3rd Party Patch Management (Windows)

In this article, you will learn everything you need to know about the 3rd Party Patch Management module. This product enables you to define policies for software management and automated patching and installation, schedule updates using our HEIMDAL Unified Threat Dashboard (UTD), blocklist applications, and allow your users to click and install only software approved by you. 

1. Description 
2. How does 3rd Party Patch Management work?
4. 3rd Party Patch Management view 
5. 3rd Party Patch Management settings 

DESCRIPTION

Our 3rd Party Patch Management solution will automatically install updates for the 3rd-party applications HEIMDAL manages, based on your configured policies, without requiring manual input. As soon as 3rd-party vendors release new patches, our technology silently deploys them to your endpoints, without the need for reboots or user interruption. HEIMDAL provides you with fully tested, repackaged, and ad-free updates using encrypted packages inside encrypted HTTPS transfers locally to your endpoints. Our distribution is further optimized through a local P2P network only between your machines. This gives you the powerful option to tailor your entire IT environment. You can create policies that meet your exact needs across the Active Directory groups within your organization. Once configured, the deployment is easy and simple. 

HOW DOES 3RD PARTY PATCH MANAGEMENT WORK?

When 3rd Party Patch Management is enabled, the HEIMDAL Agent checks the Windows Registry paths ( HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall) to see what 3rd-party applications are installed on the endpoint(s) and reports their status in the HEIMDAL Dashboard (it identifies an application using the DisplayName and DisplayVersion properties from the application's GUID registry). When a new version of a 3rd-party application is available, the HEIMDAL Agent will securely download it from the HEIMDAL Security cloud, decrypt it, and run the installer with the specified install arguments. 
3rd-party applications can be installed or updated by the HEIMDAL Agent using one of the 3 methods below: 
A. Automatic (force) install - the application is automatically installed on the first Group Policy check in case the application is not already present on the endpoint. If the application is already installed on the endpoint, the HEIMDAL Agent will bypass the automatic install. 
B. Automatic update - the application is automatically patched (updated) by the HEIMDAL Agent when a newer version is available on the HEIMDAL Patching server. 
C. Manual install - the application can be manually installed by the end-user from the HEIMDAL Agent in case the application is not already present on the endpoint. 
The Application Blocklist feature allows you to uninstall specific applications that are installed on the endpoints inside your organization (for the feature to work, the application in question needs to have an UninstallString property defined in the Windows Registry in the case of MSI Installers and a QuietUninstallString in the case of non-MSI Installers).  

HEIMDAL Agent - 3rd Party Patch Management

The HEIMDAL Agent displays information about the Monitored Applications, the Vulnerable Applications, the Version number, and the Status of each application. From the HEIMDAL Agent. The statistics displayed in the Patch & Asset Management cover a 7-day interval. 

The HEIMDAL Agent allows the end-user to manually install any of the 3rd-party applications that are configured to be allowed for installation from the HEIMDAL Dashboard.  

3rd Party Patch Management allows you to postpone the installation of a new patch in case you are using the application that is being patched. 

3RD PARTY PATCH MANAGEMENT view 

The 3rd Party Patch Management view displays all the information collected by the HEIMDAL Agent that is running on the endpoints in your organization. The collected information pertains to 3rd-party applications installed or monitored by the HEIMDAL Agent and is divided between those monitored on Windows endpoints and those monitored on Linux endpoints.

At the top, you see a statistic regarding the Number of current vulnerabilities, the Total number of applied patches, the Number of updated software, and the Number of monitored software (installed in the Agent and monitored).

The collected information is placed in the following views: Standard,  Patches per Endpoint, Assets, and Compliance. 

• Standard
  This view displays a table with the following details: Hostname, Username, Software, Version, CVE, CVS, Date, and Status.  
  
  The Standard allows you to view the information regarding the Latest Status (all statuses - up-to-date, patched, and vulnerable), Latest Patch (the latest installed/patched), Currently Outdated (displays the endpoints where vulnerabilities are still being discovered; a check is made every sync GP interval), Historically Outdated (displays the endpoints that have been discovered with vulnerabilities at a point in time), Up-to-date (all applications that are found to be up-to-date), Uninstalled. You are allowed to select one or multiple entries in the Standard view and hide them from the view. Vulnerable applications (that are listed in the Standard view -> Latest Status, Currently Outdated view, and Historically Outdated view) can be installed by selecting the Install 3rd Party Software option from the dropdown menu. The Show Hidden Apps radio button allows you to display all the applications that were hidden by the HEIMDAL Dashboard Administrator. 
  Note: The   Latest Patch view shows all patches that have been done, even if an application or more have been patched multiple times in a very short time period. 
• Patches per Endpoint 
  This view displays a table with the following details: Hostname, Username, and Patches per Endpoint.  
  

