Sophos Enterprise Console
10 Setting up patch policies
10.1 About the patch policy
The patch policy allows you to check that your computers have the most up-to-date security patches installed.
When setting up your patch policy, consider using the patch assessment Event Viewer to audit missing patches on your company's computers. It contains information about security patches and results of patch assessments. You can view patch status by computer, group, or threat after you have enabled patch assessment in the patch policy. You can access the Event Viewer by clicking
Events > Patch Assessment Events.
Note
Patch uses CScript.exe which can be blocked using Application Control. If you use both
Application Control and Patch, ensure that you do not block Microsoft WSH CScript in the Programming/Scripting tool category in the Application control policy. By default, programming and scripting tools are allowed by Application control.
22
10.2 How to roll out a patch policy
Initially, the "Default" patch policy is applied to all computers. Patch assessment is disabled in the default policy.
Once patch assessment is enabled, computers begin an assessment. This can take several minutes.
Subsequent assessments occur at the interval set in policy, which is daily by default.
Note
If computers run an assessment before Enterprise Console has downloaded patch data from
Sophos for the first time, the Patch Event viewer displays no results. The download can take several hours. To check if this has completed, see the Patch updates field in the Patch
Assessment - Event Viewer.
We recommend that you introduce patch policy as follows:
1. Deploy the patch agent to computers using the Protect Computers Wizard. (On the Select features page of the wizard, select Patch.)
Note
You must reprotect computers by running the Protect Computers Wizard if they are already running Endpoint Security and Control but do not have the patch agent installed.
2. Enable patch assessments in your default patch policy.
At this time, you have one patch policy for your entire network.
3. Use the patch assessment Event Viewer to view which computers are missing patches and which are up-to-date. You can access the Event Viewer by clicking Events > Patch Assessment
Events.
Copyright © Sophos Limited
Sophos Enterprise Console
Note
You must install missing patches on computers manually.
4. If you require the ability to enable or disable patch policy or assign different patch assessment intervals for various groups, create different policies for different groups.
For more information on setting up patch policy, see the Sophos Enterprise Console help .
Copyright © Sophos Limited 23
