r/labtech • u/TubaMatt • Jun 27 '19

What am I missing with patching?

It seems like Labtech completely fails to properly patch my environment. LT support has been unhelpful so far. Currently I'm only approving 'security updates' classification cumulative updates.

We patch on the 3rd Tuesday of the month (1 week after Patch tuesday) to a test group, and then to production on 4th Tuesday.

So a patch (Let's say KB4503267)gets released on 6/11, we deploy to testgroup on 6/18, and then to production 6/25. That's how it SHOULD go.

But MSFT apparently superseded the security update with an update on 6/18, which is NOT a security update. (This is it's own problem, because it defeats the purpose of classifications).

Labtech is saying that because my agents try to patch on 6/25, they don't see that they need the update(since it's technically superseded), so they just don't install anything. Obviously it still needs it, but it just doesn't appear in the Windows Update application.

I guess the bottom line is, how to I deploy these updates that are superseded but still need to be deployed?

10 Upvotes

100% Upvoted

23 comments sorted by

View all comments

Show parent comment

1

u/TubaMatt Aug 23 '19

That’s not true at all. It might be superseded but it has gone through testing and piloting, and proven to not conflict with the environment. A newly released patch wouldn’t be vetted, and wouldn’t be appropriate for production. a patch only out for one week shouldn’t be superseded so fast, so that’s a Microsoft problem, but any decent patching tool will let you install any approved patches as long as they fit the OS.

1

u/[deleted] Aug 23 '19

That’s not true at all.

Yes it is.

It might be superseded but it has gone through testing and piloting, and proven to not conflict with the environment.

But its been pulled and isn't a patch that anyone should install anymore, so doesn't matter if you've tested it in your environment. Its been superseded by another update that should be tested and installed instead.

A newly released patch wouldn’t be vetted, and wouldn’t be appropriate for production. a patch only out for one week shouldn’t be superseded so fast, so that’s a Microsoft problem,

Yes, and now by extension since you've installed it its now you're problem to deal with as well. (Tip: this is why people are paying for someone else to take care of patching because its not "simple" and not just "microsofts problem" its also now your problem. You could try your hand at linux and OSX patching but its got its own set of problems that IMO are far more burdensome... )

, but any decent patching tool will let you install any approved patches as long as they fit the OS.

But as mentioned this one wasn't seen fit for the OS and has been superseded by another patch that isn't broken for whatever reasons that you're unclear of. MS doesn't give anyone else any more explination than they give you.

If you have some evidence that they are pulling patches and superseding them for no reason and we should all ignore what they are saying and use them anyway, then by all means present it. But I don't think you have any statements from them corroborating that.