• Assets 
  The Asset view displays a list of all the 3rd-party applications that are installed on all the endpoints that run the HEIMDAL Agent in your organization (no matter if the 3rd-party applications are monitored by the HEIMDAL Agent or not). The detection is made in the following Windows Registry paths ( HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall). The table includes the following information: 
  - Stacked view: Software, Version, GUID, Installed Endpoints, Installed Servers, CVE, CVSS, Uninstallable (3rd-party applications that can be uninstalled by the HEIMDAL Agent), and Supported (3rd-party applications that are installed and updated through the HEIMDAL Agent); 
  
  - Non-Stacked view: Software, Version, GUID, Hostname, Username, Machine Type, CVE, CVSS, Uninstallable (3rd-party applications that can be uninstalled by the HEIMDAL Agent), Supported (3rd-party applications that are installed and updated through the HEIMDAL Agent), and Installed Date. 
  
  The Hide Microsoft Products radio button allows you to hide the Microsoft products from the Assets view. The Filters functionality allows you to filter entries by Monitored and Not Monitored applications. This view filters the data by the client (device) information's last seen status instead of the install/update time of a 3rd-party application, and the check is performed every 24 hours. The CVSS score is also updated in an interval that can be 24 hours to 48 hours (maximum).
  Note: The Heimdal Thor Agent and Heimdal RD Agent will not show up in the Assets view.

  Selecting one or multiple 3rd-party applications allows you to: 

  Add application to Group Policy	Enables the Push Install or the Automatic Update tickbox for the selected application. You can perform this for one or multiple group policies or for all (global) policies.
  Remove application from Group Policy	Disables the Push Install or the Automatic Update tickbox for the selected application. You can perform this for one or multiple group policies or for all (global) policies.
  Uninstall	Adds the selected application to the Application Uninstall. You can perform this for one or multiple group policies or for all (global) policies.  The uninstall operation is supported for the 3rd-party applications that are installed using an MSI Installer that creates an UninstallString property or for the 3rd-party applications that are installed using an EXE Installer that creates a QuietUninstallString property.
  Create software license	Creates a new Software Asset Management item for the selected application. This requires the Software Asset Management product to be enabled.

• Compliance 
  This view displays a table with the following details: Hostname, Username, Number of Updates, and Last Seen.  
  
  The Compliant / Non-Compliant filter allows you to switch between the endpoints that are compliant or not. This view does not consider the selected timeframe (from the top of the HEIMDAL Dashboard), but instead, it displays the endpoints filtered by a specific date or an interval, both selected from the green Filter button. When checking for compliance, it is necessary to set a desired date. A compliant machine is an endpoint that has no pending updates before the selected date/interval. A non-compliant machine is an endpoint that has pending updates before the selected date/interval. Filtering for compliant endpoints will list endpoints with 0 updates, which shows they are up to date. Filtering for non-compliant endpoints is possible only by selecting a specific date, but not an interval, as this view can only show the endpoints that have pending updates before the selected interval.  
  
  The Compliance view considers the Cyber Essentials norms when deeming an endpoint as being compliant or not. The Cyber Essentials compliant view will display all endpoints that do not have any 3rd Party Patches missing in the last 14 days and have a CVSS score of less than 7 since the application's release date (Heimdal release date), while the Cyber Essentials non-compliant view will display all endpoints that are missing a patch that is not applied and older than 14 days and have a CVSS score higher than (or equal to) 7, a patch version lower than the version selected in the Group Policy, and the patch reached End of Life (EOL). 

The Detailed view of any Heimdal-supported/ managed application will contain the Update Rings tab. The Update Rings functionality is available across the majority of the 3rd Party Patch Management views, including:

• Standard Patch Management views ("Current Status", "Latest Patch", "Currently Outdated", "Historically Outdated", "Up to date"), including Stats view
• Assets View (Stacked and Non-Stacked), including Stats view
• Active Clients -> "Assets" tab views
• Active Clients -> "3rd Party Patch Management" tab
• Infinity Management -> Software Asset Management -> Click on Application name -> Discovered Assets view.

• Group Policy – name of the GP defining the deployment behavior for the selected 3rd party supported app.
• Install Version – version of the application configured for deployment via the selected Group Policy.
• Delay – delay is defined for the application in the Manage Applications table of the selected Group Policy.
• Updated Endpoints – number of endpoints with the application up to date (within the selected Group Policy)
• Eligible Endpoints – number of endpoints within the selected Group Policy scope that match the deployment criteria and are eligible to receive the application update.
• Total Endpoints - total number of endpoints associated with the selected Group Policy.
• Update Percentage (%) – percentage of eligible endpoints where the third-party application has been successfully updated.
• Push Install Enabled – indicates whether the “Push Install” setting is enabled for the application in the Manage Applications section of the selected Group Policy.

