Use these best practices to structure Atera Patch Management and IT Automation profiles so that OS patches, software updates, maintenance tasks, scripts, and Windows upgrades run reliably. This article covers splitting tasks into separate automation profiles, choosing between "Reboot if needed" and a forced reboot, setting the offline agent execution preference, staggering patch schedules, and postponing new patches to avoid conflicts, failed installs, and repeated reboots.

For how to create and configure a profile step by step, see Automate patch management via IT automation profiles.

How tasks run within an automation profile

Tasks within a single automation profile can run at the same time or in a random order. You can't set the order in which they run. Because of this, tasks that share one profile may compete for the same disk, network, and processing resources on the device.

The only exception is the Reboot if needed task. It always waits until the profile's patches finish installing, and it runs only if one of them requires a restart.

The Reboot and Shutdown maintenance tasks don't follow this rule. They can run before, after, or during other tasks in the same profile. If a device restarts before the other tasks run, those tasks still execute once the device is back online in Atera, so every selected task in the profile eventually runs. Even so, splitting tasks into separate automation profiles, as described below, gives more predictable results and makes failures easier to trace.

Split automation profiles by OS and task type

Don't use a single automation profile for all your devices. Structure your profiles in two layers:

1. By operating system first: create separate profiles for Windows (workstations and servers), macOS, and Linux.
2. By task type second: within each OS, give each type of work its own profile, scheduled in its own time slot.

Separating profiles by task type means a Windows upgrade won't compete with a software rollout, and a long disk check won't slow down a critical security patch. If something fails, the profile name tells you which type of task caused it. See Set up OS-specific automation profiles.

Recommended automation profiles

For Windows devices, build at least six automation profiles, each with its own schedule.

Critical and security updates profile

This automation profile installs critical updates and security updates for the operating system. These updates close active vulnerabilities, so this profile should run on the most frequent and reliable schedule of the six, such as daily. Keeping it separate from lower-priority updates ensures an urgent security fix never waits behind something less important. Enable Reboot if needed in this profile.

Non-critical updates profile

This automation profile covers recommended and non-critical OS updates, which improve stability or add minor fixes but aren't urgent. A lighter schedule, such as weekly, is usually enough. Enable Reboot if needed in this profile.

Note: Windows Optional updates can't be patched automatically through automation profiles.

Software updates profile

This automation profile keeps third-party applications up to date. It uses WinGet on Windows and Homebrew on Mac. Any installed software that has a matching package in WinGet or Homebrew is updated automatically. To maintain other applications, add a software bundle to the profile. Because software installation is a separate process from OS patching, keeping it in its own profile prevents two unrelated installers from running at the same time.

Important: Microsoft Visual C++ Redistributable must be installed on Windows devices before WinGet can install or update software.

For details, see Automate software patching via automation profiles.

Maintenance tasks profile

This automation profile handles device housekeeping: creating a system restore point, deleting temporary files and internet history, defragmenting disks, and running Check disk.

Creating a restore point and running Check disk can take a long time. If either one regularly runs into the next profile's time slot, move it into its own profile.

If you schedule the Reboot or Shutdown task, put it in its own dedicated profile so it doesn't interrupt another task mid-run.

Recurring scripts profile

This automation profile re-runs custom scripts or scripts from the Shared Script Library on a schedule. Examples include routine housekeeping, compliance checks, and self-healing fixes for recurring issues. Scripts in this profile run in a random order like other tasks, so make sure any scripts that share the profile can safely run at the same time.

Windows upgrade profile

This automation profile upgrades Windows devices to the latest build each device is eligible for. It checks each device's eligibility first, then upgrades it to the most recent compatible build. It requires a valid license for the target version.

A Windows upgrade is not the same as a routine update. It takes significantly longer, uses more network and disk resources, and may require multiple restarts. Always keep Windows upgrades in a dedicated profile, scheduled apart from patching and maintenance profiles.

Choose a reboot approach for patching

Atera gives you two ways to restart a device through automation profiles, and they behave very differently.

Reboot if needed

Reboot if needed is a setting inside an automation profile's OS patches section. It restarts the device only if a patch installed by that same profile requires it. If the profile installs nothing that needs a restart, no reboot happens.

A device's Configuration Policy controls how the restart happens. The policy doesn't trigger the reboot itself, but once Reboot if needed triggers one, the policy decides when and how it runs. For example, it can restart only outside active hours, avoid restarting while a user is logged in, or show the end user a warning first. In short, Reboot if needed decides whether a restart is needed, and the Configuration Policy decides when and how it happens. See Configuration policies.

