Pau Lo
asked on
off / suspended guests and AV/Patch
Do you deploy any specific procedures around keeping off and suspended guests patched with OS security updates and AV definitions? If not - what is the risk? If yes - why so, why the need? I.e. if you power them on after 6 months they'll obviously be behind (I assume you cant patch and off or suspended guest?) but wouldnt your patch management and AV update tools just kick in and patch them the next time they are on?
I've been going through one of the DoD checklists and they say organisations must have some sort of process to keep off/suspended guests patched.
From vCenter - where could one see a list of currently off and suspended guests, could anyone provide a screenshot? And is there any where that you can see how long they have been "off" or "suspended for"?
I've been going through one of the DoD checklists and they say organisations must have some sort of process to keep off/suspended guests patched.
From vCenter - where could one see a list of currently off and suspended guests, could anyone provide a screenshot? And is there any where that you can see how long they have been "off" or "suspended for"?
IanTh
I think you need to do that with powercli
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
>All Physical and Virtual machines need to be patched and maintained, whether on or off.
Why so, because if you turn it back on, then surely then the AV/PM solution wll find it, find its out of date and update it? Are you saying you schedule an "on window" where you patch it, then turn it off again, until the next window?
Whats the symbol for an "off" machine as opposed a suspended? Why would you suspend over turning it off, or is it the same issue?
Why so, because if you turn it back on, then surely then the AV/PM solution wll find it, find its out of date and update it? Are you saying you schedule an "on window" where you patch it, then turn it off again, until the next window?
Whats the symbol for an "off" machine as opposed a suspended? Why would you suspend over turning it off, or is it the same issue?
ASKER
My concern is if you have an unpatched machine thats off, who can attack it?
In the screeshots above, a virtual machine which is OFF, does not have a Green Arrow or Yellow Suspended Pause Button.
It's just Blue. As per vMaster VM.
You would maybe want to Suspend, if you wanted to turn the VM on quicker, but I do not think it's used much in a Production World.
Yes, you need to ensure ALL Computers are patched.
Yes, in our Config, if a computer is attached to our LAN, and discovered by AV and Patching software it's updated.
IF THE MACHINE IS OFF, IT IS NOT AS RISK! IT CANNOT BE ATTACKED!
It's just Blue. As per vMaster VM.
You would maybe want to Suspend, if you wanted to turn the VM on quicker, but I do not think it's used much in a Production World.
Yes, you need to ensure ALL Computers are patched.
Yes, in our Config, if a computer is attached to our LAN, and discovered by AV and Patching software it's updated.
IF THE MACHINE IS OFF, IT IS NOT AS RISK! IT CANNOT BE ATTACKED!
ASKER
So you say all machines must be patched, but then say if its off theres no risk. So... why and how do you patch your "off" machines? Do you just turn them back on and let your AV/PM tool patch them, even if theyd been off say 6 months, or do you schedule maintenance windows to patch them in case they were ever back on. I.e. turn the offs on, patch, and turn them off again/
Can you explain why machines would be turned off for prolonged periods of time. And why they'd be off for minimal periods of time?
Can you explain why machines would be turned off for prolonged periods of time. And why they'd be off for minimal periods of time?
ASKER
Im basically getting at do you need any special arrangements for machines you know will be off for some time. I.e. does the fact turning them on with 6 months worth of missing patches/AV cause a window of opportunity...
if our machines are OFF for an extended period the are for decommissioning.
otherwise machines are not turned off.
In the real world, machines would not be off for extended periods if in Production.
otherwise machines are not turned off.
In the real world, machines would not be off for extended periods if in Production.
ASKER
Why would they be off at all?
because they are going to be retired. deleted and archived.