Configuration policies: overview

Configuration policies let you control Windows update installation, device restarts after updates, and Splashtop remote access settings on Windows devices, and enforce them at the site, folder, or agent (device) level. You'll find them under Admin > Monitoring and automation > Configuration policies. This article explains how policies are applied and inherited, and what each available configuration does. For step-by-step instructions on creating and assigning a policy, see Configuration policies: manage

Configuration policies let you control Windows update installation, device restarts after updates, and Splashtop remote access settings on Windows devices, and enforce them at the customer, folder, or agent (device) level. You'll find them under Admin > Monitoring and automation > Configuration policies. This article explains how policies are applied and inherited, and what each available configuration does. For step-by-step instructions on creating and assigning a policy, see Configuration policies: manage

How configuration policies work

A configuration policy is a set of settings you define once and assign to sites, folders, or individual agents. Atera applies those settings to every assigned Windows device and keeps re-applying them, so devices stay compliant even if someone changes the settings locally.

A configuration policy is a set of settings you define once and assign to customers, folders, or individual agents. Atera applies those settings to every assigned Windows device and keeps re-applying them, so devices stay compliant even if someone changes the settings locally.

Who can create and assign configuration policies

Creating, editing, and deleting configuration policies, and assigning them at the site or folder level, requires Full admin access. There is no separate configuration policies permission in custom roles.

Creating, editing, and deleting configuration policies, and assigning them at the customer or folder level, requires Full admin access. There is no separate configuration policies permission in custom roles.

Technicians without full admin access can assign a policy to individual agents only, as long as their role has access to that site.
You can assign one configuration policy per site, per folder, and per agent.
Configuration policies can't be assigned to device groups, and can't be assigned in bulk through the API.

Technicians without full admin access can assign a policy to individual agents only, as long as their role has access to that customer.
You can assign one configuration policy per customer, per folder, and per agent.
Configuration policies can't be assigned to device groups, and can't be assigned in bulk through the API.

For the steps, see Assign a configuration policy

How configuration policies are applied

A configuration policy is applied to its assigned devices as soon as it's saved, and is then re-enforced every 12 hours. Offline devices receive the policy the next time they check in.

Reboot if needed is required. Configuration policy restart settings only work when the Reboot if needed option is enabled in the device's IT automation profile. Without it, the policy's restart settings have no effect.
The policy controls the restart, not the profile. When Reboot if needed triggers a restart, the configuration policy decides when and how it happens. For example, with Restart outside of active hours, the device restarts only after active hours end.
Restart notifications require Windows update settings in the policy to be set to Control via Atera's IT automation profiles (Recommended).
Every change is logged. Creating, editing, assigning, and deleting policies is recorded in Admin > Users and security > Audit log. Atera doesn't send alerts for policy changes.

Policy inheritance and supersession

When policies are assigned at more than one level, the most specific one applies.

A site-level policy applies to every folder and agent under that site that doesn't have its own policy.
A folder-level policy overrides the site-level policy and applies to every agent in that folder that doesn't have its own policy.
An agent-level policy overrides any folder- or site-level policy for that device.

A customer-level policy applies to every folder and agent under that customer that doesn't have its own policy.
A folder-level policy overrides the customer-level policy and applies to every agent in that folder that doesn't have its own policy.
An agent-level policy overrides any folder- or customer-level policy for that device.

Policies don't combine. A device follows one policy only, the most specific one assigned to it, so include every setting you need for those devices in that one policy.

What happens when you unassign or delete a configuration policy

Unassigning or deleting a configuration policy stops enforcement but does not revert the settings it applied. Devices keep the last settings they received. If a less specific policy is assigned higher up (folder or site), the device falls back to it.

To return devices to their own Windows settings, set the policy's configurations to Revert to device settings, save, and wait for enforcement (up to 12 hours) before unassigning or deleting the policy. If Windows Update options stay greyed out afterwards, see the Configuration Policies FAQ

Available configurations

Each policy can include any combination of the configurations below. Toggle a configuration on in the policy to enforce it. Configurations left off are not managed by the policy. Have a configuration you'd like to see added? Let us know

Windows update restart configurations

These configuration policy options control how and when Windows devices restart after Atera installs updates that require a restart.

Revert to device settings: Applies the device's default Windows restart settings.
Disable auto-restart with logged-on users: The device doesn't restart while a user is logged on. If the user logs out after the automation has run, the device still won't restart.
Restart outside of active hours: Set the active hours during which devices won't restart. Active hours follow the device's local time zone, not the time zone set in your Atera account. Supported on Windows 10, Windows 11, and Windows Server 2022 and later.
Restart after the selected time period: The device restarts 15-180 minutes after updates finish installing. Supported on Windows 10, Windows 11, and Windows Server 2022 and later.
Allow end users to control device restarts: End users get a toast notification about the pending restart and can postpone it. Set how often the prompt appears (in minutes), how many prompts are shown before a restart is forced, and the message text. Toast notifications are supported on Windows workstations only, not servers.

Note:

The Prompt every and Force restart after fields have no default value. Set both, or the notification and forced restart won't work as expected.
The prompt count is tracked per update that requires a restart. After the device restarts for that update, the cycle ends. A later update that needs a restart starts a new set of prompts. This is expected. Behavior is less certain when the user shuts the device down instead of restarting it.
The prompt doesn't show a countdown of days remaining before a forced restart.
Toast notifications are used only for Windows update restart prompts. Atera has no general pop-up messaging feature for end users, on any plan.

