Example - BigFix Maintenance Window Override

Content Authoring
1

Hello!

We use maintenance windows as a way to aggregate changes during the week and apply them once the server’s maintenance window has arrived. This is done by constraining the action on the “In Maintenance Window” property:

ss (2017-02-04 at 02.37.38).png782×204 11.2 KB

The problem with this is that if you want something to apply sooner for a specific machine (a new computer, a test computer, etc) you would then have to produce multiple actions for each piece of content instead of relying on application during maintenance windows.

We wanted an easy way for developers and administrators to put their own systems into maintenance prior to the enforced maintenance window (so they could test changes ahead of production rollout, make changes occur more quickly on certain devices, etc).

To accommodate this we simply added or exists (values whose (it as boolean = true) of settings "MaintenanceWindow_Override" of client) to the end of the In Maintenance Window property and then produced two fixlets: One that enables the override and one that disables it.

Here are the Fixlets:
Override Fixlets.bes (2.1 KB)
In Maintenance Window with Override Property (4.9 KB)

We push out a policy which disables overrides every night so that a machine doesn’t stay in maintenance forever :slight_smile:

Hope this is helpful for someone!

Bill

2

@strawgate, this is a great tip. I’ve been thinking of doing something similar for our different sets of endpoints with different maintenance windows.

If you use the ‘run only when’ constraint, does precaching still happen?

3

You’d want to test it but it’s my understanding that precaching will work as long as you use “run only when”.

On that note, if you put the “in maintenance window” as your dynamic targeting or put it into relevance it won’t work.

4

Right now we deploy with the Starts/Ends selections, but those aren’t saved in presets. I was hoping that ‘in maintenance window’ would do this. Similarly, adding custom action relevance to resolve to true if during the window… that also won’t precache.

1 Like
5

We Setup a global preset for “In Maintenance Window” and have our operators use that.

We really like how it’s been working so far!

6

Maybe I misread your earlier post. Does “Run only when = In Maintenance Window”, in fact, still precache?

7

Sorry, yes.

It’s my understanding that Run Only When "Maintenance Window" equals "True" or whatever the required entry is should still precache.

The machine will sit at “Constrained” until it hits its maintenance window. I believe this is the required status for precaching.

8

Do you need to use the Enforce Client locking action for this to work?

We are wanting to leave all our clients unlocked all the time… but use the “In Maintenance Window” = true on our patching actions as a default so systems are only patched in the maint windo

9

We do this a lot for different reasons. We enforce Automatic Relay Selection but we have a way to turn it off per machine using this type of process.

We also have on demand analysis. Event log analysis have resource heavy overhead. So if we have a need too do an event log analysis (Such as list of reboots), we make the analysis applicable only if a specific property is set to True. Set it to True, give it some time to analyze, get your results and then set the setting to False to make it no longer applicable to the analysis.

This is what I love so much about BigFix. Extremely versatile. If you can sit at a computer and run a command that does not produce any prompts, you can do it with BigFix. :slightly_smiling_face: