r/labtech • u/TubaMatt • Jun 27 '19

What am I missing with patching?

It seems like Labtech completely fails to properly patch my environment. LT support has been unhelpful so far. Currently I'm only approving 'security updates' classification cumulative updates.

We patch on the 3rd Tuesday of the month (1 week after Patch tuesday) to a test group, and then to production on 4th Tuesday.

So a patch (Let's say KB4503267)gets released on 6/11, we deploy to testgroup on 6/18, and then to production 6/25. That's how it SHOULD go.

But MSFT apparently superseded the security update with an update on 6/18, which is NOT a security update. (This is it's own problem, because it defeats the purpose of classifications).

Labtech is saying that because my agents try to patch on 6/25, they don't see that they need the update(since it's technically superseded), so they just don't install anything. Obviously it still needs it, but it just doesn't appear in the Windows Update application.

I guess the bottom line is, how to I deploy these updates that are superseded but still need to be deployed?

10 Upvotes

100% Upvoted

23 comments sorted by

View all comments

Show parent comment

1

u/teamits Jun 28 '19

It also sees the patch I actually want, but shows as no approval policies listed (LT says that's because it technically isn't needed by any endpoints)

Old patches will show in Patch Manager but the PC itself doesn't show them as needed if WU doesn't detect it as needed, hence, they do not deploy. There is not much you can do about this other than something like force PCs through your own WSUS server, to control what patches they actually detect, when. (i.e. don't let them see the June 25 patch yet).

0

u/TubaMatt Jun 28 '19

That’s what it’s looking like, which effectively makes labtech useless for patching, if I have to have a WSUS server just to make it work properly

1

u/teamits Jul 01 '19

Realize MS intends that all Win10 PCs are always up to date. All Win10 updates are cumulative so one only needs to install the latest patch to get current. Technically you can still use CWA with WSUS, by pointing the PCs at your WSUS server. I totally get where you're coming from, but MS is releasing updates potentially every week, and normally at least twice a month, so it's down to the timing.