This FAQ answers common questions about Atera patch management and IT automation profiles: installing Windows, Mac, and Linux patches manually or on a schedule, device restarts after patching, excluding or postponing patches, why the patch list in Atera can differ from Windows Update, and what happens when a device is offline.
Patch Management
What Patch Management Is and What It Costs
Q: What is patch management?
A: Patch management refers to the process of acquiring and deploying updates, or patches, to software applications, operating systems, and other system components. These patches are typically released by software vendors to address security vulnerabilities, fix bugs, and improve overall performance.
Q: Does Atera provide a patch management module?
A: Yes, Atera offers a comprehensive patch management module designed to facilitate the installation of patches on Windows, Mac, and Linux devices. For more information, see Atera's patch management.
Q: How much does the patch management module cost within Atera?
A: The patch management module is integrated into your Atera subscription at no additional cost.
Installing Patches Manually
Q: How can I install a patch using Atera?
A: You can install patches on your devices manually, or automate the process with an automation profile so patches install at your preferred time.
Q: How can a patch be installed manually?
A: To manually install a patch, use either the Live Manage: Patch management module or the Patch Search and Deploy classic report. For detailed instructions on manual patch installation, see:
- Patch management: Windows and macOS
- Package manager: Linux
- Live manage: patch management
- Operational report: Patch search & deploy
Q: Can I initiate a manual scan on my devices to find undiscovered patches?
A: Yes. Whenever you access your device and go to Manage > Patch Management, you can click the Refresh button to see any new updates on your devices.
Installing Patches Automatically With Automation Profiles
Q: How can a patch be installed automatically?
A: Atera offers automation profiles that install patches automatically at a time that is convenient for you and your end users. By scheduling the automation profile, available patches on your devices will be installed automatically.
Q: How can I configure patch management using automation profiles?
A: To learn how to set up patch management with automation profiles and schedule the profiles, see:
Q: What are the recommended best practices for setting up patch management via automation profiles?
A: To ensure optimal results, follow the best practices in Patch management best practices: structure and schedule automation profiles.
Device Restarts After Patching
Q: If I install a patch manually and it requires a reboot, will the devices restart automatically?
A: No, when you install a patch manually and a reboot is required, the devices will not restart automatically. The patch installation will be queued, and once the device is rebooted or shut down, the installation will resume once the device is back online.
Q: Do automation profiles reboot a device if a patch requires it?
A: By default, profiles do not reboot a device if a patch requires it. However, within the automation profile, there is an option called "Reboot if needed." Enabling this option will initiate a device reboot if a patch installation requires it.
Q: When does the "Reboot if needed" option come into effect during the installation of multiple patches?
A: When multiple patches are being installed using the automation profile, the process follows a sequential order. First, all patches are installed. Then the automation profile checks whether any of the installed patches require a reboot. If they do, "Reboot if needed" restarts the device.
Q: Can the restart triggered by the "Reboot if needed" option be postponed?
A: Yes. "Reboot if needed" decides whether a restart happens, and the device's Configuration Policy decides when and how it happens. You can choose to postpone the restart until after working hours, specify a time period before the restart occurs, or grant end users control over the reboot. For detailed instructions, see:
Confirming Whether Atera Restarted a Device
Q: Is there a way to verify whether Atera triggered a device reboot due to an update?
A: Yes. You can confirm this using Atera reports and Windows logs.
- Patch & Automation Feedback report: Check this report to see whether automation tasks ran and included a reboot.
- Windows Event Viewer: Open Event Viewer, go to Windows Logs > System, and look for Event ID 1074.
To check from PowerShell on the device, run Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | Format-Table -wrap. It lists recent restart events and who or what caused each one.
Get-WinEvent -FilterHashtable @{logname='System'; id=1074} | Format-Table -wrapNote: All reboots initiated by Atera use the built-in shutdown.exe process. For example: 'The process C:\Windows\SYSTEM32\shutdown.exe (DEVICE-NAME) has initiated the restart of computer...'
To help distinguish between reboots executed by Atera and those triggered by other programs, Atera includes specific comments in the event log:
- When a reboot is performed manually from Manage > Shutdown, the Comment states Reboot command performed by Atera Networks or the name of the company you have set up in Admin > My Account > Account Settings.
- When a reboot is performed by an automation profile, the Comment states Reboot required after a successful patch installation.
Excluding and Postponing Patches
Q: Can patches be excluded from automatic installation via automation profiles?
A: Yes. You can exclude specific patches from automatic installation, and you can choose to approve or postpone the installation of patches using automation profiles. For more information on how to exclude patches and customize automatic installation, see Patch approval.
Q: How do I stop driver updates from installing?
A: In each automation profile assigned to the device, go to Configuration > OS patch management and clear Hardware driver updates under Drivers and tools. Check every profile assigned to the device, because any profile with Hardware driver updates selected can install drivers.
Q: Can I exclude patches by release date?
A: No. You can exclude specific patches, or postpone a class of updates so new patches wait a set number of days before they're approved automatically.
Q: If a device has two automation profiles, can one install a patch the other has postponed?
A: Yes. Patch approval settings apply to each profile separately, so a profile that approves a class of updates can install patches that another profile assigned to the same device has postponed. To keep a postponement in effect, use the same patch approval settings in every profile that installs OS patches on the device.
Where Windows, Mac, and Linux Patches Come From
Q: Is it possible to integrate the Atera Patch management module with a custom repository for updates?
A: No, currently, the Atera Patch management module does not support integration with private repositories. The module is designed to manage and distribute patches from the Windows Update Agent (WUA) API.
Q: What is the Windows Update Agent (WUA) API?
A: The Windows Update Agent (WUA) API is a programming interface used by Atera to connect with Windows Update. It allows Atera to interact with Windows Update services and retrieve information about available updates for Windows systems. For more information, see Atera's patch management: How it works.
Q: Do Linux and Mac devices also use the Windows Update Agent (WUA) API?
A: No, Linux and Mac devices do not use the Windows Update Agent (WUA) API. Each operating system has its own update mechanism. Linux devices use APT (Advanced Package Tool) to manage updates, while Mac devices rely on the native macOS software update tool for patch installation and management. For more information, see Atera's patch management.
Q: Does Atera manage updates performed through the Windows Update Agent (WUA) API?
A: No, updates delivered through the Windows Update Agent (WUA) API are managed and released by Microsoft. Atera does not control the release or management of updates through this channel.
Q: Does Microsoft make all updates accessible via the Windows Update Agent (WUA) API?
A: Yes, all patches are accessible through the API, though some updates may become available later than their standard release date.
Why the Patch List in Atera Differs From Windows Update
Q: Why do I observe a discrepancy between the patches listed in Atera and the patches displayed locally on the Windows device within Windows Updates?
A: The discrepancy arises because Atera uses the Windows Update Agent (WUA) API to interact with Windows Update and identify available updates. As Atera relies on the WUA API, the patches listed in Atera may differ from the ones displayed locally within Windows Update on the device.
Sharing Downloaded Updates Between Devices (WSUS)
Q: Is it possible for one machine to download all the Windows updates, and other computers can then point to that machine to download those updates?
A: No, this configuration is not supported within the Atera Patch Management module. Each device downloads and installs the updates that are available to it. However, you can set up WSUS (Windows Server Update Services) outside of Atera. A WSUS server acts as a repository for the updates, and other computers can be configured to point to it to download and install updates, which saves bandwidth. Atera support does not offer assistance for troubleshooting or setting up WSUS servers.
Patches That Show a Size of Hundreds of GB
Q: Why do I encounter patches with a size of hundreds of GB?
A: Updates of this size are typically cumulative updates for Windows. Atera retrieves these updates via the WUA API, and their size appears large because they include support for all available Windows languages. Atera installs only the required languages, so the actual update size is considerably smaller.
License Agreements (EULA) During Updates
Q: How does Atera handle End-User License Agreements (EULA)?
A: Atera automatically accepts End-User License Agreements (EULA) as required during software installations or updates.
Local Windows Updates Turned Off on a Device
Q: Why does Atera disable other Windows Updates?
A: Atera does not disable local Windows Updates by default. If Windows Updates appear to be disabled locally on a device, it's because the assigned configuration policy is set to turn off local updates. You can modify the configuration policy at any time to enable or disable local Windows Updates based on your needs.
IT Automation Profiles
What an Automation Profile Is and What It Can Do
Q: What is an automation profile?
A: Automation profiles run essential support tasks on a schedule. These include patching, software bundle installation, Windows version upgrades, disk management, maintenance, and automated scripting.
