This article explains how Atera patch management works on Windows, Mac, and Linux devices: where Atera gets the list of available patches, how often it refreshes, what each operating system needs, how Atera works alongside WSUS, and how automation profiles install patches, handle offline devices, and restart devices after patching.
Windows Patch Management
You can install and manage patches on Windows devices, automate update installations, and control patch approval and exclusion for your devices.
How Windows Patch Management Works
Atera uses the Windows Update Agent (WUA) API to interface with Windows Update and identify available updates. Patches within Atera are updated approximately every hour. Technicians can then install patches manually or automatically.
We recommend testing updates in a staging environment before promoting them to production. Note that Atera and local device views may differ due to the use of the WUA API. Configuration policies allow users to deactivate built-in Windows updates.
Updates through the WUA API are monitored and managed by Microsoft, so updates may be released at different intervals than their standard schedule. While certain updates may not appear immediately, they will eventually be accessible via Atera.
Windows Patching Prerequisites
The Windows Update service must be enabled in the Service Manager.
Relationship With Windows Server Update Services (WSUS)
Atera operates independently from WSUS. Therefore, the Windows update service can be configured for automatic operation. If WSUS runs before the automation profile, updates will be installed based on predefined settings. Conversely, if the automation profile executes before WSUS, updates will be installed first.
For more information, see:
- Patch Management Dashboard
- Automate software patching via automation profiles
- Patch management: Windows and macOS
- Patch approval
Mac Patch Management
Install and manage patches on Mac devices, automate the installation of updates, and control patch approval and exclusion for your devices.
How Mac Patch Management Works
Atera uses the native macOS software update tool to install and manage patches on Mac devices. The patch management module within Atera displays available macOS installers, categorized as 'Upgrades', and the Mac updates that Apple designates as recommended. The content available in Atera should mirror the output of the macOS command softwareupdate --list-full-installers:
softwareupdate --list-full-installers
For more information, see:
- Patch Management Dashboard
- Automate software patching via automation profiles
- Patch management: Windows and macOS
- Patch approval
Linux Patch Management
Install and manage patches on Linux machines, and automate the installation of updates.
How Linux Patch Management Works
Atera uses APT (Advanced Package Tool) for Linux agents to retrieve and install OS updates on Linux devices. Atera's Linux patch management supports Ubuntu 18 and Debian 11 (and above) distributions. APT comes pre-installed on Debian and Ubuntu distributions, and Atera is compatible with all APT versions. You can check the installed version of APT on your devices with the command apt-show-versions:
apt-show-versions
For more information, see:
Automated Patching FAQ: Offline Devices, Feedback, and Restarts
- Automated patch installation: To automate patch installation, create an IT automation profile. Automate patch management via IT automation profiles has the full instructions. To automate Linux package upgrades, select Linux under OS types in the profile's OS patch management section, then select Upgrade Linux packages > Upgrade all. Tasks that can't run on Linux are greyed out.
- Offline agents during scheduled automation execution: You can set how long automation tasks wait in the queue for offline agents: online agents only, or queue for up to one hour, one day, one week, two weeks, or one month. Agents that come online within that time frame receive and execute the profile, and the Patch & Automation Feedback report is updated accordingly. Set the default for all profiles under Admin > Monitoring and automation > Patch management and IT automation > Configuration > Default offline agent execution preference, or set it for a single profile under Profile settings > Offline agent behavior preference. See Patch and automations settings for all profiles.
- IT automation task feedback: Technicians and end-users can access feedback, including installation success and failure details, for IT Automation profiles in the Patch & Automation Feedback report. This report can be received via email or accessed directly in the user interface.
- Reboot functionality: When the "Reboot if needed" option is selected within the IT automation profile, Atera will initiate a system reboot if necessary following the installation of all patches currently present, including OS patches for Windows, Mac, and Linux devices.
- EULA handling: Atera will automatically accept End-User License Agreements (EULA) as required.
