FARONICS DEEP FREEZE ENTERPRISE - PATCH MANAGEMENT... Bedienungsanleitung

TECHNICAL WHITEPAPER

Last modified: June 26, 2009

www.faronics.com

Faronics Core Console, Faronics Anti-Executable, Faronics Device Filter, Faronics

Power Save, Faronics Insight, Faronics System Profiler, and WINSelect are

trademarks and/or registered trademarks of Faronics Corporation. All other

company and product names are trademarks of their respective owners.

Faronics

Toll Free Tel: 800-943-6422

Toll Free Fax: 800-943-6488

International Tel: +1 604-637-3333

International Fax: +1 604-637-8188

Deep Freeze Enterprise - Patch Management

ENTERPRISE

2

Contents

Introduction....................................................................................................................................... 3

Scheduled Patch Maintenance........................................................................................................... 3

Scheduling Windows Updates..................................................................................................................... 3

Scheduling Windows Updates in a Deep Freeze Maintenance Period.............................................. 4

Scheduling Windows Updates through Group Policy .............................................................................5

Scheduling Antivirus Updates..................................................................................................................... 7

Scheduling Additional Program Updates .................................................................................................. 7

Logon Patch Maintenance ................................................................................................................. 8

Logon Patch Maintenance eory..............................................................................................................8

Logon Patch Maintenance Example ...........................................................................................................9

Creating the Update Script......................................................................................................................9

Creating the Group Policy.....................................................................................................................15

Modifying the Group Policy .................................................................................................................16

Enforcing the Group Policy ..................................................................................................................16

Real Time Patch Maintenance......................................................................................................... 17

Disabling Deep Freeze Locally ..................................................................................................................17

Disabling Deep Freeze rough the Enterprise Console.......................................................................17

Disabling Deep Freeze rough the Command Line Control..............................................................17

Conﬁguring Soware to Update in a awed Location ................................................................. 17

Appendix A: Deep Freeze and SUS/WSUS FAQ ............................................................................. 18

Appendix B: Deep Freeze Update Script......................................................................................... 19

Appendix C: Common Update Scenarios ....................................................................................... 23

Scenario 1: Updating Clients in a Dynamic Update Environment ......................................................23

Scenario 2: Updating in a 24-Hour Lab Environment...........................................................................23

Scenario 3: Updating in a Mobile Environment .....................................................................................23

3

ENTERPRISE

Introduction

A major concern for all systems administrators is maintaining the security of their computers. With

new exploits and vulnerabilities being found all the time, a proper patch management strategy is critical

to ensure the health and security of computer deployment.

Deep Freeze allows systems administrators to ensure the integrity of their computers against exploits

— even ones that have yet to be discovered. However, it introduces some challenges within the process

of applying patches because Deep Freeze does not discriminate — it removes both the good and the

bad changes and returns the computer to its original, pristine state on every restart.

ere are several methods for integrating Deep Freeze with patch management. When properly done,

users can enjoy the bulletproof reliability of a Deep Freeze protected system and system administrators

can have the peace of mind that comes from knowing their systems are fully up to date.

is white paper discusses the diﬀerent methods available to update soware in a Deep Freeze

environment.

ScheduledPatchMaintenance

Scheduled patch maintenance allows the administrator to specify a period of time when the client

computers restart with Deep Freeze in a awed state. During this Maintenance Period, soware

updates, Windows Updates, and antivirus deﬁnition updates can be scheduled. Scripts can be run and

batch ﬁles can be executed.

Scheduled patch maintenance is an appropriate strategy for computer labs. During certain times on

certain days of the week, labs are not in use. A Maintenance Period can be scheduled to run updates

during these times.

Maintenance Periods are conﬁgured using the Deep Freeze Conﬁguration Administrator. e

Conﬁguration Administrator is used to conﬁgure workstation installation ﬁles as well as conﬁguration

ﬁles. Conﬁguration ﬁles can be used to apply the changes to deployed computers through the Deep

Freeze Enterprise Console.

Depending on the policies in place, certain updates may need to be run. Windows and antivirus

updates tend to be the most frequent. e following information explains some of the update scenarios

encountered and the diﬀerent methods available to handle these updates.

SchedulingWindowsUpdates

ere are several diﬀerent methods available to run a Windows update in a Frozen environment. Deep

Freeze can be set up to start a Windows update during a Maintenance Period. Deep Freeze can also

be set up to execute a batch ﬁle during the Maintenance Period. A batch ﬁle could be used to start the

Windows update process. Finally, another program could be used to start Windows updates during the

Deep Freeze Maintenance Period.

ENTERPRISE

4

SchedulingWindowsUpdatesinaDeepFreezeMaintenancePeriod

e ﬁrst method involves setting up a Maintenance Period using the Deep Freeze Conﬁguration

Administrator. An option is selected so Deep Freeze will run Windows updates aer the computer

goes into Maintenance Mode.

Complete the following steps to conﬁgure a Maintenance Period:

1. In the Deep Freeze Conﬁguration Administrator, click the Embedded Events tab.

2. Specify day and time the Maintenance Period will occur. e window should look similar

to the following:

In the above screen, Tuesday has been selected for Maintenance with the Run: Windows Update option.

At 1:00 AM, the computer restarts in a awed state. At 4:00 AM, the computer restarts in a Frozen

state. e Disable Keyboard and Mouse checkbox has been checked; this means that the keyboard and

mouse are locked while the computer is in Maintenance Mode.

If a client computer is conﬁgured with this option, it would attempt to download and run updates from

Microso’s web site during the Maintenance Period.

5

ENTERPRISE

If there is an SUS or WSUS server, this can be speciﬁed using the following steps:

1. Click the Maintenance tab.

2. Check Use SUS/WSUS Server and enter the IP address of fully qualiﬁed domain name of the

server. e screen should look similar to the following:

e client computer with these settings would attempt to download and run updates from the speciﬁed

SUS/WSUS server rather than from Microso’s web site.

SchedulingWindowsUpdatesthroughGroupPolicy

Although settings forWindows update can be administered through Deep Freeze, many administrators

prefer to control settings for automatic updates through the use of Group Policy in a domain

environment.

It is recommended that the following conﬁguration be used to conﬁgure the Automatic Update client

on a computer running Deep Freeze:

Computer Conﬁguration → Administrative Templates → Windows Update:

•Conﬁgure Automatic Updates: Enabled.

•Conﬁgure Automatic Updating: Enabled.

•Scheduled install day: 0 if Maintenance will happen every day; the speciﬁc day if Maintenance

will only occur once per week.

•Scheduled install time: Set to 30 minutes aer the start of the Deep Freeze Maintenance

Period.

•Do not display Install Updates and Shut Down option in Shutdown Windows dialog box:

Enabled

•Do not adjust default option to Install Updates and Shut Down in Shut Down Windows dialog

box: Enabled

ENTERPRISE

6

•Reschedule Automatic Updates scheduled installations: Disabled

•No auto-restart for scheduled Automatic Updates installations: Disabled

is policy will ensure that Windows updates are installed during the Maintenance Period and that

any updates that are downloaded (but not installed) will not attempt to reinstall on the client computer

while Frozen.

Administrators need to ensure that the Maintenance Period conﬁgured in Deep Freeze is long enough

to complete the download and installation of the updates from whatever source is conﬁgured and that

computers are either le on to enter the Maintenance Period or are woken up prior to the start of the

Maintenance Period.

7

ENTERPRISE

SchedulingAntivirusUpdates

ere are several diﬀerent methods available to run antivirus updates depending on the antivirus

solutions being used. e following are links to white papers for several of the most common solutions.

ese white papers explain several methods that can be used. Any of these white papers explain

concepts that may be used with other solutions not listed here.

