Solved

Managing unpatched virtual machines

Posted on 2016-11-25
5
117 Views
Last Modified: 2017-01-17
Usually I would look for change management , either manual or automatic patching

I have a customer who has pretty much performed no patching for 2 and a half years. For pretty much of all of their 100 virtual servers

Allied to this VMware tools , hardware versions aren't in line

Usually in my own experience, I would create test environment and apply patches there , a month behind MS Security Bulletin.

Now we're upgrading tools, hardware version currently 8, and the patches next week

Is there a best way to upgrade patches since June 2014?

I have flagged all this at the very start , that its not best practice etc to give them the outline, but I don't want to throw on a load of updates manually either (they have no WSUS, Shavlik ,or SCCM) etc

Any best way to do this? (its very frustrating as they lost 2 servers already that weren't patched, they just dont get it)
0
Comment
Question by:Indie101
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 120

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 41901457
I would recommend, you look at a Patch Management solution, and we use and recommend Shavlik, which if you wish you can integrate with WSUS, but not necessary, scan the VMs, (make sure you have valid backups), and deploy patches.

and then create a deployment plan, of which servers you will rollout to, and scheduled out out of production hours to complete the patching, not patched since 2014, is going to be a lot of patches, e.g. circa 154.

So it's going to take some time, to apply them, but Shavlik will be your quickest solution, OR.... have you considered you could consolidate servers and replace them.
0
 

Author Comment

by:Indie101
ID: 41901471
Thanks Andrew. I had asked you about best ways to patch VMs previously. I suggested Shavlik to them but they weren't interested. (I'm a contractor here 5.1 and 5.5 VCP- 3-4 years in VMware Support) They have a big environment but no ones being keeping an eye on it for some time

This time around I have to go with manual unfortunately, its a bit of a joke but thats the customer, they've been briefed etc on difficulties of this

With a manual download of updates since June 2014, any best plan? Its a file server so no dependent software involved, Windows 2008 R2 64 Bit

I haven't had to plan like this since I did desktop ago 7 years ago. I have explained its not VMware and that VMware will not support it etc but thats all I can do
0
 

Author Comment

by:Indie101
ID: 41901482
No consolidation either, i had looked into that in my first week

Thanks I have a plan in mind just wanted to check this here

Go through security bulletins, highlight and download updates (no office\windows 10 etc) and take it from there, I have one or two test vms, but not a complete standalone vCenter with test vms etc so this is going to take time

Using this

https://technet.microsoft.com/en-us/security/hh778967.aspx
0
 
LVL 120
ID: 41901492
If they don't want to purchase software you are in luck as a Contractor, because they will just have to pay you more to do it.

To be honest with you rather than visiting every server, and downloading the same patches, I would recommend you stand up a WSUS server, install Windows 2012 R2, patch it, install WSUS, sync it with Microsoft, so you have ALL the patches required locally, this will speed up deployment.

and then create a new OU in Active Directory, Create a Group Policy, and move Servers into this Managed Folder.

and then on WSUS Approve Patches.

All this is going to add to the Project and keep you in beers!
1
 

Author Closing Comment

by:Indie101
ID: 41901495
Thanks Andrew, just wanted to confirm what was there. Shavlik or some other tool would be great here
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
When rebooting a vCenters 6.0 and try to connect using vSphere Client we get this issue "Invalid URL: The hostname could not parsed." When we get this error we need to do some changes in the vCenter advanced settings to fix the issue.
Teach the user how to edit .vmx files to add advanced configuration options Open vSphere Web Client: Edit Settings for a VM: Choose VM Options -> Advanced: Add Configuration Parameters:
Teach the user how to use configure the vCenter Server storage filters Open vSphere Web Client:  Navigate to vCenter Server Advanced Settings: Add the four vCenter Server storage filters: Review the advanced settings: Modify the values of the four v…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question