VMware VCentre protect
Those of us who have to manage patching have a massive problem. There are many vulnerabilities are in applications and plug-ins which aren't covered by any kind of automated process to apply, yes some do come with updating tools but require admin rights to apply patches and you have no visibility or control over what gets applied and when.
This is where products like VMware's VCenter protect come in. They allow you patch many different products, both freeware a paid for apps.
Great you may think, well yes in principle but ultimately a product like this needs to major or a three things
Yes it does apply patches, as best as I can tell, the fails are down to useability and reporting of information.
First fail is that there is no remote console, you can only run it on the server you installed it on. Bad.
You start by creating management groups for your computers, then add computers to these groups b various methods, AD groups, browses lists or from a vCentre. This is good, unfortunately once you have added them they don't actually appear anywhere, you can see the groups but the computers are not in there until you scan them, so you scan the group and the computers go in. Well no they don't if they are not switched on. the scan will tell you if it can't talk to a computer but you won't see it in the Machine view, new computers will not be visible until you scan them, adding them to AD is not enough. This is a major fail in my book, every other console either imports stuff in a dynamic way not a static list.
Agent less scanning should only be done out of hours as it kills the server and uses huge band width, I would certainly not do it across routed subnets.
The Agent configuration is poor and inflexible.
Creating scedules is ok but you can't change them afterwards
The console is awkward and odd to use. Updating of information is manual F5 process.
The whole product looks like a after hours project that went mainstream with out anyone actually finishing it off or doing some usability testing.
It is a Windows only product which in this day and age of Apple supremacy and BYOD is unforgivable.
Unfortunately the other products I have seen aren't a great deal better, Symantec uses their all in one SIM console which I loathe. It is overly complicated like most Symantec software these days and not nice to use.
Sophos seems to be taking it's first steps in to the world of patching which may be a better prospect if you buy in to their AV as well.
This is where products like VMware's VCenter protect come in. They allow you patch many different products, both freeware a paid for apps.
Great you may think, well yes in principle but ultimately a product like this needs to major or a three things
- Usability
- Reporting
- Applying patches
Yes it does apply patches, as best as I can tell, the fails are down to useability and reporting of information.
First fail is that there is no remote console, you can only run it on the server you installed it on. Bad.
You start by creating management groups for your computers, then add computers to these groups b various methods, AD groups, browses lists or from a vCentre. This is good, unfortunately once you have added them they don't actually appear anywhere, you can see the groups but the computers are not in there until you scan them, so you scan the group and the computers go in. Well no they don't if they are not switched on. the scan will tell you if it can't talk to a computer but you won't see it in the Machine view, new computers will not be visible until you scan them, adding them to AD is not enough. This is a major fail in my book, every other console either imports stuff in a dynamic way not a static list.
Agent less scanning should only be done out of hours as it kills the server and uses huge band width, I would certainly not do it across routed subnets.
The Agent configuration is poor and inflexible.
Creating scedules is ok but you can't change them afterwards
The console is awkward and odd to use. Updating of information is manual F5 process.
The whole product looks like a after hours project that went mainstream with out anyone actually finishing it off or doing some usability testing.
It is a Windows only product which in this day and age of Apple supremacy and BYOD is unforgivable.
Unfortunately the other products I have seen aren't a great deal better, Symantec uses their all in one SIM console which I loathe. It is overly complicated like most Symantec software these days and not nice to use.
Sophos seems to be taking it's first steps in to the world of patching which may be a better prospect if you buy in to their AV as well.
Comments
Post a Comment