Walkthrough: Basic Microsoft Windows patch analysis

Create the Patching Job.

1. In the BSA console, under Jobs, navigate to an existing folder or create a new folder for your Windows Patching Job. The examples in this procedure use the folder structure Jobs > Patch Analysis Jobs > Windows Patch Analysis.
2. Right-click Windows Patch Analysis, and select New > Patching Jobs > Windows Patching Job. 

Define the general settings on the New Windows Patching Job General panel.

1. In the Name field, provide a name for this job.
2. Optionally, in the Description field, describe the job.
3. Verify that the auto-populated value in the Save in field is where you want to store this job. You can browse to another location if necessary.
4. In the Specify a Catalog field, browse to a patch catalog in the Depot folder. An updated catalog must already exist. (See Creating and updating patch catalogs.)
5. Under Number of Targets to Process in Parallel, select the number of systems on which you want the analysis Job to run simultaneously. This is a frequently requested feature which allows you to throttle the job execution thus controlling the load on the BSA server and the network. You will find this Parallelism option in many jobs in BSA.
6. Click Next. 

Define the analysis options for the job. 

In this panel, you specify a group of patches and/or hotfixes to be included in the job, or a list of your own.

This example creates a Windows Patching Job uses two previously created smart groups that look for Windows Bulletins and hotfixes newer than 10 days and with a vendor impact of critical.

1. Select List.
   
   1. Click Add New Include/Exclude. 
      The Include/Exclude Selection dialog box opens.
   2. At the bottom of the panel, select Include.
   3. Select the smart group (in this example, Production Windows Patch Policy), and click the arrows to add the smart group to the box on the right.
   4. Add any additional smart groups (in this example, Production Windows Hotfix Policy).
   5. Click OK.
   Note: You do not need to exclude the irrelevant patches item as they are already excluded by default by the Shavlik analyzer, which is the engine used by BSA to perform patch analysis on Windows.
2. When you finish specifying analysis options, click Next.

On the Remediation Options Tab, you define what to do when we find our target out of compliance with the Patch Catalog. BSA can create the BLPackages and Deploy Jobs automatically as part of the Patching Job, if needed.

1. Ensure that the Create remediation artifacts field is cleared. In this example, you are running an analysis-only process at this point. You can ignore the other fields on this window.
2. Click Next.

On the Targets panel, select the servers that are the targets of this Windows Patching Job.

1. In the left panel, navigate to a server smart group or to an individual server.
2. Click the > button to move the selection from the left panel to the right panel.
3. Continue to select groups or servers until you have a complete list of servers for the analysis.
4. Click Next. 

On the Default Notifications panel, configure the default notification settings. The defaults are used for all runs of this job unless you override them with notification settings for a scheduled job. 

This example sends an email to the patch administrator for any targets that have failed analysis, and appends detailed patch analysis results with the e-mail.

Click Next.

The Schedules page appears.

On this page we set up the job to run immediately and then to run on Wednesday every week afterwards, during the maintenance window. (The patch catalog used by the job is updated every Tuesday)

1. Select Execute job now to indicate the job should run as soon as you finish the wizard.
2. Click New Schedule and define the a job schedule. In this example, we want to schedule it to update Wednesday mornings at 1 AM, during the maintenance window. You may want to use a different time, day, or even update less often.
   1. Click Weekly.
   2. Select Wednesday.
   3. Enter a time, such as 1:00.
   4. Click Finish.

This example uses the defaults for the remaining two wizard panels, Properties and Permissions.

Once the job starts to execute, the Tasks in Progress pane appears and shows you which tasks are running at this moment on this BSA application server. In a typical BSA production environment you will see many jobs running at the same time performing many different tasks.

Wait for the job to finish and click Refresh  if needed.

To view the results of the Patching Job:

1. Right-click the Patching Job in the folder under the Jobs folder.
2. Select Show Results.

Identify the servers with missing patches or hotfixes.

1. Expand Server View.
2. Click Successful Targets.

The right panel shows a summary of the job results, including the numbers of missing patches and hotfixes for each server. 

Identify the missing patches or hotfixes.

1. Expand Successful Targets.
2. Click a server. The right panel lists the specific missing patches or hotfixes for that server. 

In our example, there are a number of critical hotfixes that have been identified for the server.

Optionally, you may want to examine the properties of a patch or a hotfix before choosing to apply it to your servers.

1. Right-click one of the missing patches or hotfixes and select Open Patch to get all information published about a specific Patch by the OS vendor including the install and the uninstall commands if the Patch supports rollback.
2. Select the Extended Properties Tab. This tab includes all the information about this patch, including links to the Knowledge Base articles, and so on.

As this patch fixes a potential security vulnerability, and is missing on both servers, we will apply this patch to remediate the servers in the next walkthrough (Basic patch remediation).

Click Close.