# vSphere Update Manager and Patch Management

> Chapter 11 of the Courseiva VMWARE-VCP-DCV curriculum — https://courseiva.com/learn/vmware-vcp-dcv/vsphere-update-manager

**Official objective:** 4.1 — Implement patch and update management using vSphere Update Manager

## Introduction

vSphere Update Manager (VUM) is a tool that automates the process of keeping your virtualisation servers safe, stable, and up-to-date without causing downtime. For the VCP-DCV exam, understanding VUM is critical because patch management is one of the most common real-world tasks a VMware administrator performs, and a significant portion of the exam tests your knowledge of its features, workflows, and limitations.

## The Home Renovation Permit Analogy

Your house, a creaky Victorian with original wiring and a boiler that groans like a haunted spirit.

You want to install a smart thermostat and replace the fuse box with a modern circuit breaker. You don't just grab a screwdriver and start poking wires. That would be reckless. Instead, you call the city building inspector. The inspector, who knows every code and every approved part, reviews your plan. He tells you: 'Your new thermostat is certified, but that specific model of breaker was recalled last week. Use this approved equivalent instead.' He hands you a checklist of required upgrades and a timeline for completion. A year later, you want to install solar panels. You call the same inspector. He checks your previous work, notes the new panel model is compatible with your existing upgrade, and gives the go-ahead.

vSphere Update Manager (VUM) is that city inspector. Instead of a house, it manages your data centre's servers (hosts). Instead of thermostats, it handles software patches and driver updates. It knows which updates are safe (certified by VMware), which are dangerous (recalled or retired), and the exact order to apply them so your servers don't crash. It even schedules the work for a quiet Saturday morning, so your applications never go down. Without VUM, you'd be blindly hammering wires into the wall, hoping the lights stay on.

## Core explanation

What is a Patch?
A patch is a small piece of software designed to fix a problem in an existing program. Think of it like a Band-Aid for a bug — it covers the hole without replacing the whole arm. Patches can fix security vulnerabilities (a hole an attacker could crawl through), resolve crashes (when the system falls over), or add minor features.

What is an Update?
An update is a more significant, larger software package that bundles many patches together, sometimes including new features or major version changes. For example, moving from vSphere 7.0 to 7.0 Update 3 is an update. It contains all the patches released since 7.0 shipped, plus new capabilities.

What is vSphere Update Manager (VUM)?
vSphere Update Manager is a component of VMware vCenter Server. vCenter Server is the central brain that manages all your ESXi hosts (the physical servers running VMware's hypervisor — the thin layer of software that runs virtual machines). VUM lives inside vCenter Server and gives you a single place to see what patches are needed, download them from VMware, and apply them to your hosts in a controlled, safe order.

Why Did VUM Exist Before?
Before VUM, administrators did everything manually. They would log into each ESXi host one at a time, use the command line or a web interface to check for updates, download them, put the host into maintenance mode (which empties it of running virtual machines by moving them to another host), reboot, apply the patches, reboot again, and then turn off maintenance mode. For a small shop with three hosts, that was tedious. For a data centre with 200 hosts, it was a full-time, error-prone nightmare. VUM automated this entire chain of events.

How Does VUM Work?
1.  Baselines and Baseline Groups: VUM uses the concept of a baseline — a collection of patches, extensions, or updates that you want to apply to your hosts. Think of a baseline as a shopping list. You can have a baseline called 'Critical Security Patches' containing only high-severity security fixes, or a baseline called 'Latest Update' containing the newest full version. A baseline group bundles multiple baselines together (e.g., 'Security + Drivers').

2.  Scanning: VUM periodically scans your ESXi hosts and compares their current state against the baselines you have attached. It reports: compliant (all patches present) or non-compliant (missing patches).

3.  Staging: Optional step where VUM downloads the patches to the ESXi host before the actual installation. This reduces downtime during the maintenance window because the files are already local.

