UpdateExpert manages patches painlessly

The recent Sobig virus and MSBlaster worm illustrate the importance of patch management in today’s sophisticated hacking environment. While not all patches relate to significant system vulnerability or stability issues, IT administrators need to quickly discern those that do — not to mention track which systems are patched and which ones aren’t.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft St. Bernard UpdateExpert 6.1 St. Bernard Software, stbernard.com Very Good  7.5 criteria score weight Manageability 8 25% Scalability 9 25% Ease-of-use 8 20% Interoperability 6 10% Value 10 10% Cost: One-year license: $1,400 for one to 100 seats; $5,580 for 1,000 seats; $30,490 for 5,000 seats; $48,360 for 10,000 seats Platforms: Windows NT4, 2000, XP; Terminal Server; IIS; SQL Server; Exchange; Internet Explorer, Windows Media Player and Media Services; Net Meeting; Office Bottom Line: UpdateExpert is a mature patch management solution for Windows OSes that is almost as easy on the budgety as it is to deploy and manage. It doesn't hog space on servers or client resources, and it extends reliable patch management through firewalls and proxy servers and to highly secured, disconnected networks. About our Reviews and Scoring Methodology

St. Bernard Software’s UpdateExpert 6.1 and its competitors — Ecora, PatchLink, and others — are addressing the problem with a combination of update tracking and management technologies.

Overall, UpdateExpert did not disappoint. The good news is that recently added features such as WAN and DMZ (demilitarized zone) administrative management capabilities, scalability improvements, and support for logical groupings of clients are primarily aimed at increasing enterprise functionality. Version 6.1 also extends support for the disconnected networks widely used in government and military organizations and has plug-in support for HP OpenView.

The bad news is that its abilities are limited to providing patch management for Windows products only, at least for now.

UpdateExpert consists of a management console and a machine agent. An optional “Leaf Agent” can be pressed into duty to handle systems in a highly secure environment where typical RPCs (Remote Procedure Calls) won’t do. These Leaf Agents can be a pain to use, since you have to perform single installations either using the Agent Installation wizard or through UpdateExpert’s command line interface. It would be great to see an easier way of deploying these in a future release.

Installation went smoothly on my test bed, an HP ProLiant ML530 server and LAN clients all running Windows 2000. I chose the typical installation that installs both the console and master agent on my server and later installs master agents on all of the clients. UpdateExpert gathers and validates patch information from client system files (a software inventory is also kept and updated), then monitors incoming updates from Microsoft and doles out appropriate patches.

The UpdateExpert management GUI was fairly intuitive, literally covering all the bases from one neatly organized, centralized window that compartmentalizes into two main views, Research and Network. In the Research view, an admin can research the various available patchesto find out more about what they correct. The Network view lets the admin easily manage client patches to the different systems on the network. Administrators can now group systems by characteristics as well as by type or function.

But it’s the added features in Version 6.1 that make UpdateExpert ready for prime time. For example, it now supports multiple management consoles on the network and allows admins to view updates made from the other consoles, saving time and preventing redundant updates.

Contact can also be made between components via a configurable IP port, which makes patch management and updating possible through proxy servers or firewalls. If you want to download patches through a proxy server, I suggest authenticating the server beforehand because it’s possible the product will erroneously think the authentication page is the patch and not install the real patch.

The Windows-only focus does limit UpdateExpert’s range, but if you’ve got a Microsoft-heavy deployment, it will make managing updates less painful. Plus, in an enterprise scenario, UpdateExpert’s cost comes out to $14 per seat for 100 users and boils down to $4.83 per seat for a 10,000-seat, one-year license.

While no product  will guarantee your Windows network immunity, $5 to $14 per seat for a polished patch management product is a reasonable insurance policy.