Enforcement of updates for devices unassociated with a directory service

Patent metadata

Field	Value
Publication number	US-10860304-B2
Application number	US-201514923848-A
Country	US
Kind code	B2
Filing date	Oct 27, 2015
Priority date	Oct 27, 2015
Publication date	Dec 8, 2020
Grant date	Dec 8, 2020

Abstract

Disclosed are approaches for enforcement of updates for devices unassociated with a directory service. An application executing on a computing device can determine, based on a policy received from a management service, that the computing device is to use an update service specified in the policy to receive updates. The application then modifies a setting of the computing device to specify the use of the update service by the computing device.

First claim

Therefore, the following is claimed:

1. A system, comprising:
a computing device that comprises a processor and a memory, and executes with the processor a version of the MICROSOFT WINDOWS operating system stored in the memory; and
an application comprising machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
receive a policy from a management service, the policy specifying an update service to be enforced;
determine that the computing device is unjoined to a domain that implements a version of the MICROSOFT ACTIVE DIRECTORY directory service;
determine that the computing device is to use the update service specified in the policy to receive and install updates to software installed on the computing device;
determine whether the computing device complies with the policy by periodically checking a WINDOWS registry key that causes the computing device to receive and install updates to software installed on the computing device;
force the computing device to use the update service based at least in part on modifying the WINDOWS registry key stored on the computing device in an instance in which the computing device does not comply with the policy;
determine that the update service is to be unavailable to the computing device at a time of day specified in the policy;
determine that a current time of day matches the time of day specified in the policy; and
cause the WINDOWS registry key stored on the computing device to be modified to disable use of the update service for the current time of day.

2. The system of claim 1 , wherein the application further causes the computing device to at least:
revert a change to the WINDOWS registry key.

3. The system of claim 1 , wherein the application further causes the computing device to at least:
determine that the update service is to be unavailable to the computing device when the computing device is connected to a network specified in the policy;
determine that the computing device is connected to the network specified in the policy; and
modify the WINDOWS registry key stored on the computing device to disable use of the update service.

4. The system of claim 1 , wherein the application further causes the computing device to at least:
determine a current enrollment status of the computing device with the management service;
determine that the current enrollment status of the computing device is unauthorized by the policy; and
modify the WINDOWS registry key stored on the computing device to disable use of the update service.

5. The system of claim 1 , wherein the update service is a version of the MICROSOFT WINDOWS SERVER update service.

6. The system of claim 1 , wherein determining that the computing device is unjoined to the domain is based at least in part on the WINDOWS registry key being a first WINDOWS registry key and the application further causes the computing device to modify a second WINDOWS registry key to force the computing device to retrieve a type of update specified in the policy.

7. The system of claim 1 , wherein the application further causes the computing device to at least:
determine that the WINDOWS registry key has been modified to allow use of another update service; and
revert the WINDOWS registry key stored on the computing device to force the computing device to use the update service.

8. A method, comprising:
receiving a policy from a management service, the policy specifying an update service to be enforced;
determining that a computing device is unjoined to a domain that implements a version of the MICROSOFT ACTIVE DIRECTORY directory service;
determining that the computing device is to use an update service specified in the policy to receive and install updates to software installed on the computing device;
determining whether the computing device complies with the policy by periodically checking a WINDOWS registry key that causes the computing device to receive and install updates to software installed on the computing device;
force the computing device to use the update service based at least in part on modifying the WINDOWS registry key stored on the computing device in an instance in which the computing device does not comply with the policy;
determining that the update service is to be unavailable to the computing device at a time of day specified in the policy;
determining that a current time of day matches the time of day specified in the policy; and
causing the WINDOWS registry key stored on the computing device to be modified to disable use of the update service for the current time of day.

9. The method of claim 8 , further comprising:
reverting a change to the WINDOWS registry key.

10. The method of claim 8 , further comprising
determining that the update service is to be unavailable to the computing device when the computing device is connected to a network specified in the policy;
determining that the computing device is connected to the network specified in the policy; and
modifying the WINDOWS registry key stored on the computing device to disable use of the update service.

11. The method of claim 8 , further comprising:
determining a current enrollment status of the computing device with the management service;
determining that the current enrollment status of the computing device is unauthorized by the policy; and
modifying the WINDOWS registry key stored on the computing device to disable use of the update service.

12. The method of claim 8 , wherein determining that the computing device is unjoined to the domain is based at least in part on the WINDOWS registry key being a first WINDOWS registry key and the method further comprises modifying a second WINDOWS registry key to force the computing device to retrieve a type of update specified in the policy.

13. The method of claim 8 , further comprising:
determining that the WINDOWS registry key has been modified to allow use of another update service; and
reverting the WINDOWS registry key stored on the computing device to force the computing device to use the update service.

14. The method of claim 8 , wherein the update service is a version of the MICROSOFT WINDOWS SERVER update service.

15. A non-transitory computer readable medium comprising machine readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
receive a policy from a management service, the policy specifying an update service to be enforced;
determine that the computing device is unjoined to a domain that implements a version of the MICROSOFT ACTIVE DIRECTORY directory service;
determine that the computing device is to use the update service specified in the policy to receive and install updates to software installed on the computing device;
determine whether the computing device complies with the policy by periodically checking a WINDOWS registry key that causes the computing device to receive and install updates to software installed on the computing device;
force the computing device to use the update service based at least in part on modifying the WINDOWS registry key stored on the computing device to force the computing device to use the update service in an instance in which the computing device does not comply with the policy;
determine that the update service is to be unavailable to the computing device at a time of day specified in the policy;
determine that a current time of day matches the time of day specified in the policy; and
cause the WINDOWS registry key stored on the computing device to be modifi

Assignees

• Airwatch Llc

Inventors

• Murthy Varun
• Regula Kalyan
• Shantharam Shravan
• Roszak Jason

Classifications

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L67/16

  Electricity · mapped topic