4.  Remediation: The process of applying the missing patches to bring a host back into compliance. During remediation, VUM automatically:
-   Puts the host into maintenance mode (all VMs are migrated away using vMotion — a technology that moves a running VM to another host with zero downtime).
-   Applies the patches according to a pre-defined order (usually: critical fixes first, then drivers, then firmware).
-   Reboots the host if required.
-   Takes the host out of maintenance mode, and VMs can be moved back.

Key Concepts for VCP-DCV:
-   Dynamic vs. Fixed Baselines: A dynamic baseline automatically includes all patches that match certain criteria (e.g., 'All Critical Patches released after January'). A fixed baseline is a snapshot of specific patches at a point in time — useful for compliance auditing (e.g., 'Only these 5 specific patches are allowed').
-   Baseline Groups: Used to apply multiple independent baselines in a single remediation action. For example, a group might contain a 'Driver Firmware' baseline and a 'Security Patch' baseline.
-   Host Maintenance Mode: The state where an ESXi host has no running virtual machines. VUM cannot patch a host that has running VMs because a reboot would kill them.

Patch Sources:
VUM downloads patches from the official VMware online depot (a repository on the internet) or from a local depot you host inside your network if your environment has no internet access (air-gapped).

Upgrade Scenarios:
VUM can also perform host upgrades (e.g., from ESXi 6.7 to 7.0) and even upgrade virtual hardware and VMware Tools (the helper software inside each VM that improves performance and features).

Distributed Resource Scheduler (DRS) Integration:
If your cluster (a group of ESXi hosts) has DRS enabled, VUM and DRS work together. DRS intelligently moves VMs between hosts to balance load. When VUM patches a host, DRS ensures the remaining hosts have enough capacity to run all the VMs. This is critical for uptime.

## Real-world context

Sarah is the sole IT administrator for a mid-sized company with 40 ESXi hosts spread across two clusters: one for production (customer-facing apps) and one for development (internal testing). It's Tuesday morning, and VMware has just released a critical security patch for a vulnerability in the ESXi hypervisor that could allow an attacker to take over the host. The company's security policy requires all critical patches to be applied within 48 hours.

Step 1: Create the Baseline.
Sarah opens vSphere Client, navigates to the Update Manager tab, and creates a new dynamic baseline. She names it 'Emergency Security - Critical'. She sets the criteria: Patch Type = Security, Severity = Critical. She then attaches this baseline to both of her clusters.

Step 2: Scan.
She clicks 'Scan' on both clusters. Within minutes, VUM reports that 35 of the 40 hosts are missing the patch. The 5 compliant hosts are new ones she just deployed. VUM also warns her that 8 hosts will require a reboot after patching.

Step 3: Staging (Optional but Wise).
Sarah has a strict change window: Saturday 2 AM to 4 AM. Between now and Saturday, she clicks 'Stage' for the production cluster. VUM downloads the patch files to each host's local storage. This means during the actual maintenance window, the hosts don't need to download over the internet — they just install the local file. This shaves 15 minutes off each host.

Step 4: Schedule Remediation.
On Friday afternoon, Sarah creates a remediation task for Saturday 2 AM. She selects the production cluster. She sets the advanced options:
-   'Migrate powered-off and suspended VMs to other hosts in the cluster.' (Ensures even powered-off VMs are moved along during maintenance).
-   'Disable High Availability (HA) admission control during remediation.' (Prevents HA from blocking the operation because some hosts will be empty. HA is the feature that automatically restarts VMs on other hosts if a host fails).
-   'Retry on failure 2 times.' (If a patch fails, VUM tries again before giving up).

Step 5: Remediation Executes.
At 2 AM Saturday, VUM wakes up. It takes the first host in production, moves all 50 of its VMs to other hosts (thanks to vMotion DRS). It installs the patch. The host reboots. VUM moves the VMs back. Then it moves to the next host. At 2:47 AM, all 20 production hosts are patched and fully operational. Sarah's phone doesn't ring once.

