Patch management: Linux and Windows
You test, schedule, roll out in stages and if needed roll back patches on Linux and Windows, and prepare a fast track for emergency patches and a coverage report.
Level 201 · 15 lessons · 15 practice labs
Lessons
Linux
- Selecting security updates with apt and dnf
- Configuring automatic updates: scope and time window
- Package holds and version pinning
- Rollback: previous versions and snapshots
- Short task: hold one package and install the other security patches
Windows
- Windows Update policies and maintenance windows
- Central patch server: approvals and deployment rings
- Reporting patch status with PowerShell
- Patching third-party applications
- Short task: list missing security patches with PowerShell
Process
- Patch testing and approval
- Emergency patching: an actively exploited vulnerability
- Patch compliance report: coverage and lag
- Compensating controls for systems that can’t be patched
- Capstone: run the monthly patch cycle on a mixed fleet
Practice labs
- List pending security updates with apt: Filter upgradable packages by security origin and write down the count.
- Install only security fixes with dnf: List important advisories with updateinfo and apply security updates only.
- Hold one package and install the other patches: Pin the package the application depends on, install the remaining security patches and show the held package.
- Set the scope and time of automatic updates: Configure security-only updates between 02:00 and 04:00 and do a dry run.
- Roll a bad patch back to the previous version: Identify the update that broke the service, downgrade the package and pin it temporarily.
- List missing security patches with PowerShell: Query installed updates, compare them with the given required list and write down what is missing.
- Define the maintenance window in update policy: Apply and verify a policy that moves automatic restarts out of hours and limits the deferral period.
- Find third-party applications missing patches: Compare the installed software inventory with the current version list and report the outdated ones.
- Plan deployment rings and assess the pilot result: Split hosts into three rings and decide on moving to the next ring from the pilot ring’s error records.
- Calculate patch compliance from the inventory: Find the share of up-to-date servers in the list and the one that lags furthest behind.
- Make the emergency patch call for an actively exploited flaw: Find the affected servers, write an emergency plan with a shortened test step and patch the most exposed one.
- Set up a compensating control for an unpatchable system: Protect a server stuck on an old version with a network rule and service restriction and show the flaw is unreachable.
- Catch the change that breaks the app in patch testing: Apply the patch on the test server, run the smoke test and report the dependency that broke.
- Manage the services awaiting restart after automatic updates: Find processes still using the old copy of an updated library, automate their restart in the maintenance window and prove none is left exposed.
- List a server’s applications with version and source: List operating system packages and manually installed applications separately with versions.
About this course
You test, schedule, roll out in stages and if needed roll back patches on Linux and Windows, and prepare a fast track for emergency patches and a coverage report.
What you will learn
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.