User's Guide
Contents
1. Shavlik Patch for Microsoft System Center User s Guide n Preparing to Use Shavik Patch 2 Specify which rules in the fitter must be matched All Only those updates that match all the rules in the filter will be displayed Any Updates that match at least one rule in the filter will be displayed 3 Define one or more rules To define a rule select an option in each of the first two logic boxes and then type the criteria in the third box To add another rule simply click Add rule 4 Typea name for the filter 5 Click Save Rename Example Assume you want to see a list of all critical updates for Adobe Acrobat You simply create the following filter 2 Shavlik Patch for Microsoft System Center Users Guide How to Publish Updates How To PUBLISH UPDATES Manually You can manually publish one or more third party updates The updates can be published immediately or be scheduled for publication at some point in the future The Publishing Microsoft Task Scheduler is used to schedule the publication The publication always Third Party runs as a separate task but can be monitored while it is running Updates 1 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Shavlik Patch 2 Enable the Selected check box for each update that you want to publish The Selected check box will be disabled if the latest revision of the update has already been publis2. certificate requirements amp step by step quide aspx Using MMC to Manually Distribute the Certificate Another method for distributing the code signing certificate is to use MMC This is an easy method for distributing the certificate to a handful of local machines but might prove impractical for distributing the certificate to many machines spread across your organization 1 Onthe target machine start Microsoft Management Console MMC 2 Inthe Certificates store right click Trusted Publishers and select All Tasks gt Import Shavlik Patch for Microsoft System Center User s Guide 27 Appendix A Creating and Distributing Cetfeates 3 On the Welcome to the Certificate Import Wizard dialog click Next 4 On the File to Import dialog browse for your public key file and then click Next a D M pu p peer en renga ey an smara i can eame nU me oen on 5 On the Certificate Store dialog choose Place all certificates in the following store and then click Next fence eign sme te enc norman an andes x 6 On the Completing the Certificate Import Wizard dialog click Finish 7 On the confirmation dialog click OK 8 Conditional If you created your certificate using WSUS repeat Steps 2 7 only this time select Trusted Root Certification Authorities in Step 2 2 Shavlik Patch for Microsoft System Center User s Guide
3. Configuration Manager With Shavlik Patch you leverage a single Configuration Manager workflow for publishing updates for both Microsoft and non Microsoft products Shavlik Patch consists of two components Update catalog Contains the detection and deployment logic used to patch non Microsoft products and legacy Microsoft products The catalog consists of a large number of update files from a number of different software vendors including Adobe Apple Firefox Sun and others Addin to the Configuration Manager console Used to select updates from the catalog publish them to your WSUS servers and synchronize with Configuration Manager This allows you to patch your legacy Microsoft products and your non Microsoft products using the same Configuration Manager workflow Used to patch Microsoft products System Here are the requirements for installing and using Shavlik Patch Requirements Shavlik Patch installs as an add in to an existing Configuration Manager 2012 console SP1 or later The Configuration Manager console must be installed on one of these Windows operating systems o Windows Server 2012 or later o Windows Server 2008 R2 SP1 or later o Windows 8 or later o Windows 7 SP1 or later NET Framework 4 5 or later 1f you are missing this requirement NET Framework 4 5 1 will be installed for you during the installation of Shavlik Patch Windows Server Update Services WSUS client requirements c Mf
4. Shavlik Patch for Microsoft System Center User s Guide For use with Microsoft System Center Configuration Manager 2012 shaviik Copyright and Trademarks Copyright Copyright 2014 Shavlik All rights reserved This product is protected by copyright and intellectual property laws in the United States and other countries as well as by international treaties No part of this document may be reproduced or retransmitted in any form or by any means electronic mechanical or otherwise including photocopying and recording for any purpose other than the purchaser s personal use without written permission of Shavlik Trademarks Shavlik is a trademark of Shavlik in the United States and other jurisdictions Microsoft Windows and System Center Configuration Manager are either trademarks or registered trademarks of Microsoft Corporation All other trademarks tradenames or images mentioned herein belong to their respective owners Document Information and Print History Document number N A Version Description February 2014 Initial version initial release of the Shavlik Patch for Microsoft System Center User s Guide 2 Shavik Patch for Microsoft System Center User s Guide Table of Contents Table of Contents PREPARING To USE SHAVLIK PATCH Welcome System Requirements Installing the Shavlik Patch Configuration Manager Add in What the Shavlik Patch Add in Adds to Configuration Manager Understanding