Computer Associates eTrust Anti-Virus

http://www.faronics.com/Faronics/Documents/DFEnt_CAeTrust.pdf

McAfee eTrust Orchestrator

http://www.faronics.com/Faronics/Documents/DFEnt_McAfeeEPO.pdf

Panda BusinessSecure Antivirus

http://www.faronics.com/Faronics/Documents/DFEnt_PandaAntivirus.pdf

Symantec Anti-Virus Corporate Edition

http://www.faronics.com/Faronics/Documents/DFEnt_SymantecAntivirus.pdf

Trend Micro OﬃceScan

http://www.faronics.com/Faronics/Documents/DFEnt_TrendOﬃceScan.pdf

For additional white papers describing antivirus products that may have been added to the Faronics

Content Library aer publication of this white paper, refer to:

http://www.faronics.com/library

SchedulingAdditionalProgramUpdates

e concepts outlined for the antivirus deﬁnition updates can also be applied to updating other

applications. However, not all methods described may work with a particular application. Refer to the

above antivirus white papers for suggested methods, or the white paper entitled Retaining User Data at

the following location: http://www.faronics.com/Faronics/Documents/DF_RetainUserData.pdf

ENTERPRISE

8

LogonPatchMaintenance

is option allows the administrator to install updates to the client computer when a certain user logs

on. In an Active Directory environment, a logon script can be executed to update the client computer.

Using Deep Freeze command line control (DFC), Deep Freeze can be disabled before the updates are

run and re-enabled aerwards.

Logon patch maintenance is appropriate in mobile environments where users are working with laptops

and are oen oﬀ the local network. When they get back to the oﬃce or school and login, a script is

executed to determine if the users require any updates. If they do, the users are prompted as to whether

they would like to run the updates. If they agree, Deep Freeze is disabled, the updates are run, and

Deep Freeze is re-enabled.

e example below assumes that the person implementing the script is familiar with Group Policy,

Active Directory, and Visual Basic Scripting.

LogonPatchMaintenanceTheory

is concept deals with updating a Frozen machine when the user logs on. With some slight

modiﬁcations, the same theory can be applied to an environment where patches are scheduled or

performed in real time. e following ﬂowchart outlines the required steps, depending on the state of

the update process:

Star t Update running Run Patch

Update

Complete?

Prompt User

Update?

End

Insert Marker Frozen?

Run Patch

Boot into Thawed

State

Remove Marker

Boot into Frozen

State

Remove Marker Boot into Frozen

state

End

Yes

Yes Yes

No No

9

ENTERPRISE

Because the computer boots several times, the script needs to check a value to see what phase of the

script is currently running. Because the computer will be Frozen at times, a value cannot be stored

in the Frozen partition. is means the value must be stored either on the network or in a awed

partition on the computer.

It is also important to understand that the above ﬂowchart is a very simple model. In a real-world

example, the ﬂowchart would most likely have additional steps to disable the keyboard and mouse

and check for the current version of the patch to run. ose steps are beyond the scope of this white

paper.

LogonPatchMaintenanceExample

e following example uses an Active Directory environment to call a script ﬁle when a user logs on.

e following section describes how to create a script based on the earlier ﬂowchart and implement

Group Policy to call this script when a user logs on.A full version of the script can be downloaded from

the following location:

http://www.faronics.com/Faronics/Documents/DFEnt_ADUpdateScript.zip

CreatingtheUpdateScript

is script checks to see if the computer requires updates. If the computer requires an update, it

prompts the user. If the user selects Yes, the computer is put into a awed state. At this point, the

patch is applied and the computer is returned to a Frozen state.

Use the following steps to create the script ﬁle one section at a time:

e script ﬁle can be created using many diﬀerent editors. In this case, Notepad is used.

1. Open Notepad and enter the following text to create the global assemblies:

‘ ********** GLOBAL ASSEMBLIES **********

Set objNet = CreateObject(“WScript.NetWork”)

is code segment creates an object called objNet used throughout the script.