The Details view allows you to manage application deployment directly from the rollout view. From here, you can add or remove applications to/from one or multiple Group Policies, with full control over whether Install and/ or Keep up to Date behaviors are enabled or disabled - the configuration being applied exactly as selected, without overriding existing version selections unless required. You can directly enqueue applications for uninstall, with support for global or custom policy settings, version targeting, and precise matching logic (e.g., exact, lower, higher, or all versions).

The  Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode, corresponding to each view. 

The   Standard and Assets views, besides the standard   Grid view, have an additional view called the   Stats view, which can be toggled by switching from the   Grid view. 

This view contains statistical data regarding the 3rd Party patches that are separated into Pie charts and matrix data.   The info displayed shows the   CVSS  pie chart graphs and the By release date matrices. 
By clicking the data, you will be redirected to a pre-filtered view (date range and CVSS) where you can visualize only the 3rd party patches that fall under that specific selection. 

3RD PARTY PATCH MANAGEMENT

The 3rd Party Patch Management module allows users to install or update a specific 3rd-party application from the list of applications managed by Heimdal.
Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.

3rd Party Patch Management - turns the 3rd Party Patch Management module ON or OFF.

General Settings

Infinity Management - turns the Infinity Management module ON or OFF to deploy your own applications and critical security patches (msi, exe, zip files) to all computers running the Heimdal Agent. Infinity Management is a stand-alone patch management system; the patches can be configured in the Infinity Management module and applied to any Group Policy. This option requires an active Infinity Management license.
Assets view - allows you to view, track, and manage all the 3rd-party applications installed on the devices in your organization, even if Heimdal does not offer patches for them (supports applications that are installed in the All Users context). The Assets view updates the list of applications every 24 hours, but it can be manually updated by restarting the computer (which takes the Postpone patching at startup option into consideration).
Software Asset Management - enables software license tracking for the applications installed in your environment, in a dedicated view found under Patch & Asset Management -> Infinity Management. You can manage license details such as software name, alias, publisher, license type, quantity, cost, license key, expiration date, renewal date, and others. This option requires an active Infinity Management license and Assets view to be enabled, and is only visible in Advanced mode.
Keep all 3rd-party applications up to date - enables the Automatic Update setting for all current 3rd-party applications in the Heimdal portfolio and ensures that any 3rd-party applications added to the portfolio in the future will automatically have Automatic Update enabled by default. While this option is enabled, the per-application Automatic Update checkboxes in the Application Settings grid cannot be changed.
3rd Party Patch Management check interval [minutes] - sets the interval (between 120 and 1440 minutes) the Heimdal Agent uses to automatically check for newly available patches. This option is only visible in Advanced mode.
Inherit the 3rd Party Patch Management configuration of other GPs linked to matching AD Groups only - when Group Policy Inheritance mode is enabled, this option restricts the merge so that this Group Policy only inherits the 3rd Party Patch Management configuration (automatic install/update, manual install) from other Group Policies linked to Active Directory groups that match the computer's AD computer and/or user groups. This option is only available when Group Policy Inheritance is enabled for your account, and is only visible in Advanced mode.

Application Settings

Show Infinity Management applications only - displays only the 3rd-party applications added in Infinity Management. This option is available when Infinity Management is enabled. Use the Search application field to find a specific application in the list.

Sequence - allows administrators to influence the priority in which applications are pushed to the Heimdal Agent. This field is editable only when Push Install is enabled for the application and accepts unique values between 1 and 999. Applications are deployed in ascending order (lowest value first), while applications left without a sequence value follow the default installation path, so that a single-app failure does not block the entire deployment workflow.
Push Install - installs the selected 3rd-party application(s) on the endpoint(s) if not already installed. If the 3rd-party application is already installed, no action is taken.
Automatic Update - enables the automatic update of the selected 3rd-party application(s).
Manual Install - makes the selected 3rd-party application(s) available for manual installation by displaying them in the Heimdal Agent - 3rd Party Patch Management list:

Postpone Update - marks the selected 3rd-party application(s) as eligible for the end-user postpone pop-up. This column is only editable when Allow the user to postpone patching is enabled in the Delay & Install Schedule section (see below).
Delay - allows you to delay the automatic deployment of the selected 3rd-party application(s) by 1 to 30 days (Off by default). The header dropdown applies the same delay to all applications.
Version - allows you to target the selected 3rd-party application(s) to the Latest version (default) or an older version available in the Patching System. Targeting a version that is older than the latest version will downgrade the higher version to the targeted version, and Heimdal Patch & Assets will not update it anymore (this works ONLY for the 3rd-party applications that can be uninstalled through the Heimdal Agent, where Uninstall is supported).
Note: The Delay and Version fields become editable only once Push Install, Automatic Update, or Manual Install is ticked for that application.

