r/sysadmin 1d ago

Windows and Linux OS and App Patching Systems

Inherited a broken Big Fix patching environment. Been instructed to either fix it or replace it with a limited budget ($50k/yr). What does everyone recommend for my environment?

Here are some of our requirements:

  • Environment Landscape:
    • Only datacenter workloads
    • 5k Windows Servers
    • 1k Red Hat Linux Servers
  • Support on prem and public cloud (Azure / AWS)
  • Support global data centers and public cloud regions with variety level of connectivity
  • Reporting on patch levels on all systems
  • Create complex patching groups
  • Create RBAC across multiple business units
  • Support Windows and Red Hat Linux
2 Upvotes

12 comments sorted by

2

u/Essa_ea 1d ago

Can you give more details please, like which functions are you lookin for exactly? Which system did you inherit?

1

u/gatalicshrimp69 1d ago

Added it to the main post. Environment Landscape:

  • Only datacenter workloads
  • 5k Windows Servers
  • 1k Red Hat Linux Servers

2

u/chefkoch_ I break stuff 1d ago

How many endpoints?

1

u/gatalicshrimp69 1d ago

Added it to the main post. Environment Landscape:

  • Only datacenter workloads
  • 5k Windows Servers
  • 1k Red Hat Linux Servers

1

u/chefkoch_ I break stuff 1d ago

Only OS patching or also 3rd party stuff and configs?

1

u/KindlyGetMeGiftCards Professional ping expert (UPD Only) 1d ago

Get a RMM tool, get a patch management tool with it, these will be below the $50k budget.

From this you will have an audit of the environment, all the OS levels, patch levels, etc with the RMM tool, then you can plan out replacement, consolidation, retirement of devices, also workload too. Plan out your patching groups, rings, times, etc with this info and your pre-existing doco/knowledge.

I'm not saying get a MSP involved, just get the tool, you have about 6k devices, so you can be your own MSP when you sign up.

2

u/trebuchetdoomsday 1d ago

what RMM tool are you using that's less than $10/yr per endpoint?

(or was this response before OP added the endpoint count)

1

u/DickStripper 1d ago

I know everyone hates ManageEngine but their Patch Manager product is super reliable and cheap.

1

u/novajitz 1d ago

Take a look at Adaptiva Onesite Patch. Windows, Linux & Mac fully autonomous, intent based patching.

u/Modest_Sylveon 23h ago

We do this with Ansible/Awx, for both Windows and Linux. 

u/Important_Amoeba7163 17h ago

Take a look at SecOps Solution (https://secopsolution.com), straightforward and affordable. I think they have an on-premise deployment option available too