Windows update settings

This configuration policy option decides whether Atera or Windows controls update installation on the device.

Control via Atera's IT automation profiles (Recommended): Atera's IT automation profiles fully control patching and Windows updates. End users can't check for or install updates themselves; they see a message that update settings are managed by their organization. Users on earlier Windows versions are not blocked.
- Security intelligence updates for Microsoft Defender Antivirus keep updating automatically.
- Because automatic Windows updates are turned off, make sure your IT automation profile includes every patch you want installed.
- The Windows Update screen on the device stops refreshing its "Last checked" date. Atera still checks for and installs patches in the background.
Allow automatic Windows local updates: Devices install updates automatically according to their local Windows policy, while you still monitor and manage updates through IT automation profiles. In this mode, your OS excluded patches list and IT automation schedule can be overridden, so excluded patches may still be installed.

Migrate Windows local updates from IT automation profiles

Windows local update settings used to be set in IT automation profiles and are now managed in configuration policies. If you set them in a profile before the change, map your old choice as follows:

Don't affect: No action needed. Devices keep following their local settings.
Disable: In a configuration policy, toggle on Windows update settings and select Control via Atera's IT automation profiles.
Enable: In a configuration policy, toggle on Windows update settings and select Allow automatic Windows local updates.

Then assign the policy to the relevant sites, folders, or devices.

Then assign the policy to the relevant customers, folders, or devices.

Splashtop settings override: remote access type

Splashtop settings in a configuration policy override your account-level Splashtop settings (Admin > Monitoring and automation > Remote access settings) for the devices the policy is assigned to. Use this to set stricter or different remote access rules for specific sites, folders, or devices. Account-level settings are marked in the policy so you can tell them apart.

Splashtop settings in a configuration policy override your account-level Splashtop settings (Admin > Monitoring and automation > Remote access settings) for the devices the policy is assigned to. Use this to set stricter or different remote access rules for specific customers, folders, or devices. Account-level settings are marked in the policy so you can tell them apart.

Toggle on the remote access type to choose whether end users must approve Splashtop connections:

Reject after request expires (reject at login screen automatically): End-user permission is required. If the request expires without a response, the connection is rejected, and connections at the login screen are rejected automatically.
Reject after request expires (connect at login screen automatically): End-user permission is required. If the request expires without a response, the connection is rejected, but connections at the login screen are accepted automatically.
Connect after request expires: End-user permission is requested. If the request expires without a response, the connection goes through.
Unattended (connect without end-user permission): Connects without asking the end user. This is the account-level default.

Splashtop settings override: additional password

Toggle on the additional password setting to require an extra login step for Splashtop connections to the policy's devices:

Require device login: The technician must enter the device's Windows login credentials.
Require security code: The technician must enter a security code you create.
No additional password: No extra step (default).

Limitations

These limitations apply to all configuration policies, regardless of which configurations are enabled.

Group Policy wins. Configuration policies don't override a domain Group Policy Object (GPO), and GPO or third-party settings can override Windows update settings even when Atera is set to control updates. Two Group Policy settings in particular block Atera from installing updates: UseWUServer (points the device to an internal WSUS server) and TargetReleaseVersion (pins the device to a specific Windows version). Remove both at the Group Policy level. Clearing them only on the device won't hold, because Group Policy re-applies them. Windows may still enforce some updates on its own.
Windows Home is not supported, because it doesn't support Group Policy.
Windows Server 2016 and 2019: Restart outside of active hours and Restart after the selected time period don't run on these versions, because their Windows Update Agent doesn't support these scheduling options. The policy can still be assigned, but those two settings have no effect. Use Windows 10, Windows 11, or Windows Server 2022 or later for full restart scheduling.
Maintenance Reboot task: Restart settings apply only to restarts triggered by Reboot if needed in an IT automation profile's patch management section. The Reboot task in a profile's maintenance section always restarts the device on schedule, with no notification or postponement, regardless of any policy.
Windows version upgrades: Windows 10 and 11 version upgrade tasks force a mandatory restart that overrides configuration policies and user notifications. Schedule upgrades outside business hours, in a separate IT automation profile from regular patching.
Power and sleep settings can't be managed with configuration policies or anywhere else in Atera.

Troubleshooting restart notifications

If end users don't see the configuration policy's Windows update restart notification (toast notification), check the causes below in order.

The device has no pending restart

A fully updated device won't show a restart notification and won't restart, even when the configuration policy and IT automation profile are set correctly. First confirm the device has installed an update that requires a restart.

Update or restart notifications are turned off on the device

If the end user has turned off update or restart notifications in Windows, the toast notification won't appear.

On the Windows device, go to Settings > Update & security > Windows Update.
Click Advanced options.
Turn on Update notifications, Restart required notifications, or Notify me when a restart is required to finish updating, depending on the Windows version.

If those options aren't available on the device's Windows version, go to Settings > System > Notifications & actions and turn on Restart required under Get notifications from these senders.

Group Policy is blocking toast notifications

If notifications are on but still don't appear, a local or domain Group Policy may be blocking them.

Press Windows key + R, type gpedit.msc, and press Enter. The Local Group Policy Editor opens.
Go to User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications.
If Turn off toast notifications is enabled, double-click it, select Disabled or Not Configured, and click Apply.
Do the same for Turn off toast notifications on the lock screen.
Restart the device and check whether the notification now appears.

If a domain GPO sets these values, change them at the domain level instead.

How can we help?

Common topics:

MSP

IT Department

Related articles