FARONICS DEEP FREEZE ENTERPRISE - PATCH MANAGEMENT..., Manual

Page 1: ...e Filter Faronics Power Save Faronics Insight Faronics System Profiler and WINSelect are trademarks and or registered trademarks of Faronics Corporation All other company and product names are trademarks of their respective owners Faronics Toll Free Tel 800 943 6422 Toll Free Fax 800 943 6488 International Tel 1 604 637 3333 International Fax 1 604 637 8188 Deep Freeze Enterprise Patch Management ...

Page 2: ... Creating the Group Policy 15 Modifying the Group Policy 16 Enforcing the Group Policy 16 Real Time Patch Maintenance 17 Disabling Deep Freeze Locally 17 Disabling Deep Freeze Through the Enterprise Console 17 Disabling Deep Freeze Through the Command Line Control 17 Configuring Software to Update in a Thawed Location 17 Appendix A Deep Freeze and SUS WSUS FAQ 18 Appendix B Deep Freeze Update Scri...

Page 3: ...hawed state During this Maintenance Period software updates Windows Updates and antivirus definition updates can be scheduled Scripts can be run and batch files can be executed Scheduled patch maintenance is an appropriate strategy for computer labs During certain times on certain days of the week labs are not in use A Maintenance Period can be scheduled to run updates during these times Maintenan...

Page 4: ...ded Events tab 2 Specify day and time the Maintenance Period will occur The window should look similar to the following In the above screen Tuesday has been selected for Maintenance with the Run Windows Update option At 1 00 AM the computer restarts in a Thawed state At 4 00 AM the computer restarts in a Frozen state The Disable Keyboard and Mouse checkbox has been checked this means that the keyb...

Page 5: ...o control settings for automatic updates through the use of Group Policy in a domain environment It is recommended that the following configuration be used to configure the Automatic Update client on a computer running Deep Freeze Computer Configuration Administrative Templates Windows Update Configure Automatic Updates Enabled Configure Automatic Updating Enabled Scheduled install day 0 if Mainte...

Page 6: ...hat any updates that are downloaded but not installed will not attempt to reinstall on the client computer while Frozen Administrators need to ensure that the Maintenance Period configured in Deep Freeze is long enough to complete the download and installation of the updates from whatever source is configured and that computers are either left on to enter the Maintenance Period or are woken up pri...

Page 7: ...s Documents DFEnt_PandaAntivirus pdf Symantec Anti Virus Corporate Edition http www faronics com Faronics Documents DFEnt_SymantecAntivirus pdf Trend Micro OfficeScan http www faronics com Faronics Documents DFEnt_TrendOfficeScan pdf For additional white papers describing antivirus products that may have been added to the Faronics Content Library after publication of this white paper refer to http...

Page 8: ...ompted as to whether they would like to run the updates If they agree Deep Freeze is disabled the updates are run and Deep Freeze is re enabled The example below assumes that the person implementing the script is familiar with Group Policy Active Directory and Visual Basic Scripting Logon Patch Maintenance Theory This concept deals with updating a Frozen machine when the user logs on With some sli...

Page 9: ...update it prompts the user If the user selects Yes the computer is put into a Thawed state At this point the patch is applied and the computer is returned to a Frozen state Use the following steps to create the script file one section at a time The script file can be created using many different editors In this case Notepad is used 1 Open Notepad and enter the following text to create the global a...

Page 10: ...nes as required 4 Enter the following text to create the UpdateRunning function UPDATE RUNNING Check for marker file If exists the update is running Return True Function UpdateRunning Set objFS CreateObject Scripting FileSystemObject Set objFolder objFS GetFolder strUNCPath Set objRE new RegExp objRE Pattern strMarkerFile objRE IgnoreCase True For Each objFile In objFolder Files If objRE Test objF...

Page 11: ...created which signifies the completion of the update If this file exists the function returns a value of True 6 Enter the following text to create the UserPatchPrompt function USER PATCH PROMPT Prompt the user whether they would like to run the updates at this time Function UserPatchPrompt intAnswer Msgbox Anupdatehasbeendetected Wouldyouliketoruntheupdatenow vbLF _ The update process will require...

Page 12: ... Deep Freeze is Frozen and returns True or False Function Frozen Set objShell CreateObject Wscript Shell intStatus objShell Run DFC password ISFROZEN 1 True If intStatus 0 Then DF is Thawed Frozen False Else If intStatus 1 Then DF is Frozen Frozen True Else A number of other reasons End If End If End Function The Frozen function checks to see if Deep Freeze is Frozen If it is Frozen the function r...

