
and Symantec Security Response to provide alerting services and virus definition
updates.
Symantec’s support offerings include the following:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and/or web-based support that provides rapid response and
up-to-the-minute information
■Upgrade assurance that delivers software upgrades
■Global support purchased on a regional business hours or 24 hours a day, 7
days a week basis
■Premium service offerings that include Account Management Services
For information about Symantec’s support offerings, you can visit our web site
at the following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement
and the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
www.symantec.com/business/support/
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be
at the computer on which the problem occurred, in case it is necessary to replicate
the problem.
When you contact Technical Support, please have the following information
available:
■Product release level

■Hardware information
■Available memory, disk space, and NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description:
■Error messages and log files
■Troubleshooting that was performed before contacting Symantec
■Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registration or a license key, access our technical
support web page at the following URL:
www.symantec.com/business/support/
Customer service
Customer service information is available at the following URL:
www.symantec.com/business/support/
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates, such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information about product updates and upgrades
■Information about upgrade assurance and support contracts
■Information about the Symantec Buying Programs
■Advice about Symantec's technical support options
■Nontechnical presales questions
■Issues that are related to CD-ROMs or manuals

Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
[email protected]Asia-Pacific and Japan
[email protected]Europe, Middle-East, and Africa
[email protected]North America and Latin America
Additional enterprise services
Symantec offers a comprehensive set of services that allow you to maximize your
investment in Symantec products and to develop your knowledge, expertise, and
global insight, which enable you to manage your business risks proactively.
Enterprise services that are available include the following:
Managed Services remove the burden of managing and monitoring security
devices and events, ensuring rapid response to real threats.
Managed Services
Symantec Consulting Services provide on-site technical expertise from
Symantec and its trusted partners. Symantec Consulting Services offer a variety
of prepackaged and customizable options that include assessment, design,
implementation, monitoring, and management capabilities. Each is focused on
establishing and maintaining the integrity and availability of your IT resources.
Consulting Services
Education Services provide a full array of technical training, security education,
security certification, and awareness communication programs.
Education Services
To access more information about enterprise services, please visit our web site
at the following URL:
www.symantec.com/business/services/
Select your country or language from the site index.

Technical Support ............................................................................................... 3
Chapter 1 Introducing Patch Management Solution for
Windows .......................................................................... 11
About Patch Management Solution for Windows ............................... 11
How Patch Management Solution for Windows works ......................... 12
Where to get more information ....................................................... 13
Chapter 2 Implementing Patch Management Solution for
Windows .......................................................................... 15
Implementing Patch Management Solution for Windows ..................... 15
Chapter 3 Installing Patch Management Solution for
Windows .......................................................................... 17
Prerequisites for Patch Management Solution for Windows ................. 17
Installing Patch Management Solution for Windows ........................... 18
Upgrading Patch Management Solution for Windows ......................... 18
Migrating from Patch Management Solution for Windows 6.2 to
7.x ....................................................................................... 18
Uninstalling Patch Management Solution for Windows ....................... 21
Licensing .................................................................................... 21
Chapter 4 Installing the Software Update Plug-in .......................... 23
About the Software Update Plug-in ................................................. 23
Installing the Software Update Plug-in ............................................. 24
Upgrading the Software Update Plug-in ........................................... 24
Uninstalling the Software Update Plug-in ......................................... 25
About the Software Update Plug-in user interface .............................. 25
Chapter 5 Configuring Patch Management Solution for
Windows .......................................................................... 29
Configuring patch management Core Services settings ....................... 29
Customizing severity levels ............................................................ 30
Contents

Configuring vendor settings ........................................................... 31
Configuring software updates installation settings ............................ 31
Configuring inventory and vulnerabilities checking interval ................ 32
Core Services page ....................................................................... 33
Patch management vendor settings page .......................................... 33
Default Software Update Plug-in Policy page ..................................... 35
Chapter 6 Configuring Patch Management server tasks ............... 39
About Patch Management server tasks ............................................. 39
Downloading software updates catalog ............................................ 40
Downloading QChain .................................................................... 41
Checking Software Update packages integrity .................................. 42
Patch Management Import page ..................................................... 42
Download QChain page ................................................................. 43
Chapter 7 Staging and distributing software bulletins and
software updates ........................................................... 45
About software updates and software bulletins .................................. 45
About staging and distributing software bulletins .............................. 46
Staging software bulletins ............................................................. 47
Distributing software updates ........................................................ 48
Viewing the software update delivery summary report ....................... 49
About Software Update policies and maintenance windows ................. 49
Patch Remediation Center page ...................................................... 49
Software Update Policy Wizard pages .............................................. 51
Chapter 8 Using Patch Management reports ................................... 53
About Patch Management Solution for Windows reports ..................... 53
About compliance reports .............................................................. 54
About diagnostic reports ............................................................... 55
About remediation status reports .................................................... 55
About software bulletin reports ..................................................... 55
About the Patch Management home page ......................................... 55
Viewing Patch Management reports ................................................ 56
Chapter 9 Replicating Patch Management data in
hierarchy ......................................................................... 59
About replicating Patch Management data ........................................ 59
About Patch Management Language Alert rule .................................. 60
Replicating Patch Management language alerts ................................. 60
Contents8

