Patching

Keep operating system updates current across every machine you manage, from a single screen.

The agent scans what each machine is missing, the console shows you the state of your whole fleet, and from there you install what you need: a single patch on one machine, or a full round on a group of servers during Sunday night.

Where it lives

Side menu, "Patches" entry.

From there you reach the module's two screens:

• Patches, the list of all your devices and their status.
• Patch groups, through the button of that name above the table.

There is also a Patches tab inside each device record, which is where the detailed work happens.

What you need first

• Patching is available from the Starter plan.
• The permission to install and reboot is Manage devices. Without it you can see status but cannot run anything.
• The device needs the agent installed and must have been online at least once.
• On Windows the agent uses the machine's own Windows Update. If the machine points to a WSUS, the scan respects that configuration.
• On Linux, the distribution's package manager is used.

Scanning a device

The scan is what tells the console what a machine is missing. Without a scan, the console knows nothing.

It runs on its own every night at 1:00 AM for every device. But if you have just installed the agent, or you want the current picture, you can request it manually.

1. Go to Patches and click the device name.
2. If it has never been scanned, the screen says so plainly: the device shows as not scanned.
3. Click Scan now.
4. You get the notice "Scan requested. The agent runs it on its next cycle." and the Scan in progress badge.
5. The page refreshes itself when the data arrives.

Worth knowing: if the machine is powered off, the request is stored anyway and waits. The console confirms it requested the scan, not that the machine ran it. When the machine comes back online, it runs.

Installing a single patch

1. Open the device record, Pending tab.
2. Narrow the list with the chips next to Filter by: All, Critical, Security, Definitions, Drivers, Other.
3. Tick the box for each patch you want to apply. For everything currently on screen, use Select visible.
4. Click Install selected. The button tells you how many you are about to apply.
5. You get the notice "Installation launched. Progress is shown below in near real time."
6. The progress panel appears below and tracks which patch it is on.
7. When it finishes it says Installation completed, or Installation error in red if something failed.

On Linux devices you also get two buttons that speed up the common case: Install all pending and Install security only. They do not exist on Windows, where you tick the boxes.

Rebooting when required

Many Windows patches do not finish applying until the machine restarts. When that happens, a pending reboot notice appears at the top of the record.

1. Click Reboot computer.
2. Confirm. The console reminds you the customer will see a countdown.
3. Whoever is using the machine sees an on-screen notice with 60 seconds to save their work.
4. If you change your mind, you have that minute to click Cancel reboot.

To reboot several machines at once, go back to the Patches list and use Reboot pending. The dialog shows the full list, with offline machines marked "(offline, skipped)".

The reboot is always immediate with a one minute warning. It cannot be scheduled for three in the morning from this button. That is what groups are for.

Patching several machines for one customer

The Patches screen has no bulk install: the table has no per-row checkboxes. The only action that works across several machines from there is the reboot.

You have two paths.

One at a time, with the list filtered. Pick the customer in the selector, click Filter, and go machine by machine. The table is sorted by critical count, so you start with what is urgent. This works for small fleets or one-off work.

With a patch group. This is the only mechanism that installs across a set in a single operation. You build the group once and then run it whenever you want with Run now, or leave it scheduled.

Creating a group with a scheduled window

A patch group is a set of machines, a rule for what to install, and a time window.

1. Patches, then Patch groups, then New group.
2. Give it a Name that will still make sense in six months. For example "Doctor Center Servers".
3. Pick the classifications you want it to install.
4. Set the window: day, start time and duration.
5. Tick Group enabled so it schedules itself. If you only plan to run it manually, leave it unticked.
6. Save. You get "Patch group created. Now assign computers." and the console leaves you on the group detail.
7. Under Group computers, search and tick the machines. For everything on screen, Select all.
8. Click Save computers.

Three things to keep in mind when building groups:

• Linux devices cannot join a group. They appear with a padlock and the note "Patched from its own record". Scheduled calendar patching is Windows only.
• A device can belong to only one group. There are no overlapping groups.
• The group's Customer field is a label, not a filter. The device selector brings you every machine in your organization, so a group named "Customer A" can end up holding Customer B machines if you are not careful when assigning them.

Reviewing what happened after a window

1. Go to Patch groups and click the group.
2. In the list of runs, open the one you care about.
3. There you get the result machine by machine, with the Installed and Failed counters.

The per-device states you will see:

"Rebooted" is worth being precise about: it means the console sent the order, not that the machine actually restarted. That is confirmed on the next scan.

When the console cannot see

This section matters more than any other, because it is where a green dashboard can mislead you.

The console does distinguish "never scanned" from "up to date". A device that has never been scanned shows a dash in the pending and critical columns, and Last scan says "Never". You will never see a false zero.

The console does not flag offline devices on this screen. There is no online column. A machine that has been off for three weeks shows its three-week-old counters exactly like one that reported ten minutes ago.

The way to catch it is to read the Last scan column. If the date is old, the number you are looking at is old too. A device showing "0 pending" with a scan from twenty days ago is not up to date: it is powered off.

If a scan returns something the console cannot interpret, it is discarded and the previous data stays with its old date. Again: the date is what warns you.

Common errors

The device shows as not scanned. No scan has ever run. Click Scan now and wait for the agent's next cycle.

The scan stays "in progress" and never advances. The machine is offline. The request waits and runs when it comes back. No need to request it again.

"Installation error." The machine ran the job and it failed. The result detail sits below the progress panel. Typical causes are no disk space, an earlier pending reboot blocking the install, or a patch Microsoft has withdrawn.

"These computers cannot join a patch group." You are trying to add Linux devices to a group. They are patched from their own record.

A device ended a run "With errors". At least one patch failed. The engine does not retry: open the device record and apply them manually.

Frequently asked questions

How often does it scan on its own? Every night at 1:00 AM, for every device.

Can I uninstall a patch that went wrong? Not from the console. There is no rollback or update removal.

Can I cancel a run that has already started? No. Once launched, it runs to completion or to timeout.

Can I exclude one specific patch so it never installs? Not from the console. Filtering is by classification, not by individual patch. If the patch is already hidden on the machine, the scan respects that and does not list it.

Can I separate the download from the install? No. Download and install are part of the same operation.

Can I schedule the reboot for a specific time? Only inside a group, where the reboot happens as the run closes. The manual reboot button is always immediate with a one minute warning.

How long has this patch been pending? The console does not know. Each scan replaces the pending list with the current picture, so there is no per-patch age.

Why does a device's history not refresh overnight? The nightly scan updates pending patches, not history. History refreshes when you click Scan now or when an installation finishes.

Does the customer get notified? An email goes out when a device goes from having no critical patches to having at least one, and only to the addresses that customer has configured for patching. If a device goes from three criticals to forty, no new notice is generated.

What happens if a machine is off during the group's window? The engine retries while the window is still open. If the window closes and the machine never appeared, it is left as Skipped.