5. Shavlik Patch is installed on the primary WSUS server and you are using Windows Server 2012 or Windows 8 then the WSUS API and the PowerShell cmdlets features must be enabled If WSUS is on a remote Windows 8 or Windows 8 1 machine then the remote admin tools feature must be installed on that machine The version of the remote admin tools and the version of WSUS must match or you will not be able to deploy updates o Ifthe primary WSUS server is running WSUS 3 0 SP2 then the WSUS 3 0 SP2 Administration Console must be installed on the same machine as Shavlik Patch Patches KB2720211 and KB2734608 must be applied to both the WSUS server and the Configuration Manager Console machines The Microsoft Task Scheduler service must be enabled and the user must have the rights necessary to create scheduled tasks Shavlik Patch for Microsoft System Center User s Guide 5 Preparing to Use Shavik Patch Shavlik Protect Cloud account The user running Shavlik Patch must be a member of the WSUS Administrators group on the WSUS server Client machine requirements Each of your client machines must meet the following requirements in order to deploy non Microsoft updates distributed by a WSUS server Must contain a copy of the code signing certificate in the appropriate certificate stores c Must have enabled the Allow signed updates from an intranet Microsoft update service location policy setting Note You must be r
6. ate certificate stores on all your WSUS servers and to your client machines Trusted Publishers certificate store Trusted Root Certificate Authorities certificate store This appendix provides details on how to accomplish each of these tasks Reference For detailed certificate information beyond that presented in this appendix please see the following articles For information on establishing a trust relationship to support third party patching http msdn microsoft com en us library bb902479 vvs 85 aspx For information on why WSUS in Windows Server 2012 R2 no longer by default supports generating code signing certificates and for a workaround http blogs technet com b wsus archive 2013 08 15 wsus no longer issues self signed certificates aspx The minimum requirements of the signing certificate are Certificate Requirements The private key must be exportable The key size must be 2048 or greater e It must be a code signing certificate Shavlik Patch for Microsoft System Center User s Guide E Appendix A Creating and Distributing Cetfeates Creating a Code Signing Certificate 2 Note You can skip this section if you already have a code signing certificate You have two options for creating a code signing certificate e Use a code signing certificate that is created using an internal CA Use the Shavlik Patch user interface to have WSUS create a self signed code signing certifica
7. cts supported by Shavlik Patch see Products 3 T hitp J community shavlik com docs DOC 2285 Technical For technical assistance with Shavlik Patch please refer to one of the following Assistance support options j Browse the Shavlik Patch section of the Shavlik community page at http community shavlik com You will need to become a member of the community in order to gain full access to all available resources Open a support request at http support shavlik com CaseLogging aspx Phone Technical Support at 866 407 5279 View online video tutorials at www shaviik com support training videos patch E Shavik Patch for Microsoft System Center User s Guide Appendix A Creating and Distributing Corificatos APPENDIX A CREATING AND DISTRIBUTING CERTIFICATES Overview A code signing certificate is required when using Shavlik Patch with Configuration Manager and WSUS to publish third party updates In general you must 1 Create a code signing certificate You can do this using either an internal Certificate Authority CA or your WSUS server 2 Conditional If you use an internal CA to create the code signing certificate you must import the certificate into WSUS which you can do using Shavlik Patch If you use WSUS to create the code signing certificate the certificate will be automatically imported into WSUS 3 Export the certificate 4 Distribute the code signing certificate to the appropri
8. e Tab This tab is used to publish updates using a recurring scheduled task For more information on this tab see the section titled Automatically Publishing Updates Using a Recurring Scheduled Task Shavlik Patch for Microsoft System Center Users Guide Using the Filters Preparing o Use Shavik Patch Information displayed in the Shavlik Patch list and the Published Third Party Updates list can be filtered to search for specific updates You can also use a filter when scheduling a recurring task Default Filters The default filters are identified by a leading asterisk Default filters cannot be modified or deleted The default filters include the following Shavlik Patch List All All updates are displayed Not Published Only the updates that have not been published to WSUS are displayed Published Only the updates that have been published to WSUS are displayed Selected Only the updates you select in the grid are displayed Published Third Party Updates List All All updates are displayed Selected Only the updates you select in the grid are displayed Custom Filters You can create your own custom filters This powerful tool enables you to specify exactly which updates are displayed Each custom fiter is comprised of one or more rules You can define as many rules in a filter as needed To create a new fier Ll Click the New Filter icon The Filter dialog is displayed O majn