About Patch Management software update catalog replication ............. 61
Replicating Patch Management import data ...................................... 61
About Software Update policy replication ......................................... 62
Replicating Software Update policies ............................................... 62
Appendix A Technical reference ............................................................ 65
About hierarchy and data replication direction .................................. 65
About Patch Management security roles ........................................... 66
Index .................................................................................................................... 69
9Contents

Contents10

Introducing Patch
Management Solution for
Windows
This chapter includes the following topics:
■About Patch Management Solution for Windows
■How Patch Management Solution for Windows works
■Where to get more information
About Patch Management Solution for Windows
Patch Management Solution for Windows takes inventory of managed computers
to determine the operating system and software updates (patches) they require.
The solution then downloads the required patches and provides wizards to help
you deploy patches. The solution enables you to set up a patch update schedule
to ensure that managed computers are kept up-to-date with the latest vendor
security updates. Managed computers are then protected on an on-going basis.
Key features include a comprehensive software repository that automates the
downloads from the vendor site before distribution without administrator
intervention. The repository provides comprehensive data on software bulletins,
software updates, inventory rules, such as technical details, severity ratings, and
number of executables. The process of populating the information repository
from the Microsoft Patch Management Import files can be started after installation
is complete.
To reduce labor, the Software Update Plug-in automatically analyses managed
computer. The Software Update Plug-in gathers Patch-specific inventory on
1
Chapter

supported operating systems, applications, and the associated service pack level.
The inventory data is used to determine whether a patch is required or not.
Inventory results populate predefined filters. The Software Update Policy Wizard
then automatically assigns software updates to relevant filters. The wizard also
simplifies the management of distribution. Instead of creating a policy for each
individual software update, you create a single policy for the relevant software
bulletin. For example, if three software bulletins with seven software updates
address various operating systems in various languages, you only have to manage
three distribution policies. If you want to, you can modify any default settings
and command-line options in a Software Update policy.
Integration with Notification Server 7.0 includes features such as hierarchy and
maintenance windows. Hierarchy lets you configure features and settings for a
parent Notification Server, then pass the settings down to child Notification
Servers . Further on integration, Patch Management Solution for Windows can
be used with other Altiris solutions from Symantec such as Altiris® Recovery
Solution from Symantec. After Recovery Solution is installed, Patch Management
Solution for Windows provides an agent option to automatically create a snapshot
before patch installations. Snapshots allow for rollback when a patch causes a
problem.
How Patch Management Solution for Windows works
This section provides an overview of how inventory information is used to decide
which software update packages to distribute. From software update packages,
you create the Software Update policies that send the associated packages to
managed computers and install the appropriate software update programs.
After Patch Management Solution for Windows is installed, it downloads complete
software bulletin information from the Altiris Web site. Information includes the
severity of each software bulletin, details on its software updates, and where they
can be downloaded from Microsoft or Adobe. This information also includes rules
for creating filters and rules on how to verify that a software update is installed.
Patch Management Solution for Windows deploys the Software Update Plug-in
to managed computers, which gathers inventory including software vendor,
software release, and service pack information. From this inventory, Patch
Management Solution for Windows creates specific filters to target only the
computers requiring individual software updates.
See “About the Software Update Plug-in”on page 23.
You must stage software bulletins to download software updates and create
packages. When a software bulletin is staged, each associated software update
executable is downloaded from Microsoft or Adobe to the Notification Server
computer. From the information in software bulletin executables, Patch
Introducing Patch Management Solution for Windows
How Patch Management Solution for Windows works
12