Her development cluster is patched the following Tuesday during the day, since those systems are non-critical and a rolling reboot is acceptable.

Key actions Sarah performed:
-   Created dynamic baselines to automatically include future critical patches.
-   Used staging to minimise downtime.
-   Scheduled remediation for a low-traffic window.
-   Integrated with DRS for zero-downtime patching.

Without VUM, Sarah would have had to manually patch each of those 40 hosts over two nights, probably making a typo on host 27 that would take down a customer-facing application.

## Exam focus

The VCP-DCV exam (now the VMware vSphere 8.x Professional exam) tests vSphere Update Manager extensively. Expect roughly 8-12% of the exam questions to touch on patch management concepts. Here is what they specifically test:

Question Types:
-   Scenario-based: 'You need to patch 50 hosts that are in a DRS/HA cluster. What is the minimum number of hosts that must remain powered on during the remediation?' Answer: 1 host per cluster (because you need somewhere to run the vCenter Server, HA master, etc.). But if the cluster has 50 hosts and DRS auto-migration, you can patch them all in a rolling fashion.
-   'Best practice' questions: 'What should you do before remediating a host?' Answer: Ensure the host is in maintenance mode or that DRS is enabled.
-   'Baseline types' questions: They will give you a scenario where you need to audit a host's compliance against a specific set of patches from a specific date. Answer: Use a fixed baseline, not a dynamic one.
-   'Integration' questions: 'Which VMware feature automates VM migration during VUM patching?' Answer: vMotion (combined with DRS).

Traps and Distractors:
-   The exam loves to confuse Update Manager with vSphere Lifecycle Manager (vLCM). vLCM is a newer feature (vSphere 7+) that manages firmware drivers and hardware compatibility in a more holistic way. The exam will present a question about updating driver firmware for a specific server vendor. If they mention 'using a single image' or 'hardware compatibility list', the answer is vLCM, not VUM. But VUM is still the tool for software patches.
-   Another trap: 'Can VUM upgrade virtual machine hardware?' The answer is yes, but it is done as part of a baseline upgrade, not a patch.
-   'Does VUM upgrade vCenter Server?' No. vCenter Server is upgraded using the vCenter Server installer, not VUM. VUM manages only ESXi hosts, virtual hardware, and VMware Tools.
-   'What happens if you remove a host from inventory while a remediation is in progress?' The remediation fails for that host.

Key Definitions to Memorise:

-   Baseline: A list of patches or upgrades to apply.
-   Baseline Group: A collection of baselines.
-   Dynamic Baseline: Automatically includes all patches matching criteria.
-   Fixed Baseline: A specific, unchanging set of patches.
-   Remediation: The process of applying patches.
-   Staging: Pre-downloading patches to reduce downtime.
-   Maintenance Mode: Host state where VMs are evacuated before patching.
-   vMotion: Live migration of a running VM.
-   DRS: Distributed Resource Scheduler — automates vMotion for load balancing and patching.

What They DON'T Test:
They will not ask you about the exact version numbers of patches (e.g., 'Name the third security patch released in June 2023'). They test concepts, workflows, and troubleshooting.

## Step by step

1. **Create a Baseline** — Define what needs to be applied. In vSphere Client, go to the VUM interface and create a new baseline (either dynamic or fixed). Select patch type (security, bug fix, etc.) and severity. This baseline is your plan of action.
2. **Attach the Baseline to Hosts or Clusters** — You attach the baseline to one or more ESXi hosts or to an entire cluster. This tells VUM which objects need to be checked and potentially patched. Attachment defines the scope of the operation.
3. **Scan for Compliance** — VUM scans each attached host and compares its current patch level against the baseline. It reports each host as either 'compliant' (no missing patches) or 'non-compliant' (missing patches). This gives you a clear status before you start any changes.
4. **Stage Patches (Optional)** — If you schedule remediation for a later time (e.g., a weekend), you can pre-download the patch files to each host's local storage. This reduces the time the host spends in maintenance mode because it does not need to download during the window. Staging is optional but strongly recommended for critical environments.
5. **Remediate** — The actual execution. VUM puts the first host into maintenance mode, applies the patches in the correct order (critical first, then others), reboots the host if needed, and takes it out of maintenance mode. It then repeats this process for each host in the scope. If DRS is enabled, VMs are live-migrated automatically between hosts.