Q: What is the cost of the automation module?
A: The module is included in all Atera subscriptions at no additional cost.
Q: What tasks can be automated using automation profiles?
A: Key automation profile tasks include:
- Automated patch management for Windows, Mac, and Linux devices
- Automated patch management for software applications
- Software bundle installation
- Automated upgrades for Windows 10 and Windows 11
- Disk management: Defragment (all disks), Run check disk (all disks).
- Maintenance: Create System Restore Point, Delete Temp Files, Delete Internet History, Reboot, Shutdown.
- Automatic script execution
Q: Can I create custom tasks for automation profiles?
A: There is no built-in method to create custom tasks, but the Scripts task within automation profiles lets you run custom scripts or commands to automate specific tasks.
Assigning Automation Profiles to Customers, Folders, and Devices
Q: How do I use an automation profile?
A: Assign the profile to a specific device, folder, or customer. Once the profile has been assigned, it runs its scheduled tasks according to the configured settings. For more information, see:
- Assign automation profiles to sites, folders, or agents
- Assign automation profiles to customers, folders, or agents
Q: What is the distinction between assigning an automation profile to a customer, folder, or device?
A: Assigning an automation profile to a customer ensures that all agents associated with that customer, including newly installed agents, receive the profile automatically. Assigning the profile to a folder ensures that all agents within that folder, including newly installed agents, receive the profile automatically. Assigning the profile to a specific device adds the profile to that device only.
Q: Is there a limit to the number of profiles that a device can have?
A: No, there is no limit to the number of profiles that can be assigned to a device. You can assign multiple profiles to a device based on your automation needs.
Task Order and Organizing Automation Profiles
Q: What is the sequence in which the automation tasks run within an automation profile?
A: The tasks within an automation profile run in a random order, and there is no way to define the order in which they execute. To ensure a desired sequence of actions, create separate automation profiles for each specific task or category. For more information, see Patch management best practices: structure and schedule automation profiles.
Q: How should automation profiles be organized?
A: Organize automation profiles by operating system and by task. For instance, create separate profiles for Windows, Mac, and Linux devices. Within each operating system, divide the profiles further by task, such as OS updates, software updates, and maintenance.
Also consider time zone differences when setting up automation profiles. Align each profile's schedule with the time zones of the devices or locations where its tasks run, so the automation runs at the intended time for each location. For more information, see Patch management best practices: structure and schedule automation profiles.
Time Zones and Offline Devices
Q: When scheduling an automation profile, what time zone does the profile run on?
A: By default, automation profiles run based on the time zone specified in Admin > My account > Account settings. However, you can select to run profiles based on the local device time. For more information, see Automate patch management via IT automation profiles.
Q: What occurs if a device is offline while an automation profile is running?
A: You can configure automation profiles to retain actions in the device's queue for up to one month. This can be done for all profiles, or on a per-profile basis. For more information, see:
- Patch and automations settings for all profiles
- Automate patch management via IT automation profiles
Reports on Automation Profile Results
Q: Is there a report available that shows the actions performed by an automation profile?
A: The Patch and automation feedback report shows the actions performed by an automation profile, from successful actions to errors and failures. For more information, see Operational reports: patch and automation feedback.
Q: Is there an article available that provides an explanation of the errors displayed in the Patch and automation feedback report?
A: Yes. See Understanding the Patch & Automation Feedback Report.
Stopping or Preventing an Automation Profile From Running
Q: How can I prevent a profile from running?
A: There are a few options to prevent a profile from running:
- Remove the schedule: Removing the profile's schedule prevents it from running at the specified time or recurrence.
- Deactivate the profile: Open the profile and, under Configuration > Profile settings, turn off Activate profile. The profile shows as Inactive and is unusable until you turn Activate profile on again.
- Delete the profile: If you no longer require the profile, you can delete it. Once deleted, the profile cannot be restored, so use caution before deleting.
Q: Can an ongoing automation profile be halted once it has commenced?
A: No, once an automation profile has started running, there is no way to stop it.
Q: Does deleting a profile cancel runs already queued for offline devices?
A: No. There is no way to cancel or revoke a run that is already queued. If a device was offline when the profile was scheduled to run, the run stays queued and executes as soon as the device comes online within the profile's offline queue window, even if you delete the profile.
