Patch Management

Problem: Partners must treat servers (DC’s, SQL, FileServers, App servers) differently for remediation or 3rd party app deployments. Proposed Solution: Could we automatically tag server roles detected with tags in the ConnectSecure platform (like we do for workstation/servers/w11compat)? This would enable quick and easy filtering and rule creation without worry of affecting critical assets.

Request: Ability to auto tag assets based on a specific application being installed, service being detected, or registry key being present on the lightweight agent. Purpose: Restrict updates and remediation plans based on these tags.

Problem: A specific version of an update or 3rd party app is released that causes issues at a client site. Currently ConnectSecure has no method to: Roll back the update. Freeze/Stop deployments of the new version and "lock" the version of the update to a specific version. Proposed Solution: Method to select a specific 3rd party update (by name in the database), then have a drop down to display the version to lock deployment to. The lock should be able to be deployed to an entire company, and tags. A uninstall command could be initiated with the stored msi uninstall switches listed in the registry, then re-install the version listed above in the version lock setting.

To prevent malicious actor creating havoc in case of a breach I recommend that connectsecurepatch.exe and other binaries used for patch management is only present in the application catalog on devices when the global/local option of Enable Patching Status is enabled. Please see the now closed ticket "Hardening Connectsecure agent and admin interface #55507" for reference.

Patch Management has this problem right now where it will run and give you no feedback of whats going on. A progress bar of any kind would be nice. Also, to have the results of a script completing and what the feedback was from the script would be nice. AKA: If script failed, WHY did script fail.