Delay & Install Schedule

Postpone patching at startup [min] - sets the delay interval (between 5 and 240 minutes) applied on computer startup before the Heimdal Agent starts the patching operation.

Allow the user to postpone patching - notifies end users when application installations or updates are scheduled and allows them to defer the process for a limited time, giving them the possibility to complete critical tasks without experiencing sudden software closures. When enabled, two sliders become available: Postpone interval [minutes] (5 to 60 minutes) and Number of allowed postpones (0 to 5). You can then choose which 3rd-party application(s) can be postponed using the Postpone Update column in the Application Settings grid. If only some 3rd-party applications are marked for Postpone Update, the Heimdal Agent will first update/patch all the 3rd-party applications that are not marked, followed by the ones that are. This option is only visible in Advanced mode and is not available while Hide Heimdal Agent UI is enabled in General Management.This feature is recommended if you're using Infinity Management to deploy software packages that can lead to end-user disruption (latency, reboots, etc.). The pop-up presented by the Heimdal Agent on the endpoint looks as follows:

Install/Patch schedule - allows you to define specific days and times when application patches are permitted to install on your endpoints:

• Choose weekday - select one or more days of the week (Monday to Sunday) when Heimdal Patch & Assets can install the 3rd-party application(s)/patches. You can optionally limit the schedule to specific weeks of the month; by default, it applies to every week of the month.
• Monthly - select one or more days of the month (1 to 31) when Heimdal Patch & Assets can install the 3rd-party application(s)/patches.
• Choose Time Interval [00:00 to Midnight] - set the time window on the selected days using the two-handle slider (minimum 2 hours), and choose whether patching is Active during time selection or Inactive during time selection.

Choosing a day or multiple days (without selecting the weeks) will run the 3rd-party application patching on the selected days of every week. Choosing a day or multiple days (by selecting the First Week and the Second Week) will run the 3rd-party application patching on the selected days in the First Week and the Second Week only. The scheduler considers the way the days are distributed within the calendar.

In the example above, the month of September 2022 spans a period of 5 weeks. The First Week starts on the 1st of September, which means that the First Week includes only 4 days, while the Fifth Week includes 5 days. Choosing a combination of Thursday and the First Week means that the patching will run on the 1st of September. Choosing a combination of Monday and the First Week means that patching will run on the 5th of September (the first day of the Second Week), because the first Monday of the month happens then. This prevents skipping a month if the selected day is out of scope. The other case refers to a combination of Sunday and the Fifth Week, where the last Sunday is out of the scope of the Fifth Week. Because the algorithm is adjusted so as not to skip any month, the patching scheduler will run on the 25th of September (which is the actual last Sunday of the month).

Application Uninstall

This feature allows you to uninstall specific 3rd-party application(s) to restrict the usage of unwanted applications or to remove applications from all endpoints applying the current Group Policy. It removes most of the applications that Patch & Asset Management is monitoring and also uninstalls other 3rd-party applications that are present on the endpoints but not managed by the Patch & Asset Management module.

To uninstall a 3rd-party application, enter its name in the Application Name field. You can also enter at least the first word of the name (if the 3rd-party application has a name composed of more than one word) to target multiple 3rd-party applications whose names start with the same word, and tick the Starts with checkbox before adding the entry.

Optionally, enter an Application Version and choose how it should be matched from the dropdown:

• All versions - uninstalls every installed version of the application (the version field is ignored).
• Exact Version - uninstalls only the specified version.
• Lower Versions - uninstalls the specified version and any lower version.
• Higher Versions - uninstalls the specified version and any higher version.

Click Add to add the entry. Existing entries are listed in a grid with the Starts with, Uninstall Applications, Version, and Action columns, and can be searched by application name.

• The example below targets the Poly Lens application that is installed on the endpoint(s).
• If you target a specific application, you have to add the exact application name (as it is displayed in the Control Panel -> Programs and Features list) to be uninstalled, as in the example below: Java 8 Update 291 (64-bit).
  
• If you want to uninstall a 3rd-party application that is in the 3rd Party Patch Management list, make sure that the Push Install and Automatic Update checkboxes are unticked for that application in the Application Settings grid; otherwise, it cannot be added to the Application Uninstall list.