Page 13: ...rker file remains on the server until it is removed by the DeleteMarker routine 12 Enter the following text to create the RemoveMarker routine REMOVE MARKER Remove the marker file to indicate the patch is complete Sub RemoveMarker Set objFSO CreateObject Scripting FileSystemObject objFSO DeleteFile strUNCPath strMarkerFile End Sub The RemoveMarker routine removes the marker file on the server to i...

Page 14: ...Nothing Set objTextFile Nothing Set objFSO Nothing This code cleans up all the objects that have been created throughout the script 15 Save the file as DF Update vbs Make sure the file is saved as a vbs and not a txt The icon should look like the following The script is now ready to be implemented through a logon script in Group Policy NOTE The script does not contain any error handling ...

Page 15: ...on to the network with a laptop machine requiring updates Use the following steps to create the Policy 1 Right click on the desired User OU and select Properties The properties dialog appears 2 Select the Group Policy tab If the Group Policy Management console is successfully installed the following screen appears 3 Click Open The Group Policy Management window opens displaying all the OUs that ha...

Page 16: ... 6 Click Add in the Logon Properties dialog The Open dialog should appear and point to the folder where the script was just placed 7 Select DF Update vbs and click OK 8 Click OK on the Logon Properties dialog to save the settings Enforcing the Group Policy The logon script has been configured to execute when the user logs on However the GPO is not yet enforced Enforcing a GPO indicates to the Acti...

Page 17: ...to put a computer into a Thawed state using the Deep Freeze Enterprise Console 1 Launch the Deep Freeze Enterprise Console 2 Select the computers that need to be put into a Thawed state 3 Click the Reboot Thawed icon in the toolbar or right click and select Reboot Thawed from the menu The selected computers will reboot in the Thawed state Disabling Deep Freeze Through the Command Line Control The ...

Page 18: ...ended or the computer was restarted or powered off If an update is incomplete for any reason the mechanism that Microsoft uses will correct and reinstall the update the next time the service is called Will the computer restart during the update process if the update being installed requires it to do so Yes the computer will restart as many times as required until the updates are completed What do ...

Page 19: ...eze Command Line Control NOTES The following script will turn off Deep Freeze run updates and turn on Deep Freeze GLOBAL ASSEMBLIES Set objNet CreateObject WScript NetWork GLOBAL VARIABLES Modify the UNC path to match that of your server envrionment strUNCPath FarDemo local NETLOGON strMarkerFile objNet ComputerName mar strMarkerCompleteFile COMPLETED objNet ComputerName fin MAIN Calls all of the ...

Page 20: ...ready run Function UpdateComplete Set objFS CreateObject Scripting FileSystemObject Set objFolder objFS GetFolder strUNCPath Set objRE new RegExp objRE Pattern strMarkerCompleteFile objRE IgnoreCase True For Each objFile In objFolder Files If objRE Test objFile Name Then UpdateComplete True Exit Function End If Next UpdateComplete False End Function USER PATCH PROMPT Prompt the user whether they w...

Page 21: ...ell intStatus objShell Run DFC password ISFROZEN 1 True If intStatus 0 Then DF is Thawed Frozen False Else If intStatus 1 Then DF is Frozen Frozen True Else A number of other reasons End If End If End Function BOOT FROZEN Sub BootFrozen Set objShell CreateObject Wscript Shell objShell Run DFC password BOOTFROZEN End Sub BOOT THAWED Sub BootThawed Set objShell CreateObject Wscript Shell objShell Ru...

Page 22: ...SERT UPDATE COMPLETE MARKER This inserts an update completed file to prevent update looping Sub InsertCompleteMarker Set objFSO CreateObject Scripting FileSystemObject Set objFile objFSO CreateTextFile strUNCPath strMarkerCompleteFile End Sub CLEANUP Set objNet Nothing Set objFile Nothing Set objRE Nothing Set objFolder Nothing Set objTS Nothing Set objFS Nothing Set objTextFile Nothing Set objFSO...

Page 23: ...nt Requirement Some cases exist where computers are in use for 24 hours In these environments it can be difficult to take computers offline to apply changes Most patches do not require a restart In order to disable Deep Freeze a restart is required How can patches be deployed in this type of environment Solution In these types of environments the computers should be kept in a consistent state Deep...