barscaret-downcaret-leftcaret-rightcaret-upcheckchevron-leftchevron-rightfile-pdfinfosign-in-altsignin text-widthtimesyoutube

Windows > App & Patch Management

Deploying Patches to Windows Devices

Updated on June 24th, 2020

Patch detection and reporting features are always enabled on all Miradore sites, whereas the patch distribution feature is disabled by default. Customers with the Enterprise Plan can enable automated patch deployment for Windows devices as described in this article.

See How to upgrade your subscription if you want to upgrade to the Enterprise Plan.

Enabling automated patch deployment for Windows devices

Navigate to the Management > Patches page and open the Installation settings tab of the page.

patchinstallationsettings.png

On that page, you can enable the automated patching of your Windows devices.

About pilot testing

While enabling the patch management, you’ll notice that Miradore offers you a possibility to define separate patch installation settings for a pilot group. It is highly recommended to take advantage of this option to minimize the possible problems caused by patches. See description of the settings on the table below.

Patch installation settings for devices in pilot group
Install patches Do you want to verify the functionality of patches on pilot devices before rolling them out to all Windows devices?

After enabling the installation of patches for the pilot group, remember to define the Pilot group tags and Installation delay fields as well.

Pilot group tags Use device or user tags to select a group of pilot computers. Try to choose the pilot computers so that they represent all of your Windows devices as well as possible. This is important, because it helps you detect potential patch compatibility issues before deploying patches to more devices.

If a device, or its user has any of the specified tags, it is included in to the pilot group. If you’re not yet familiar with device tagging, see the article about Device tagging.

This field doesn’t affect anything if the patch installation for pilot group computers is disabled.

Installation delay This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the devices in the pilot group.

This field doesn’t affect anything if the patch installation for the pilot group computers is disabled.

Make sure that the installation delay for the pilot group is shorter than the installation delay for the rest of your Windows computers. In this way, you have enough time to ensure the correct functionality of the patches.

Patch installation settings for devices not in the pilot group
Install patches Enabling this setting activates automated patch installation for all Windows computers which don’t belong to any of the pilot group(s).

If the pilot testing is disabled, Miradore deploys patches to all Windows computers when this setting is enabled.

Installation delay This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the Windows computers outside the possible pilot group(s).

If the pilot testing is disabled, Miradore deploys patches to all Windows computers according to this installation delay.

Installation delay for the devices not in the pilot group should be higher than the installation delay for the pilot group. In this way, you have enough time to ensure the correct functionality of the patches before they are installed to all Windows PCs.

Good to know: Managed devices will receive the installation delay setting when they sync with Miradore next time. If you want your devices to get the settings immediately, go to the Devices page and run Actions > Sync now from the page toolbar.

Configuring Windows Update for the managed computers

In order to ensure the proper functionality of Miradore’s patch management feature in your managed computers, it is recommended to configure Windows Update on the managed computers as follows:

  • Make sure the Windows Update Service is not disabled. Patch deployments won’t succeed if the service is disabled.
  • Set Windows Automatic Updates to Never check for updates (Windows 7 & 8). This will speed up the patch deployments. If Windows Automatic Updates is configured to check for updates, it may slow down patch deployments with Miradore. It also makes patching more manageable when there is only one system patching devices.
  • On Windows 10 computers you cannot modify the automatic updates setting from the Control panel, but you can edit the settings through the Group Policy Editor or use Miradore’s Windows Update configuration profile to disable the automatic updates. On domain-joined computers this setting is most likely managed through group policies by your administrator.

Related articles:

Patch management for Windows

Troubleshooting patch deployments

Get started with Miradore

Start securing your devices and data today with Miradore. Create a site in just a few minutes and start adding devices immediately. You can get started for free and try out the full features with our 14-day Enterprise trial.

No credit card needed.

SIGN UP FOR MIRADORESEE PLANS AND PRICING