## Comparisons

### vSphere Update Manager (VUM) vs vSphere Lifecycle Manager (vLCM)

**vSphere Update Manager (VUM):**
- Uses baselines (dynamic or fixed) to define patches.
- Primary focus is on ESXi software patches and updates.
- Requires separate processes for firmware and driver updates.

**vSphere Lifecycle Manager (vLCM):**
- Uses a single desired-state image to define the full software stack (ESXi, drivers, firmware).
- Primary focus is on full lifecycle management including hardware compatibility.
- Manages firmware and drivers together with ESXi version in one operation.

### Dynamic Baseline vs Fixed Baseline

**Dynamic Baseline:**
- Automatically includes all patches that match defined criteria (e.g., all critical security patches).
- Changes over time as new patches are released by VMware.
- Best for ongoing maintenance where you always want the latest fixes.

**Fixed Baseline:**
- Contains a specific, unchanging set of patches (e.g., patch IDs KB12345, KB67890).
- Does not change once created, even if new patches are released.
- Best for compliance audits where you need to prove a host was patched to a specific level on a specific date.

### Patch Remediation with DRS On vs Patch Remediation with DRS Off

**Patch Remediation with DRS On:**
- VMs are automatically live-migrated to other hosts (vMotion) before patching.
- No manual VM evacuation needed before the maintenance window.
- Zero downtime for running virtual machines during patching.

**Patch Remediation with DRS Off:**
- VMs are evacuated only if you manually vMotion them or shut them down.
- The administrator must ensure no VMs are running on the target host before remediation.
- Potential for application downtime if not manually managed.

## Diagram

_This flowchart shows the complete lifecycle of patching a cluster using vSphere Update Manager, from baseline creation through rolling remediation._

```mermaid
flowchart TD
    A[vCenter Server] --> B[vSphere Update Manager]
    B --> C[Create Baseline]
    C --> D[Dynamic Baseline]
    C --> E[Fixed Baseline]
    D --> F[Attach to Cluster]
    E --> F
    F --> G[Scan Hosts]
    G --> H{Compliant?}
    H -->|Yes| I[No action]
    H -->|No| J[Stage Patches]
    J --> K[Schedule Remediation]
    K --> L[Host enters Maintenance Mode]
    L --> M[Apply Patches]
    M --> N[Reboot if needed]
    N --> O[Host exits Maintenance Mode]
    O --> P[Next host in cluster]
    P --> G
```

## Common misconceptions

- **Misconception:** VUM can patch vCenter Server itself. **Reality:** VUM patching is limited to ESXi hosts, virtual machine hardware, and VMware Tools. vCenter Server upgrades require a separate installer or appliance update process. (Beginners see VUM as a universal update tool within vSphere, but vCenter is the management layer that runs VUM, so it cannot update itself.)
- **Misconception:** If a host fails to patch, the entire cluster remediation fails and all hosts revert. **Reality:** VUM patches each host sequentially. If one host fails (e.g., a patch error), VUM will log the failure and continue to the next host (unless you configured it to stop on failure). The already-patched hosts remain patched. (This mirrors a common user expectation from OS-level patching where a single failure can roll back an entire Windows Update cycle. VUM is designed for resilience.)
- **Misconception:** You must manually put hosts into maintenance mode before patching. **Reality:** VUM automatically places a host into maintenance mode during remediation, provided DRS is enabled on the cluster. If DRS is off, you must manually evacuate VMs or use a vMotion. (New administrators are used to manual processes and think automation requires explicit steps, but VUM is designed to handle the entire workflow.)
- **Misconception:** Dynamic baselines are the best choice for compliance auditing. **Reality:** For compliance auditing (e.g., proving a host was patched to a specific level on a specific date), fixed baselines are better because they capture a snapshot in time. Dynamic baselines change as new patches are released, making them unsuitable for retrospective audits. (The word 'dynamic' sounds flexible and modern, so beginners assume it is superior. They don't think about the need for a fixed reference point in regulated environments (e.g., PCI DSS).)