Management Solution for Windows then creates a software update package for
each software update. From the staged software bulletins , you must create
Software Update policies to distribute software update packages to the appropriate
computer filters (previously known as collections). When a managed computer
receives a Software Update policy, it verifies that the update is needed, then
downloads the software update package from the Notification Server computer.
The managed computer then installs the update. At an interval, the Software
Update policy is re-evaluated and software updates are reinstalled if needed. For
example, if an operation removes a software update, it is reinstalled. Or if a vendor
revises a software update, it is reinstalled.
After the Software Update Plug-in distributes software updates, it sends results
of patch deployment to the Notification Server computer. This information can
be viewed through reports and the dashboard. You can configure part or all of
Patch Management Solution for Windows to automatically download and install
future software updates. When configuring the solution you should consider
possible effects on your network environment. Distribute new updates to a test
environment first.
Where to get more information
Use the following documentation resources to learn and use this product.
Table 1-1 Documentation resources
LocationDescriptionDocument
http://kb.altiris.com/
You can search for the product name under
Release Notes.
Information about new features and
important issues.
This information is available as an article in
the knowledge base.
Release Notes
■The Documentation Library, which is
available in the Symantec Management
Console on the Help menu.
■The Product Support page, which is
available at the following URL:
http://www.symantec.com/business
/support/all_products.jsp
When you open your product’s support
page, look for the Documentation link
on the right side of the page.
Information about how to use this product,
including detailed technical information and
instructions for performing common tasks.
This information is available in PDF format.
User Guide
13Introducing Patch Management Solution for Windows
Where to get more information

Table 1-1 Documentation resources (continued)
LocationDescriptionDocument
The Documentation Library, which is
available in the Symantec Management
Console on the Help menu.
Context-sensitive help is available for most
screens in the Symantec Management
Console.
You can open context-sensitive help in the
following ways:
■The F1 key
■The Context command, which is available
in the Symantec Management Console
on the Help menu.
Information about how to use this product,
including detailed technical information and
instructions for performing common tasks.
Help is available at the solution level and at
the suite level.
This information is available in HTML help
format.
Help
In addition to the product documentation, you can use the following resources to
learn about Altiris products.
Table 1-2 Altiris information resources
LocationDescriptionResource
http://kb.altiris.com/Articles, incidents, and issues about Altiris
products.
Knowledge base
http://www.symantec.com/connect
/endpoint-management-virtualization
An online magazine that contains best
practices, tips, tricks, forums, and articles
for users of this product.
Symantec Connect
(formerly Altiris Juice)
Introducing Patch Management Solution for Windows
Where to get more information
14

Implementing Patch
Management Solution for
Windows
This chapter includes the following topics:
■Implementing Patch Management Solution for Windows
Implementing Patch Management Solution for
Windows
Patch Management Solution for Windows requires some components to be
configured or enabled before others function correctly. When initially completing
each task you can also configure it for future automation. Automation is a key
feature of Patch Management Solution for Windows as it reduces system
administration workload and enhances overall security.
To implement Patch Management Solution for Windows
1Install the solution.
See “Installing Patch Management Solution for Windows”on page 18.
2Install or upgrade the Altiris Agent 7.0 on every computer to which you want
to send patches.
For more information, see topics about installing the Altiris Agent in the
Symantec Management Platform User Guide.
2
Chapter

3Install or upgrade the Software Update Plug-in.
See “Installing the Software Update Plug-in”on page 24.
See “Upgrading the Software Update Plug-in”on page 24.
4Configure the Patch Management Solution core settings.
See “Configuring patch management Core Services settings”on page 29.
5Configure the Software Updates installation settings.
See “Configuring software updates installation settings ”on page 31.
6Configure the vulnerabilities check interval.
See “Configuring inventory and vulnerabilities checking interval”on page 32.
7Download Adobe software updates catalog, Microsoft software updates catalog
and QChain.
See “Downloading software updates catalog”on page 40.
See “Downloading QChain”on page 41.
8View which software updates you need to install and stage software bulletins.
See “Staging software bulletins”on page 47.
9Create Software Update policies to distribute software updates.
See “Distributing software updates”on page 48.
10 Evaluate the results by running the Software Update Delivery Summary
report and revisiting compliance reports.
See “Viewing the software update delivery summary report ”on page 49.
See “Viewing Patch Management reports”on page 56.
Implementing Patch Management Solution for Windows
Implementing Patch Management Solution for Windows
16

Installing Patch
Management Solution for
Windows
This chapter includes the following topics:
■Prerequisites for Patch Management Solution for Windows
■Installing Patch Management Solution for Windows
■Upgrading Patch Management Solution for Windows
■Migrating from Patch Management Solution for Windows 6.2 to 7.x
■Uninstalling Patch Management Solution for Windows
■Licensing
Prerequisites for Patch Management Solution for
Windows
Patch Management Solution for Windows requires the following:
■Symantec Management Platform 7.0 SP4.
For more information, see topics about system requirements for Symantec
Management Platform in the Symantec Management Platform Installation
Guide.
When you install or upgrade Patch Management Solution for Windows through
the Symantec Installation Manager, Symantec Management Platform is installed
or upgraded automatically.
3
Chapter

