Two main decision points for companies choosing a patch management suite are breadth of operating system support and dependence on agents, and we saw a lot of variation here. Though we found some great agent management utilities, sometimes the requirement to install one more piece of software is a deal breaker. For these companies, Shavlik's NetChk Protect can run without agents.
For multiplatform patching, consider Lumension's PatchLink Update, LANDesk's Patch Manager, and BigFix's Patch Management Enterprise Suite. Each supports varied Windows, Linux, and Unix platforms; provides robust patch deployment features; and regularly updates the patch content available. BigFix and LANDesk are multifunctional endpoint management suites that include patching, while Lumension's PatchLink is purely a patch manager.
BigFix's Enterprise Suite excels at bandwidth management, allowing both static and dynamic throttling while enabling settings to control bandwidth at endpoint, server, and all distribution points. We also liked its distributed architecture and support for a broad base of operating systems and apps. On the downside, all this functionality comes with a learning curve, as BigFix's terminology and structure are different from what's standard in the rest of the patch management field. And, while BigFix shows when vendors recommend reboots with a patch, all deployments default to a no-reboot setting.
LANDesk's Patch Manager is, like BigFix, part of a comprehensive endpoint management package. We found its user interface a tad cumbersome, but of all the products tested, Patch Manager was the only one with an automated process to facilitate ITIL change management practices--a huge plus. Its Parallel Patch Process defines testing and rollout processes that can be clearly documented and transparent to a change management board, as well as enabling highly efficient deployment of patches. These plus an automated process for copying patches to an entire subnet through one client and an option to auto-fix vulnerabilities helped LANDesk capture our Editor's Choice.
However, environments looking to automate patching of AIX, Solaris, and HP-UX should be aware that LANDesk only scans those operating systems--it doesn't deploy patches to them.
Lumension's PatchLink is a multiplatform patch manager without the extras of endpoint management. We found PatchLink easy to use, and it's the only multiplatform entry with a browser-accessible administrative interface.
For desktop patching, Kaseya's Managed Services Edition provides extensive administrative functionality and flexibility on Windows or Mac OS X systems, though we were disappointed that the selection of natively supported patches is limited to Microsoft applications that fall under Windows Update. Beyond that, you'll need custom scripts.
Shavlik also specializes in Windows-focused patching, with optional agents. Shavlik NetChk Protect's bandwidth throttling isn't as precise as we'd have liked, but it is available during agentless patching. NetChk Protect automatically checks for new patches and updates before every scan and can make use of a distributed patch repository architecture.
Note that we chose not to review Novell's ZENworks Patch Management in the course of this Rolling Review because it licenses PatchLink's product. However, those looking into full endpoint management, or to add patching to an existing ZENworks environment, should feel confident in the patch management that Novell provides.
Photo by Jupiterimages