Patch approval lets you choose, for each automation profile, which OS patches install automatically: approve, postpone, or exclude critical and non-critical Windows updates and recommended Mac updates, and manage the patches you've excluded or postponed.
What It Means to Approve, Postpone, and Exclude Patches
Approve patches: If a category is marked as 'Always approve' when scanning for available patches, the patches will be installed when the profile is executed.
Postponed patches: If a category is marked as 'Postpone' when scanning for available patches, the patches won't be immediately installed on the devices to which the profile is applied. Instead, they will be installed in the next profile execution after the specified number of days before auto-approval. This allows you to test any new patches before deploying them to your monitored networks, and to exclude them if they are found to be risky.
Excluded patches: If a patch has been manually excluded, it won't be installed unless approved later on.
Note: Patch approval settings apply to each profile separately. If a device is assigned another profile that approves the same class of updates, that profile can install patches this profile has postponed. To keep a postponement in effect, use the same patch approval settings in every profile that installs OS patches on the device.
Set Patch Approval
Configuring OS patch approval settings ensures timely and secure updates, protecting your system from vulnerabilities while maintaining optimal performance.
Note:
- You'll need to enable Windows updates settings within Configuration policies and select 'Control via Atera's IT automation profiles (Recommended)' before configuring patch approval settings. For more info, see Configuration policies: overview.
- The 'Windows critical updates' setting on the Patch approval tab includes only the Critical updates category. The 'Windows non-critical updates' setting includes the Security updates, Service packs, and Drivers and tools categories, along with all their subcategories.
- Patch approval only approves or postpones driver updates. To stop driver updates entirely, clear Hardware driver updates under Drivers and tools in the profile's Configuration > OS patch management section. Check every profile assigned to the device, because any profile with Hardware driver updates selected can install drivers.
To access patch approval settings:
1. Go to Admin > Monitoring and automation > Patch management and IT automation.
The Patch management and IT automation page appears.
2. Select a profile, or click Create profile to create a new one.
The profile page appears.
3. Click the Patch approval tab.
The Patch approval tab appears.
Here you can set postponement and approval by OS patch type, exclude specific OS patches, and manage all excluded or postponed patches.
Approve, Postpone, and Exclude Patches
Under OS patch installation settings, configure your installation preferences for Windows updates (critical and non-critical), as well as recommended Mac updates. Updates can be set to 'Always approve' or 'Postpone'. Postponed patches will appear within Excluded and postponed patches.
Note:
- Updates can be postponed for up to 30 days before they're auto-approved.
- Linux package upgrades cannot be postponed.
You can exclude OS patches from automatic installation. These patches will not be installed unless manually approved in Excluded and postponed patches. Under Exclude OS patches, you can search for patches by KB, description, product, or class. Select Exclude all related KBs to also exclude all related KB updates with the same KB number.
Note: You can't exclude patches by release date. Exclude specific patches, or postpone a class of updates so new patches wait a set number of days before they're approved automatically.
Manage Excluded and Postponed Patches
Patches that you've postponed or excluded appear in Excluded and postponed patches. Patches that were postponed via the OS patch installation settings will include an auto-approval date.
You can update the status of postponed or excluded patches by clicking on the Status dropdown menu. To approve or exclude postponed patches in bulk, select them and click Approve or Exclude.
Note:
- Postponed patches can be excluded or approved. Once approved, they will be installed on the next scheduled IT automation run. Postponed patches, once excluded, cannot be postponed again.
- Approved patches can be excluded again, as long as it's before the next scheduled IT automation run.
- Excluded patches can be approved but don't have an auto-approval date: they'll only escape patching purgatory through manual intervention.