See “Installing Patch Management Solution for Windows”on page 18.
Installing Patch Management Solution for Windows
You install Patch Management Solution for Windows through the Symantec
Installation Manager as part of the Altiris™Client Management Suite or Altiris™
Server Management Suite.
You can also install Patch Management Solution for Windows separately from
other suite components.
See “Prerequisites for Patch Management Solution for Windows”on page 17.
To install Patch Management Solution for Windows
1Do one of the following:
■Download and run the Altiris Client Management Suite or Altiris Server
Management Suite installation file from the Symantec Web site
(www.symatec.com).
■If you already have the Symantec Installation Manager installed, click
Start > All Programs > Altiris > Symantec Installation Manager >
Symantec Installation Manager.
2In the Symantec Installation Manager, click Install New Products.
3In the Filter by box, click None.
4In the list of available products, select Altiris Patch Management Solution
for Windows.
5Follow the installation wizard through to completion.
Upgrading Patch Management Solution for Windows
Use the Symantec Installation Manager to upgrade the product.
Migrating from Patch Management Solution for
Windows 6.2 to 7.x
Migrating, or upgrading, from Patch Management Solution for Windows 6.2 to
7.x is handled through the Symantec Installation Manager.
If you want to install 7.x to a new computer, the upgrade process is as follows:
■Installing the Symantec Installation Manager on the Notification Server
computer with Patch Management Solution for Windows 6.2.
Installing Patch Management Solution for Windows
Installing Patch Management Solution for Windows
18

See “To install the Symantec Installation Manager on a 6.x Notification Server”
on page 19.
■Running the Symantec Installation Manager migration wizard on the 6.2 to
export data.
See “To export data from Patch Management Solution for Windows 6.2 ”
on page 19.
■Running the Patch Management Import task on the 7.x.
See “Downloading software updates catalog”on page 40.
■Running the Symantec Installation Manager migration wizard on the 7.x to
import the 6.2 data.
See “To import 6.2 data into Patch Management Solution for Windows 7.x”
on page 20.
To install the Symantec Installation Manager on a 6.x Notification Server
1Install Patch Management Solution for Windows 7.x.
See “Installing Patch Management Solution for Windows”on page 18.
2Open Windows Explorer on the computer with Patch Management Solution
for Windows 7.x installed.
3Navigate to C:\Program Files\Altiris\Symantec Installation
Manager\Installs\Altiris.
4Select and copy the following files, and move them to the computer with
Patch Management Solution for Windows 6.2 installed:
■altiris_nsupgrade_7_0_x86.msi
■pmcoreupgrade_7_0.msi
■pmwindowsupgrade_7_0.msi
5On the computer with 6.2, run the files in the following order:
■altiris_nsupgrade_7_0_x86.msi
■pmcoreupgrade_7_0.msi
■pmwindowsupgrade_7_0.msi
Running the three .msi files builds the migration structure on the 6.2
computer.
To export data from Patch Management Solution for Windows 6.2
1Open Windows Explorer on the computer with Patch Management Solution
for Windows 6.2 installed.
2Navigate to C:\Program Files\Altiris\Upgrade.
19Installing Patch Management Solution for Windows
Migrating from Patch Management Solution for Windows 6.2 to 7.x

3Double-click the file NSUpgradeWizard.exe.
4To start migration, on the first page of the wizard, click Next.
5On the Export / Import Task Selection page of the wizard, click Export data
from an Altiris Notification Server to a file store.
6In the Data store box, leave the default location or specify a different location,
and click Next.
7On the Products section of the Exporter Configuration page of the wizard,
ensure Patch Management Core Solution and Patch Management Solution
are selected.
8Make any wanted changes to the Exporters list, and click Next.
9Review the product readiness check, and click Next.
10 Once the data export has completed, click Finish.
The data file is now ready to copy across to the 7.x computer from the location
that was specified in step 6.
Note: Custom locations for 6.2 Microsoft Patch Management Import files cannot
migrate to 7.x.
To import 6.2 data into Patch Management Solution for Windows 7.x
1Copy the .adb data file exported from Patch Management Solution 6.2 to the
computer with Patch Management Solution 7.x installed.
2Navigate to C:\Program Files\Altiris\Upgrade.
3Double-click the file NSUpgradeWizard.exe.
4To start migration, on the first page of the wizard, click Next.
5On the Export / Import Task Selection page of the wizard, click Import data
from a file store into an Altiris Notification Server, and click Next.
6In the Data store box, navigate to and select the 6.2 data file.
7On the Importer Configuration page of the wizard, under Products, ensure
Patch Management Core Solution and Patch Management Solution are
selected.
8Make any wanted changes to the Importers list, and click Next.
9Review the product readiness check, and click Next.
10 Once the data import has completed, click Finish.
Migration from Patch Management Solution 6.2 to 7.x is now completed.
Installing Patch Management Solution for Windows
Migrating from Patch Management Solution for Windows 6.2 to 7.x
20