9. ed WSUS to create a code signing certificate as that certificate was automatically written to the proper locations To import a certificate 1 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Shavlik Patch 2 On the Configuration Manager Home tab click Settings 3 On the Shavlik Patch Settings dialog select the WSUS Server tab WSUS Sever WSUS Server DSe O M ELI SS pet Selle TF Sane Comserer_Te srcion E 3 Thea caeso n tdg don ho certare ra you nih te WOE ve Te coals mede bo ander ach blow ey meet aly pied ees Cmi Cie Gier Nonton nated aen po ostente s metale em E Sei ecole sale Hor floored Pre Wess _ Omas nararos centene ma ox 4 Clik Import 5 Navigate to the certificate file and click OK Appendix A Creating and Distributing Cetfeates Export The export process is used to export the certificate used to sign the published updates Certificate to an accessible location on your network 1 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Shavlik Patch 2 On the Configuration Manager Home tab click Settings 3 On the Shavlik Patch Settings dialog select the WSUS Server tab 4 Click Export 5 Specify the location and fle name and then click Save After exporting the certificate you will need to distribute it to any other WSUS servers and to your client machi
10. hed or has recently been scheduled for publication To locate the desired updates you can Use a filter Use the Group by vendor check box Sort the columns by clicking in the column headers 3 Click Publish updates where the number of selected updates th Selected Updates dialog is displayed Now once Monday Feb 03 2014 v fi20551PM E Alto ochodulod tine I Synchronize atter publishing selected updates Fun as User SEMDE Aamar Pesoword 4 Specify when and how you want to publish the update s Now The publishing process will begin as soon as you click OK Once Schedule the publication process to occur at some time in the future Shavik Patch for Microsoft System Center User s Guide E How to Publish Updates Synchronize after publishing selected updates If you want Configuration Manager to automatically synchronize itself with the WSUS database as part of this task enable this check box This will cause an incremental synchronization to be performed If you do not enable this check box the published update s will not be available until your regularly scheduled synchronization process occurs Run as Provide the credentials needed to add the publishing task to Microsoft Scheduler 5 Click OK The Notice dialog is displayed a Publication task Publ 2014 23 11 5921 Adninistrator SCCHDEY nas success scheduled Status can be viewed in Autoblog us
11. iguration selected Manager Shavlik Patch Contains all the updates available in the Shavlik Patch catalog You will use this list to locate and publish updates ee Bl girone E Published Third Party Updates Contains all the third party updates that have been published to WSUS The updates may have been published using Shavlik Patch or by another mechanism You will use this list to review and manage the updates The most common use will be to expire updates Shavlik Patch for Microsoft System Center User s Guide Preparing to Use Shavik Patch Settings This toolbar button is available on the Home tab when Shavlik Patch or Published Third Party Updates is selected You will use this button to set up local publishing to enter your Shavlik Protect Cloud credentials and to schedule recurring publication tasks stem rre Bite Pr d Understanding 7 shavik Patch grid contains a number of unique columns that help you identify the Information the status of each update in the Shavlik Published Indicates ifthe update has been published to WSUS Patch Grid Published Revision This number is incremented each time a revision to that update is publ
12. ing Brace 6 During the publication process the Published column status will show Scheduled i f i i Ear puer que m pasa i bie ob HAs 7 Optional Use the Configuration Manager Trace Log Tool to open the AutoPublish log file and monitor the publication process AutoPublish log is written by all one time or recurring scheduled jobs that publish to WSUS 4 Shavlik Patch for Microsoft System Center Users Guide How to Publish Updates Here is an example of the AutoPublish log file B When the update is successfully published the Published column status will change to Yes the next time the grid is refreshed Note that the check box in the Selected column will be disabled if the latest revision of an update has been published You can sort the Published column to see the list of updates that have been published or you can use the Published fiter Shavlik Patch for Microsoft System Center User s Guide E How to Publish Updates Automatically Publishing Updates Using a Recurring Scheduled Task 16 You can automatically publish updates on a recurring basis by creating a scheduled task You can only schedule one recurring task 1 2 3 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Shavlik Patch On the Home tab click Sett
