Patch a device now
For updates on a schedule, use policies. This page is for patching by hand.
Start a patch job
- Open the host on Devices and choose Available updates.
- Choose what to install:
- Patch selected: the updates you ticked;
- Patch all security: every security update;
- Patch all: every available update.
- In Confirm patch job, tick Reboot if required if the host may restart when an update needs it. Without it, the host is never restarted; it then shows Reboot required until someone restarts it.
- Confirm.
Packages Held on host are never installed, even when you choose Patch all.
You need the Patch admin or Organization admin role, or Helpdesk operator for patching without restarts.
Follow the job
The job opens on Jobs. For each host it shows a timeline (queued, dispatched, installing, verifying, rebooting) and the live output of the package manager. When it finishes, the host scans again so its list is up to date.
| Result | Means |
|---|---|
| Succeeded | Everything requested is installed |
| Failed | The package manager reported an error; the output shows which |
| Timed out | The host stopped reporting for 30 minutes, for example because it went to sleep or lost its network |
| Cancelled | Cancelled before the host picked it up, or stopped by someone ("Stopped by" and their email) |
Stop a job
If a job is stuck or should not go on, choose Stop job on its page and confirm. Hosts that have not started it are cancelled; a host already working on it stops within about a minute, ending whatever the package manager was running. An install cut off halfway can leave packages half-configured: scan the host afterwards and patch again if needed. An agent upgrade already under way is left to finish or roll back.
Anyone who can patch can stop a job.
Restart a host
Choose Reboot on the host's page. The job waits until the host is back and has reported in.
Good to know
- Macs with an Intel processor: Homebrew no longer provides ready-built packages for them, so each Homebrew update is compiled on the Mac, which can take hours. Keep the Mac on power and awake, or leave Homebrew updates out.
- Windows installs updates through Windows Update, and third-party programs through winget.