We had been using Patch Management for our patching needs and felt that Software Management would be a better solution as it would provide the 3rd party support "out of the box" which would decrease the need for us to create the update content and deploy.
Since moving endpoints over to software management I encountered a few roadblocks and I would like to see if any of you have any recommendations or ideas that may help us improve our current process.
As background please note that a majority of the endpoints in our organization are laptops and typically they are only on during regular business hours. We have some stand alone workstations PC's and also servers that we manage.
I have created some Scan and deployment profiles and have received feedback that at time (during patching application) some end users report issues with Office products not working.
We trigger most of our patching efforts during business hours because we are taking a more aggressive approach at a time we know the devices are on.
My idea was to create separate scan profiles and deployments based on specific approval criteria.
M W F - Deploy critical only - no pre-message just send reboot request after update complete
T / TH - Deploy Recommended (Office) - send pre update message asking user to close office products
My question is how are others handling office updates and Browser that require the application to be closed if you send them during business hours?
We understand that in the beginning we will have a lot of machines with outstanding patches because if we approve all recommended it will have a lot more relevant than if you filtered via a patch policy. Challenge as always is that if the end user doesn't read the pre-warning they may still have issues during the update installation.
And you'll have a very slow ... crawling network connection, because Software Management is still not ready for production use and everything gets funneled thru your server to the endpoints, creating a huge bottleneck and slowing your network speeds to nothing.
This scenario under software management tends to happen.
LAN Cache functionality is being developed for Software Management to avoid this situation from occurring.
If SM is not ready for the big leagues why are we being urged by our rep to transition from PM over to SM? I certainly like the flexibility that PM has specifically with the scheduling and ability to configure reboot hours/days vs just limited canned options.
Seems like you have to have profiles on top of profiles for every reboot scenario in an organisation to avoid rebooting something outside of maintenance hours..
Has anyone used the import function in SM, does it import things from PM and configure some settings or what is this function's primary use?
So, to move forward you must embrace the past by manually configuring a LAN Cache? Endpoint Fabric was a miss?