This is the recommended reboot approach for all patching profiles.

Forced reboot

A forced reboot restarts the device immediately, whether or not an update requires it. Configuration Policies don't apply to it.

A forced reboot is useful as a weekly safety net. If a user leaves their computer running on Friday evening, a forced reboot scheduled for Sunday evening restarts the device, finishes applying pending updates, and gives the user a clean start on Monday.

Warning: Because a forced reboot bypasses Configuration Policies, the end user gets no warning before the restart, and any unsaved work may be lost. Schedule it only when devices are expected to be idle, such as on weekends.

Match the offline queue window to the profile's run cadence

Automation profiles can only run tasks on online devices. The Offline agent execution preference sets how long a profile's tasks wait in the queue for an offline device before they're dropped. The options are Online agents only, or queue for up to 1 hour, 1 day, 1 week, 2 weeks, or 1 month. You can set this as an account-wide default or for each profile individually. See Patch and automations settings for all profiles.

Rule of thumb: the offline queue window should never be longer than the profile's run cadence. That way, a device can only have one run of each profile waiting for it at a time.

Warning: If the queue window is longer than the profile's cadence, runs can pile up. For example, a daily profile with a 1-week queue window queues a new run every day the device stays offline. When the device reconnects, all of those queued runs execute one after another, which can install updates and restart the device several times in quick succession.

Stagger automation profile schedules

Each automation profile should run in its own time slot, so it has enough time to finish before another profile starts using the same resources.

• Schedule types: Profiles can run one time, weekly, monthly, or on a flexible schedule, and a single profile can have more than one schedule. Whenever you add a schedule, check that the profile's offline queue window is still no longer than its run cadence.
• Stagger profiles: Leave about 60 to 90 minutes between profiles so that longer tasks, such as a Windows upgrade or Check disk, finish before the next profile starts.
• Run outside business hours: Schedule profiles outside working hours, and ask users to leave their devices on so the profiles can run.
• Time zone: By default, profiles run in the account time zone set under Admin > My account > Account settings, so every device runs on one shared schedule. Select device local time instead if your devices span several regions, so each device runs by its own clock.

See Schedule an automation profile.

Postpone new patches before they install

Each automation profile has a Patch Approval tab where you set an installation preference for each class of update, such as Windows critical or non-critical updates. For each class, choose Always approve to install updates as soon as they're available, or Postpone to wait a set number of days before they're approved automatically.

Postponing doesn't delay the profile itself. It delays the specific update. A newly released update in a postponed class is added to the profile's Excluded and postponed patches list, which shows how long remains before it's approved. From that list, you can either let the countdown finish so the update is approved and installed automatically, or exclude the update so it never installs through that profile.

These settings apply only to devices assigned to that profile. To exclude a patch from all active profiles in your account, use the global exclusion on the main Patch Management and IT Automation page. See Patch approval.

Tip: In your critical and security updates profile, postpone new updates for a few days so they have time to prove stable before they reach your organization's devices. Reserve global exclusion for patches you know cause a specific, recurring problem in your environment.

Tip: In your critical and security updates profile, postpone new updates for a few days so they have time to prove stable before they reach your customers' devices. Reserve global exclusion for patches you know cause a specific, recurring problem in your environment.

Troubleshoot a low Patch & Automation Feedback success score

If the Patch & Automation Feedback report shows a low success rate after an automation profile runs, check when you looked at the report.

The Patch & Automation Feedback email is always sent one hour after the profile runs. If the profile's offline agent execution preference queues tasks for longer than one hour, results keep arriving after the email is sent. Tasks that are still queued or running appear as failed in the email, so the email can show a lower success rate than the final report.

To get an accurate picture, check the Feedback report a few hours after the profile runs, or after its offline queue window has closed. For other patching failures, see Patch management troubleshooting.

Avoid conflicts with "Run the profile on newly installed agents"

If several automation profiles assigned to the same site have Run the profile on newly installed agents enabled, they all run on a newly installed agent at the same time and can conflict.

If several automation profiles assigned to the same customer have Run the profile on newly installed agents enabled, they all run on a newly installed agent at the same time and can conflict.

Enable this option only on profiles whose tasks don't conflict with each other. If more than one of these profiles includes scripts, make sure the scripts can run at the same time.

Quick reference: recommended automation profiles

Suggested setup for Windows devices. Adjust cadences to your environment and number of endpoints.

Related articles

• Automate patch management via IT automation profiles
• Automate software patching via automation profiles
• Patch and automations settings for all profiles
• Configuration policies
• Atera's patch management
• Patch management and IT automation FAQ