============================================================================= Run Date: OCT 28, 2013 Designation: VBEC*1*63 Package : VBEC - VBECS Priority: Mandatory Version : 1 SEQ #62 Status: Released Compliance Date: NOV 05, 2013 ============================================================================= Subject: OCTOBER 2013 WINDOWS UPDATES FOR VBECS Category: - Informational Description: ============ This patch serves to alert VA facilities using the Vista Blood Establishment Computer Software (VBECS) that Microsoft Windows Updates are available for immediate installation. If the VBECS servers are serviced by a second group, i.e. a Regional Data Center, it is the responsibility of the local IRM support person for VBECS to ensure that all parties who need to see this Update Information for 'their' VBECS system sees it. The local support should follow local policies to forward such information to their Server Administrators. Sites who have not installed VBECS have no action to take with this informational patch. This patch is released with a seven (7) day compliance because the updates address security vulnerabilities in Microsoft Windows. Failure to comply with the installation of Windows Updates could expose the VBECS servers and software to security threats. BLOOD BANK CLEARANCE ===================== EFFECT ON BLOOD BANK FUNCTIONAL REQUIREMENTS: Patch VBEC*1.0*63 contains changes to a package referenced in BBM Team Review of VISTA Patches. This patch does not alter or modify any VistA Blood Bank software design safeguards or safety critical elements functions. RISK ANALYSIS: Changes made by patch VBEC*1.0*63 have no effect on Blood Bank software functionality, therefore RISK is none. Windows Updates ================ If your servers are maintained at a data center, ignore this section since data center personnel will install updates. The Microsoft Windows Update patches must be installed on the VBECS Servers. The updates will take approximately 1 hour and 2 reboots to fully install all patches. The list of updates includes: KB951847** KB2879017 KB2861188 KB2858302v2 KB2847311 KB2862330 KB2862335 KB2864058 KB2868038 KB2883150 KB2756918 KB2844285v2 KB2742596 KB2789643 KB2863239 KB2729450 KB2833940 KB2656352 KB2861189 KB2832411 KB961118 KB2861697 KB2840629 KB2736416 KB2604111 KB963707 KB982168*** KB982524*** KB2604092*** KB890830* These patches appear in Add/Remove Programs after installation, but not as an update: KB976765 KB958481 KB977354 KB954550v5 Following installation of all KB security patches some additional Updates will appear on the server. These updates are a result of the approved KB installations and do not require verification. *Note: Windows Update KB890830 is a malicious software removal tool and does not appear in the list of applied patches after installation. **Note: This is the .NET framework 3.5 Service Pack 1 It will appear in Add/Remove Programs after installation, but not as an update. ***Note: These do not appear in Add/Remove Programs after installation. The VBECS development team must test every Microsoft Windows update. Once the development team is satisfied that the update causes no adverse effects, Clinical Product Support (CPS) will give the sites permission to apply the update by releasing this informational patch. Updates are approved with Windows Server Update Service. Approved updates will be downloaded to your servers automatically. However, a server administrator must install the updates locally. Windows Update instructions: ============================ The updates will take 1 hour to perform and require 2 reboots to install all patches. 1) Since most updates require a reboot, coordinate a time with the Blood Bank manager to apply the updates. All Blood Bank users must be logged off the VBECS server before updates can begin. 2) At the agreed upon down time, log on to the VBECS cluster as a user with server administrator privileges. 3) Use the Cluster Administrator Tool to verify which node is active (Windows Updates should not be installed on an active node): a. Click on START, CONTROL PANEL, ADMINISTRATIVE TOOLS, CLUSTER ADMINISTRATOR. b. If the OPEN CONNECTION TO CLUSTER window appears, enter the VBECS cluster name and click OK. c. When Cluster Administrator has opened click on the folder titled "Groups". d. The server name listed on the right side under the Owner column is the "Active" node. e. Record the server name listed under Owner, this is the active node. The other server in the VBECS cluster is the passive node. f. Log off of the VBECS cluster server once the server name of the active node is determined. 4) Log on to the passive node of the VBECS cluster as a user with server administrator privileges. 5) Verify all users (other than the user installing the Windows updates) are off the VBECS server (do not proceed until all users are logged off): a. Open Task Manager: click on START, RUN; Type TASKMGR and click OK. b. Select the USERS tab to see the users who are logged on to the server. c. Right click on each user's name and click on SEND MESSAGE to send a message to the user asking them to log off the system. d. Wait for all users to logoff. If a user's status is Disconnected, right click the user's name and click on LOG OFF. e. Close TASK MANAGER after all users are logged off the server. 6) A yellow shield shaped icon should appear in the System Tray (lower right corner of desktop) indicating updates are available for installation. 7) If the yellow shield shaped icon fails to appear after waiting one minute, perform the following steps: a. Click on START, RUN. b. Type WUAUCLT.EXE /DETECTNOW and click OK. c. The yellow shield shaped icon can take up to 30 minutes to appear after entering the WUAUCLT.EXE /DETECTNOW command. d. If the icon does not appear after 30 minutes, click on START, ADMINISTRATIVE TOOLS, SERVICES. e. Right-click the service named "Automatic Updates" and select RESTART. f. If the yellow shield icon does not appear within 5 minutes, contact the VA Service Desk (VASD) or file a Remedy ticket. 8) Click on the yellow shield shaped icon in the System Tray. 9) Leave Express Install selected. Click INSTALL. 10) When the update process is complete, you will be prompted to reboot. Reboot the server at this time. 11) Log back on to the passive node of the VBECS cluster as a user with server administrator privileges. 12) A yellow shield shaped icon should again appear in the System Tray (lower right corner of desktop) indicating more updates are available for installation. If the yellow shield does not display follow the steps in step #7. 13) Click on the yellow shield shaped icon in the System Tray. 14) Leave Express Install selected. Click INSTALL. 15) When the update process is complete, you will be prompted to reboot again. Reboot the server at this time. 16) After the reboot is completed (this may take several minutes), log on to the passive node that is now fully patched. Open the Cluster Administrator tool and perform these steps in order: a. Expand the Groups folder. b. Right click the VBECS Group TEST and select TAKE OFFLINE. c. Right click the VBECS Group PROD and select TAKE OFFLINE. d. Right click the Group 1 and select TAKE OFFLINE. e. Right click the Group 0 and select TAKE OFFLINE. f. Right click on the Cluster Group and select MOVE GROUP - wait until the group is ONLINE before proceeding to the next step (this may take up to 5 minutes). g. Right click on each remaining groups and select MOVE GROUP (VBECS Group TEST, VBECS Group PROD, Group 1, and Group 0). h. Right click on Group 0 and select BRING ONLINE - wait until the group is ONLINE before proceeding to the next step (this may take up to 5 minutes). i. Right click on Group 1 and select BRING ONLINE. j. Right click on VBECS Group PROD and select BRING ONLINE. k. Right click on VBECS Group TEST and select BRING ONLINE. l. Examine the Resources folder. All resources should be owned by the server that has just been patched (making it the active node). m. Close Cluster Administrator. 17) Log off the patched server which is now the active node. 18) Log on to the unpatched server and repeat steps 5-15. 19) At this point, if the Server Windows Update process is complete and there are no outstanding issues, notify the Blood Bank Manager that the VBECS system is once again available for use. If any issues are encountered, contact the VA Service Desk (VASD) or file a Remedy ticket. ======================================================================== NOTE: Do not change the system! The U.S. Food and Drug Administration classifies this software as a medical device. Unauthorized modifications will render this device an adulterated medical device under Section 501 of the Medical Device Amendments to the Federal Food, Drug, and Cosmetic Act. Acquiring and implementing this software through the Freedom of Information Act require the implementer to assume total responsibility for the software and become a registered manufacturer of a medical device, subject to FDA regulations. Adding to or updating VBECS software without permission is prohibited. Routine Information: ==================== No routines included. ============================================================================= User Information: Entered By : HA,THANH-HUONG HUU Date Entered : OCT 18, 2013 Completed By: KANIA,KEVIN Date Completed: OCT 28, 2013 Released By : CHRISTENSEN,LINDA L Date Released : OCT 28, 2013 ============================================================================= Packman Mail Message: ===================== No routines included