Patch Management Solution

Greetings all;

There is a group of machines that have a database app and automated tasks running 24 X 7 in our environment.  When they recieve patches they get a pop-up warning with the option to defer.  If no one responds the machines are rebooted within 8 hours of patches being applied.  We're good so far up to this point...

There is an issue with this group of machines where Altiris is sending a "normal" reboot command to the OS which causes Windows 7 to pop up with that message that says something like "the following app(s) are preventing windows from shutting down" and you have to hit the "force close" button at the bottom.  Then the pc will reboot normally.  This effectively creates a "down" situation since the PC stops all of it's services but hasn't fully rebooted to start them all up again and perform its automated jobs.

In testing with command prompt, issuing shutdown -r fails to reboot these PC's, but using shutdown -r -f works great because the reboot is forced.

I think what I need is to set Altiris to use a -f or forced reboot but I don't know how to change this.  Or maybe there is another solution that I haven't thought of???

THanks in advance for anyone's time in reading this.  Any advice is greatly appreciated.  :-)

- Michael Babb

Hi Michael,

I have an idea how to force reboot for Windows 7 clients, which are in pending reboot state within patch

1. Clone default "Restart Status" report ⇒ click "edit" of cloned "Restart Status" report ⇒ click on "Resolved Query" to have all required data for report parameters and copy this resolved query

2. Go to "Filters" and create custom "Raw SQL" filter and paste there copied "Resolved Query" from "Restart Status" report ⇒ give an appropriate name for this new custom filter, such as "Windows Computers requiring reboot after completed patch installations" and save changes.

Or you can add there required filters to exclude all other Operating Systems to include only Windows 7 OS clients in this filter ⇒ After that specify another name for this filter to 100% be sure that this filter includes "Only Windows 7 clients which are requiring reboot after completed patch installation"

3. Now you need to go to "Jobs and Tasks" and create "Update Filter Membership" task ⇒ choose there your custom filter and enable "Force update" to have there up-to-date data

Why you need to set a "force update" in "Update Filter Membership" task? ⇒ Because this filter isn't added in any resource target which is applied to enabled policy, therefore default "Delta Membership Update" scheduled task doesn't update your custom filter content)

4. Create "Power control" task and enable there "Force applications to close without prompting"

5. Create "Server Job" and add there:

• 1st task: "Update Filter Membership" task
• 2nd task: "Power control" task to reboot clients with force application closing without promt
• Create "Resource target", using your custom filter, created in #2 above to have there only Windows 7 clients with pending reboot

• Enable "Force Update" and make sure that your custom filter is available in "Filters" and set appropriate schedule, when this Server Job will be started and both tasks will be executed.

Here is result of how this idea works in 7.6 released build

Thanks,

IP.

Thanks again for coming to the rescue Igor.  I'll give this a shot.  :-)

HI Michael,

that was a cool use case to try to think how to implement it, using existing functionality of ITMS :- )

Have you checked many Windows 7 clients were forced to reboot after patch cycle?

Regards,

IP.