## Key takeaways

- VUM only manages patches and upgrades for ESXi hosts, virtual machine hardware, and VMware Tools; it never updates vCenter Server itself.
- A dynamic baseline automatically includes all patches that match your criteria (e.g., all critical security patches), while a fixed baseline captures a specific set of patches for auditing.
- Before remediating a host, VUM automatically places it into maintenance mode — if DRS is enabled, all running VMs are migrated to other hosts with zero downtime.
- Staging patches downloads them to the host before the maintenance window, significantly reducing downtime during remediation.
- VUM integrates with DRS to balance VM loads across the cluster during rolling host patching, ensuring no single host is overwhelmed.
- Baseline groups allow you to apply multiple independent baselines (e.g., security patches and driver updates) in a single remediation task.

## FAQ

**Does vSphere Update Manager update the firmware on the physical server's hard drive?**

No. VUM only updates the ESXi software, VMware Tools, and virtual machine hardware. Firmware updates for components like disk controllers or network cards are managed by vendor-specific tools or vSphere Lifecycle Manager (vLCM), not VUM.

**Can I use VUM to upgrade from ESXi 7.0 to 8.0?**

Yes, VUM can perform host upgrades (e.g., from 7.0 to 8.0) by using an upgrade baseline. This is separate from patch baselines. You point it to the ESXi installer ISO, and it runs the upgrade as part of remediation.

**What happens if I reboot a host while VUM is patching it?**

The remediation fails for that host, and VUM marks the task as failed. The host may be left in a partially patched state. It will need to be manually fixed (re-run remediation or examine logs). VUM does not automatically roll back the patch.

**Is VUM the same as Windows Update?**

Conceptually similar, but VUM is designed for managing virtualisation hosts, not operating systems. It has features like maintenance mode, DRS integration, and baseline groups that have no equivalent in Windows Update. It also operates at the cluster level, not just single machines.

**Do I need internet access for VUM to work?**

By default, VUM downloads patches from the VMware online depot via the internet. However, you can set up a local depot (a file share on your network) to download patches manually and point VUM to that local source, which is common in air-gapped environments.

**Can VUM update all hosts in a cluster at the same time?**

No. VUM remediates hosts one at a time in a rolling fashion. This ensures that at least one host (or more, depending on cluster configuration) remains available to run VMs during the process. Patching all at once would cause downtime.

## Check your understanding

1. **What is the main difference between a dynamic baseline and a fixed baseline in vSphere Update Manager?**

   Answer: A dynamic baseline automatically includes all patches matching your criteria and changes over time, while a fixed baseline contains a specific, unchanging set of patches ideal for compliance auditing.

2. **What must an ESXi host enter before VUM can apply patches that require a reboot?**

   Answer: Maintenance mode, which ensures no virtual machines are running on the host during the reboot.

3. **Can vSphere Update Manager upgrade the version of vCenter Server?**

   Answer: No. VUM only patches ESXi hosts, virtual machine hardware, and VMware Tools. vCenter Server upgrades require a separate installer process.

4. **What is the purpose of staging patches in VUM?**

   Answer: Staging downloads patch files to the ESXi host before the scheduled remediation window, reducing the time the host spends in maintenance mode during the actual patching.

5. **How does VUM ensure that running virtual machines are not disrupted during patching of a cluster with DRS enabled?**

   Answer: VUM works with DRS to automatically live-migrate (via vMotion) all VMs from the host being patched to other hosts in the cluster, achieving zero downtime.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/vmware-vcp-dcv/vsphere-update-manager