Patch detection and reporting features are always enabled on all Miradore sites, whereas the patch distribution feature is disabled by default. Customers with the Enterprise Plan can enable automated patch deployment for Windows devices as described in this article.
See How to upgrade your subscription if you want to upgrade to the Enterprise Plan.
Enabling automated patch deployment for Windows devices
Navigate to the Management > Patches page and open the Installation settings tab of the page.
On that page, you can enable the automated patching of your Windows devices.
While enabling the patch management, you’ll notice that Miradore offers you a possibility to define separate patch installation settings for a pilot group. It is highly recommended to take advantage of this option to minimize the possible problems caused by patches. See the description of the pilot group settings from the table below.
|Patch installation settings for devices in pilot group|
Do you want to verify the functionality of patches on pilot devices before rolling them out to all Windows devices?
After enabling the installation of patches for the pilot group, remember to define the Pilot group tags and Installation delay fields as well.
|Pilot group tags||
Use device or user tags to select a group of pilot computers. Try to choose the pilot computers so that they represent all of your Windows devices as well as possible. This is important, because it helps you detect potential patch compatibility issues before deploying patches to more devices.
If a device, or its user has any of the specified tags, it is included in to the pilot group. If you’re not yet familiar with device tagging, see the article about Device tagging.
This field doesn’t affect anything if the patch installation for pilot group computers is disabled.
This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the devices in the pilot group.
This field doesn’t affect anything if the patch installation for the pilot group computers is disabled.
Make sure that the installation delay for the pilot group is shorter than the installation delay for the rest of your Windows computers. In this way, you have enough time to ensure the correct functionality of the patches.
Main installation settings
In addition to the pilot group settings, you can define patch installation settings for other devices. These settings can be applied to all devices outside the pilot group, or you may restrict the patch installation to a specific group with tags.
Please note that if a device or its user have tags from both pilot and main groups, the device belongs to the pilot group. In case the automated patch deployment is restricted with tags, the device having no tags does not get any patch deployments. See the description of the settings from the table below.
|Patch installation settings for devices not in the pilot group|
Enabling this setting activates automated patch installation for all Windows computers which don’t belong to any of the pilot group(s).
If the pilot testing is disabled, Miradore deploys patches to all Windows computers when this setting is enabled.
|Tags||Use device or user tags to select a group of computers for patch installation. With this field, you may restrict the patch installations to a specific group of devices.
If the device or its user has any of these defined tags, the computer is included in the group. Please read about device tagging for more information.
This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the Windows computers outside the possible pilot group(s).
If the pilot testing is disabled, Miradore deploys patches to all Windows computers according to this installation delay.
Installation delay for the devices not in the pilot group should be higher than the installation delay for the pilot group. In this way, you have enough time to ensure the correct functionality of the patches before they are installed to all Windows PCs.
Good to know: Managed devices will receive the installation delay setting when they sync with Miradore next time. If you want your devices to get the settings immediately, go to the Devices page and run Actions > Start patch installation now from the page toolbar.
Configuring Windows Update for the managed computers
In order to ensure the proper functionality of Miradore’s patch management feature in your managed computers, it is recommended to configure Windows Update on the managed computers as follows:
- Make sure the Windows Update Service is not disabled. Patch deployments won’t succeed if the service is disabled.
- Set Windows Automatic Updates to Never check for updates (Windows 7 & 8). This will speed up the patch deployments. If Windows Automatic Updates is configured to check for updates, it may slow down patch deployments with Miradore. It also makes patching more manageable when there is only one system patching devices.
- On Windows 10 computers you cannot modify the automatic updates setting from the Control panel, but you can edit the settings through the Group Policy Editor or use Miradore’s Windows Update configuration profile to disable the automatic updates. On domain-joined computers this setting is most likely managed through group policies by your administrator.