13. ings or right click Shavlik Patch and click Settings The Shavlik Patch Settings dialog is displayed re FF Puente updater oskate by tar fa s E ana er po m E x On the Schedule tab specify when the scheduled task should run and what action s should occur Schedule Download and or Publication Specify when you want the recurring task to run Publish the packages selected by this filter Enables you to specify which updates you want to publish on a recurring basis You can choose either the predefined filter named All meaning all unpublished updates in the Shavlik Patch catalog or any of your custom filters Shavlik Patch for Microsoft System Center User s Guide How to Publish Updates Example 1 To publish all updates that have not been previously Published select the All filter This is an easy way to automatically Publish new updates on a recurring basis Example 2 Assume you have previously created a custom filter that identifies all unpublished critical updates for the products you use in your organization Simply select that filter here to publish just those updates on a recurring basis Synchronize updates If you want Configuration Manager to automatically synchronize itself with the WSUS database as part of this task enable this check box This will cause an incremental synchronization to be performed If you do not enable this check box the published updates will not be availab
14. ished All published updates will have a number greater than zero Revised Indicates if the update is a revision to an update that was previously published If so the check box in the Selected column will be enabled Publishing such an update will create a new revision and will increment the Published Revision number A revision update alters only the metadata and not the update package A revision is posted to the Shavlik Patch catalog whenever any of the following need updating The detection logic that determines if a patch applies to a system and if itis already installed Any text related to the update a Shavlik Patch for Microsoft System Center Users Guide Configuring Your Shavlik Patch Settings Shavlik Patch for Microsoft System Center User s Guide Preparing to Use Shavik Patch The first time you use the Shavlik Patch add in the Shavlik Patch Settings dialog will automatically be displayed You must use this dialog to specify how to connect to your WSUS server and to your Protect Cloud account You can return to this dialog at any time using the Settings button on the Home tab WSUS Server Tab The WSUS Server tab is used to configure how the add in will communicate with your WSUS Server It is also used to define the certificate that will be used to digitally sign the content that is published to the WSUS server WSUS Server Information Name Confirm the name or IP address of your WSUS Server This i
15. le until your regularly scheduled synchronization process occurs Run as Provide the credentials needed to add the publishing task to Microsoft Scheduler 4 Optional Use the Configuration Manager Trace Log Tool to open the AutoPublish log file and monitor the publication process The AutoPublish log file is written by any one time or recurring scheduled jobs that publish to WSUS You can use the Auto Publish feature of Shavlik Patch in conjunction with Automatic Deployment rules in Configuration Manager to keep clients up to date with the latest third party updates Shavlik Patch for Microsoft System Center User s Guide 7 How to Publish Updates Viewing and nd You can use the Microsoft Task Scheduler to view and manage your scheduled Managing publications To access Shavlik Patch scheduled tasks select Start gt Administrator Scheduled Tools gt Task Scheduler gt Task Scheduler Library gt Shavlik Patch Publications One time tasks can be run deleted disabled or rescheduled using the Microsoft Task Scheduler Ifyou alter a recurring auto publish schedule using the Shavlik Patch Settings dialog the task will be automatically rescheduled Ifyou clear the Schedule download and or publication check box in the Settings dialog and click OK the recurring task will be deleted from the Microsoft Task Scheduler After publishing task completes the task will continue to be di
16. ned certificate Creates a code signing certificate for your enterprise This process uses the services of WSUS to create the certificate For detailed information on exporting importing and creating certificates see Appendix A Creating and Using Certificates Preparing to Use Shavik Patch Account Tab You must be signed in to the Shavlik Protect Cloud service in order for the add in to automatically access and download the full Shavlik Patch catalog The add in uses your Protect Cloud account to periodically check for a new catalog If you do not have a Protect Cloud account you will only receive trial content which consists of only a few sample updates Taname ca Aan a ar haen Daae rans ones Kee Rd Stent aai sa meeen ananas Vence Ie p po eo Genere foaral ee poe User name Type the user name that you use to authenticate to your Protect Cloud account Password Type the password that you use to authenticate to your Protect Cloud account Register Now If you don t have a Protect Cloud account click this button and follow the on screen instructions to become a registered user You must be a registered use in order to access the full Shavlik Patch catalog Verify If you want to test your ability to connect to your Protect Cloud account using the supplied credentials click Verify If you cannot connect ta your account you will not be able to access the full Shavlik Patch catalog T0 Schedul
17. nes This is necessary in order for the machines to receive locally published updates The distribution process is described in the next section E Shavik Patch tor Mirosfi System Center User s Guide Distributing the Certificate Appendix A Creating and Distributing Corificatos You must distribute the code signing certificate to all servers that house your Configuration Manager and WSUS consoles and to all of your client machines Which certificate store s the certificate is copied to depends on how the code signing certificate was created If your code signing certificate was created by WSUS and is therefore a self signed code signing certificate you will need to copy the certificate to the following locations on all your WSUS servers and to your client machines c Trusted Publishers certificate store c Trusted Root Certificate Authorities certificate store If the code signing certificate was issued by a CA whose root is already trusted by your clients you only need to copy the certificate to the Trusted Publishers certificate store on your WSUS and client machines Using Group Policy to Distribute the Certificate A common method for distributing the code signing certificate to your servers and or client machines is to use Group Policy For general instructions on how to perform this task see Step 3 in this article hhttp blogs technet com b jasonlewis archive 2011 07 12 system center updates publisher signing
18. nformation will normally be detected and automatically populated Port Confirm the port number used when making a connection to your WSUS Server The default value for unsecured connections is either 80 or 8530 For secured connections you will typically use either 443 or 8531 Secure Connection If your WSUS Server has been configured to use a secure connection enable this check box A secure connection is mandatory if you need to import a signing certificate See Importing a Certificate in Appendix A for more information Test connection If you want to test your ability to access the WSUS Server lick Test connection Code Signing Certificate Information A code signing certificate is required in order to publish updates to the WSUS server If you already have a signing certificate in place it will be shown in the Current Certificate area You can perform the following certificate tasks Export Exports the current certificate from within Shavlik Patch After exporting the certificate you will distribute it to your clients and to your infrastructure machines e g other machines that run the Shavlik Patch add in downstream WSUS servers and Windows Update clients This is necessary in order for the machines to receive locally published updates Import Imports a code signing certificate that was created by a Certificate Authority CA A secure connection is required in order to import a certificate Create a self sig
19. splayed in the Microsoft Task Scheduler for one to two days 18 Shavik Patch for Microsoft System Center User s Guide Expiring Third Party Updates EXPIRING THIRD PARTY UPDATES You can expire third party updates that have been invalidated by the product vendor or that have been superseded by other updates Expired software updates cannot be deployed The updates you set as expired can then be deleted using the WSUS cleanup tool To expire an update 1 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Published Third Party Updates 2 Select the updates that you want to expire 3 Click Expire updates where the number of selected updates To view expired updates Within the Published Third Party Updates list sort the list using the Expired column Note that the check boxes in the Selected column will be disabled For example D B e 3 i i el Eg e re pom Se ae porum m 2 s eee 2 Within the All Software Updates list expired updates are represented by the expired icon i For example mies rene worn dade creo tob er Oaa hen e ena reann ee a vic ac ee 3 soem vim an M Lee os EO nmi rete Weron str attan Shavik Patch for Microsoft System Center User s Guide E Support Information SUPPORT INFORMATION Supported For a complete list of the produ
20. te Creating a Code Signing Certificate Using a CA Creating a certificate from a trusted CA offers a couple of advantages Distribution Eliminates the need to distribute the certificate to other machines in the same domain Management Simplifies management because the certificate can be managed the same way as other certificates in your environment Follow your normal process for creating a certificate from your internal CA After you have created the certificate you must write it to the WSUS server You can do this using the Import Certificate feature in Shavlik Patch See the section titled Importing a Certificate for more details Using Shavlik Patch and WSUS to Create a Code Signing Certificate Using the Shavlik Patch interface you can instruct WSUS to create a self signed code signing certificate for your enterprise Creating a code signing certificate is enabled by default on WSUS prior to Windows Server 2012 R2 To create a self signed code signing certificate using WSUS 1 Within the Configuration Manager Software Library workspace expand the Software Updates folder and click on Shavlik Patch 2 On the Configuration Manager Home tab click Settings Shavlik Patch for Microsoft System Center Users Guide Appendix A Creating and Distributing Cetiicates 3 On the Shavlik Patch Settings dialog select the WSUS Server tab pp Cid 4 Click Create a self signed certificate If a certificate alread
21. the Information in the Shavlik Patch Grid Configuring Your Shavlik Patch Settings WSUS Server Tab WSUS Server Information Code Signing Certificate Information Account Tab Schedule Tab Using the Filters Default Filters Custom Filters How TO PUBLISH UPDATES Manually Publishing Third Party Updates Automatically Publishing Updates Using a Recurring Scheduled Task Viewing and Managing Scheduled Publications EXPIRING THIRD PARTY UPDATES SUPPORT INFORMATION Supported Products Technical Assistance APPENDIX A CREATING AND DISTRIBUTING CERTIFICATES Overview Reference Certificate Requirements Creating a Code Signing Certificate Creating a Code Signing Certificate Using a CA Using Shavlik Patch and WSUS to Create a Code Signing Certificate Importing a Certificate Export Certificate Distributing the Certificate Using Group Policy to Distribute the Certificate Using MMC to Manually Distribute the Certificate Shavlik Patch for Microsoft System Center User s Guide Table of Contents This page intentionally left blank The document is designed for duplex printing 4 Shavik Patch for Microsoft System Center User s Guide Preparing to Use Shavik Patch PREPARING TO USE SHAVLIK PATCH Welcome Welcome to Shavlik Patch for Microsoft System Center an add in that extends Microsoft s System Center Configuration Manager capabilities by enabling you to publish third party updates and legacy products no longer supported by
22. unning as Administrator in order to install the add in Shavlik Patch Installing the Configuration 1 Manager 2 Add in E 4 5 6 7 Using a Web browser go to www shavlk com downloads Click the Shavlik Patch tab Download the Shavlik Patch for Configuration Manager 2012 setup file Close System Center Configuration Manager Begin the Shavlik Patch installation by double clicking the file named SCCMPatchSetup exe If NET Framework 4 5 or later is not installed on the Configuration Manager machine you will be prompted to install NET Framework 4 5 1 before continuing with the installation Follow the on screen instructions for installing this prerequisite fall prerequisites are installed the license agreement is displayed You must accept the terms of the license agreement in order to install the program Enable the check box to accept the license agreement and then click Install After the files have been installed the Completed dialog is displayed I comple the shavik Patch for Merosot System Coto Setup Wizard Click Finish Shavlik Patch for Microsoft System Center User s Guide Proparing to Use Shavik Patch What th Sh artha h nstaling the Shavik Patch add in will add two new list items to the Software avl atc Library gt Software Updates folder It will also add a Settings toolbar button to Add in Adds to the Configuration Manager Home tab when either of the two new list items are Conf
23. y exists the following Warning dialog is displayed 1f you replace the exicing certificate the new certicate should be dstibuted to al update dients before pubishing any more updates Jf you delete the old certificate you wil need toresgn allocaly pubished undetes signed with the dd certificate Do you wich t centinue Do not proceed unless you are certain you need a different certificate The warning message explains what you will need to do if you are replacing or deleting an existing certificate The new certificate is created on the WSUS server and is registered with WSUS Details of the certificate are displayed in the Current Certificate area For example Shavlik Patch for Microsoft System Center User s Guide m Appendix A Creating and Distributing Certificates The certificate is also installed in the following certificate stores on the local Configuration Manager console Trusted Root Certification Authorities e Trusted Publishers a Shavlik Patch for Microsoft System Center Users Guide Importing a Certificate Shavlik Patch for Microsoft System Center User s Guide Appendix A Creating and Distributing Corificatos This section applies only if you created your code signing certificate using an internal CA Importing the certificate will write the certificate to the WSUS Server and to the appropriate certificate stores on your machine You do not need to use the import process if you us
Download Pdf Manuals
Related Search