Best Practices for Configuring Patch Manager in ConnectWise Automate

Keeping your organization’s systems and software up-to-date is a critical part of maintaining security and stability in the ever-evolving landscape of IT. ConnectWise Automate Patch Manager helps automate the patching process and ensures your systems remain protected from vulnerabilities. To make the most of this tool, let’s explore some best practices for configuring the Patch Manager in ConnectWise Automate.

Before diving into the technical best practices, I will outline a few things to consider before setting up your new patching schedule.

• Understand Your Environment
  • Before enabling patch management across the board, it is important to understand fully how patching is going to affect your client’s environments. For example, if certain servers don’t come up properly after a reboot, you will need to handle patching differently on those machines and may need to generate tickets for a manual reboot.
• Define your Default Patch Policies
  • It is important to discuss internally how you would like to see patching happen. The simpler it is, the easier it will be on everyone. Select a default time to patch servers as well as workstations (these are generally different times). Consider patching third-party apps as well.
• Implement Patch Rollback Procedures
  • It is important to be prepared for any unexpected behavior because of a patch being installed. Sometimes patches can cause issues, and having a plan in place to revert systems to their previous states can help minimize downtime and disruptions.

Patch Manager – Important Notes

There are two parts to the Patch Manager configuration that you need to be aware of. It is important that you understand how the patch manager works before going into too much detail:

• First, understand the priority levels on the group’s tab within Patch Manager. Contrary to general logic, ConnectWise has configured the plugin to have the priority level increase the lower you are on the list.

• The next thing that I would like to point out is if you look at the screenshot above, you will notice that there are two types of groups, one for approvals and one for patch installs. Keep this separate for best results, as it follows best practice. Additionally, assign one Approval Policy per group for optimal performance.

• Note that only one patch and reboot policy can apply per machine, but approval policies combine based on priority level.
  • For example, if Patch A is approved under the ‘Approvals – Default’ policy but denied in the ‘Approvals – Workstations’ group, any machine in that group will follow the higher priority setting, which in this case is the denial of Patch A.

Best Practices – Technical Deep Dive

• Update and Reboot Policy – Best Practices:
  • Workstations:
    • Update Policy: Everyday 3-5 am
      • Daytime Patching Enabled
        • Do not patch if uptime is less than 30 minutes.
        Wake on LAN DisabledCreate Restore Point EnabledWindows Update Agent Mode:
        ‘Managed Mode’ or ‘Managed Mode – UI Disabled’
      Reboot Policy: Suppress Reboot
      • Prompt Interval: 120 minutesDeadline: 48 – 72 hoursReboot if no user logged on – EnabledWake on LAN – Disabled
    Servers:
    • Update Policy: <Day of Week> 3-5 am (Choose what day you would like to perform updates for servers)
      • Create Windows Restore Point – CheckedService Branch – Do NothingDefer feature and quality updates – Set to 0Windows Update Agent Mode:
        ‘Managed Mode’ or ‘Managed Mode – UI Disabled’
      Reboot Policy: During Microsoft Update Window + 30 Min
      • Reboot Behavior: During Windows UpdateExtend Reboot Window: 30 minutes.Patch Reboot Mode: ‘Now’ or ‘Ask then Allow’Set Maintenance Window for instance of reboot,
        ignore alerts and scripts with a 15-30 minute duration
  • Servers – Domain Controllers
    • Set up Domain Controllers to patch at a different time than other servers to prevent issues if the domain controller is offline when other servers reboot.
• Approval Policy – Best Practices: (These should be on the Approvals – Default policy)
  • Auto-Approve All Categories EXCEPT Bing Bar, Bing Service, Drivers, and UpgradesAuto-Ignore: Drivers
    • By title: Language and Preview
    Auto-Deny: Bing Bar, Bing Service, UpgradesStaging Delay
    • Test Group: 3 daysPilot Group: 4 days
    Approvals – Servers
    • Set the Server Overrides approval policy for this group to manually deny a patch for all servers when needed.
  • Approvals – Workstations
    • Set the Workstation Override policy on this group
    • This is used when you would want to manually deny a patch for all workstations
• Custom Groups/Client-Level Exclusions
  • Position all custom configurations that don’t fall under the above categories below the default groups to ensure they have higher priority.
  • Create a group populated with all the agents you want to apply this configuration to, and set up the custom Update and Reboot policies.

All in all, ConnectWise Automate Patch Manager is a powerful tool to help businesses streamline and enhance their patching processes. By adhering to the best practices outlined above, organizations can ensure their systems remain secure, resilient, and compliant. Embracing these best practices safeguards sensitive data and systems while promoting a proactive approach to cybersecurity, which is essential in today’s interconnected world.

Contact us for ConnectWise Consulting today!