2. Enter the following text to create the global variables:

‘ ********** GLOBAL VARIABLES **********

strUNCPath = “\\FarDemo.local\NETLOGON\”

strMarkerFile = objNet.ComputerName & “.mar”

strMarkerCompleteFile = “COMPLETED-” & objNet.ComputerName & “.fin”

strUNCPath is a variable that maps to a server. Modify the path to match that of the server

being used. is is where the marker ﬁles are created. e Marker ﬁles are used to determine

whether the machine requires an update and whether the update is completed.

strMarkerFile is a variable holding the name of the marker ﬁle used to indicate whether an

update is running. Each marker ﬁle has the unique name equal to the machine the update is

running on.

strMarkerCompleteFile is a variable holding the name of the ﬁle to indicate if the patch has

been run. If this ﬁle exists, the update has been run and is not required to run again.

ENTERPRISE

10

3. Enter the following text to create the main routine:

‘ ********** MAIN **********

‘ Calls all of the other routines...

If UpdateRunning = True Then

RunPatch

RemoveMarker

BootFrozen

Else

If UpdateComplete = False Then

If UserPatchPrompt = True Then

InsertMarker

If Frozen = True Then

BootThawed

Else

RunPatch

RemoveMarker

BootFrozen

End If

Else

‘ Exit Script

End If

Else

‘ Exit Script

End If

e main routine follows the structure of the ﬂowchart. It calls the other routines as

required.

4. Enter the following text to create the UpdateRunning function:

‘ ********** UPDATE RUNNING? **********

‘ Check for marker file. If exists, the update is running. Return True.

Function UpdateRunning

Set objFS = CreateObject(“Scripting.FileSystemObject”)

Set objFolder = objFS.GetFolder(strUNCPath)

Set objRE = new RegExp

objRE.Pattern = strMarkerFile

objRE.IgnoreCase = True

For Each objFile In objFolder.Files

If objRE.Test(objFile.Name) Then

UpdateRunning = True

Exit Function

End If

UpdateRunning = False

End Function

e UpdateRunning function checks to see if the marker ﬁle exists on the server. If it does, the

updates must be running and the function returns the value of True.

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere FARONICS Software Handbücher

FARONICS

FARONICS POWER SAVE Bedienungsanleitung

FARONICS

FARONICS ANTI-VIRUS Betriebshandbuch

FARONICS

FARONICS ANTI-VIRUS Bedienungsanleitung

FARONICS

FARONICS POWER SAVE - REQUIREMENTS GUIDE Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE SERVER STANDARD Bedienungsanleitung

FARONICS

FARONICS POWER SAVE MAC Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE - Bedienungsanleitung

FARONICS

FARONICS ANTI-EXECUTABLE ENTERPRISE Bedienungsanleitung

FARONICS

FARONICS DATA IGLOO Bedienungsanleitung

FARONICS

FARONICS DEVICE FILTER MAC Betriebshandbuch

FARONICS

FARONICS ANTI-EXECUTABLE - PRODUCT Betriebshandbuch

FARONICS

FARONICS ANTI-VIRUS Bedienungsanleitung

FARONICS

FARONICS WIN SELECT Betriebshandbuch

FARONICS

FARONICS DEEP FREEZE ENTERPRISE Leitfaden

FARONICS

FARONICS INSIGHT - TEACHER Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE - INTEGRATING WITH ALTIRIS... Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE - Bedienungsanleitung

FARONICS

FARONICS WINSELECT ENTERPRISE Bedienungsanleitung

FARONICS

FARONICS CORE - MIGRATION GUIDE 11-2009 Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE MAC Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE ENTERPRISE - UPDATE PROCEDURE... Technisches Handbuch

FARONICS

FARONICS POWER SAVE Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE ENTERPRISE Bedienungsanleitung

FARONICS

FARONICS DEEP FREEZE - Betriebshandbuch

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung