Installing/Uninstalling Patches and Service Packs

Name the Configuration
Define Configuration
Define Target
Deploy Configuration

The Install/Uninstall Patches configuration enables you to install or uninstall patches/service packs from a central location. You can click on Install Patch and select the OS that you wanted to deploy patches/service packs to. Uninstallation of patches is not supported for computers running on Mac operating systems. You can see the steps below to know more about installing and uninstalling patches using UEM Central MSP.

Install Patches in Windows Computers

Follow the steps mentioned below to install/uninstall patches and service packs for windows operating systems.

Click Patch Management
Under Deployment select Install/uninstall Patch
Choose the operating system as Windows and then create a configuration that needs to be deployed.

Step 1: Name the Configuration

Provide a name and description for the Install/uninstall Patches Configuration.

Step 2: Define Configuration

Note: Specify the operation type as Install to install the patches/service packs.

specify the following values:

Parameter	Description
Add the Patches	If you have reached this configuration page from the Patch Management tab by selecting the patches, the selected patches automatically gets added to the List of Patches. Click the Add More Patches button to invoke the Patch Browser. From the patch browser select the patches and service packs that have to be applied. The patch browser has an option to view the missing patches/service packs or all patches/service packs, which can then be filtered based on the application and service pack.
Scheduler Settings	Install After Select this option and specify the date and time after which the patches have to be installed. The patches will be installed based on the Install Options selected after the scheduled time.
Deployment Settings	If you have set any Policy as default, then the default policy will be automatically applied to the configuration. You can choose from the policies which are listed under "Apply Deployment Policy". You can see the Policies segregated as My Policies and Created by Others. You can click on View Details to see the policy details and the list of configurations to which the policy is applied. If you do not have an existing policy, you can create one by clicking on create policy

Parameter

Description

Add the Patches

If you have reached this configuration page from the Patch Management tab by selecting the patches, the selected patches automatically gets added to the List of Patches.

Click the Add More Patches button to invoke the Patch Browser. From the patch browser select the patches and service packs that have to be applied. The patch browser has an option to view the missing patches/service packs or all patches/service packs, which can then be filtered based on the application and service pack.

Scheduler Settings

Install After

Select this option and specify the date and time after which the patches have to be installed. The patches will be installed based on the Install Options selected after the scheduled time.

Deployment Settings

If you have set any Policy as default, then the default policy will be automatically applied to the configuration. You can choose from the policies which are listed under "Apply Deployment Policy". You can see the Policies segregated as My Policies and Created by Others. You can click on View Details to see the policy details and the list of configurations to which the policy is applied.

If you do not have an existing policy, you can create one by clicking on create policy

Step 3: Define Target

Using the Defining Targets procedure, define the targets for deploying the Install Patches Configuration.

Step 4: Deploy Configuration

Click the Deploy button to deploy the defined Install Patches Configuration in the defined targets. Deployment will be initiated during the next system startup.

To save the configuration as draft, click Save as Draft.

Install Patches in Mac Computers

Follow the steps mentioned below to install patches Mac operating systems.

Click on Patch Management
Under Deployment select Install Patch
Choose the operating system as Mac and then create a configuration that needs to be deployed.

Step 1: Name the Configuration

Provide a name and description for the Install Patches Configuration.

Step 2: Define Configuration

specify the following values:

Parameter	Description
Add the Patches	Click the Add More Patches button to invoke the Patch Browser. From the patch browser select the patches that have to be applied. The patch browser has an option to view the missing patches or all patches, which can then be filtered based on the application and service pack. If you have reached this configuration page from the Patch Management tab by selecting the patches, the selected patches automatically gets added to the List of Patches.
Scheduler Settings	Install After Select this option and specify the date and time after which the patches have to be installed. The patches will be installed based on the Install Options selected after the scheduled time.
Deployment Settings	Specify the following Deployment Settings: Installation/Uninstallation Option: Install during computer startup: Select this option if the patches have to be deployed during computer startup. Install during 90 minutes refresh interval: Select this option if the patches have to be installed after the computer startup when the next update happens (within 90 minutes) Either of the above, whichever is earlier Install Between If you want the installation to happen only between a specified time of a day, you can specify the Start and End time within which the deployment should begin. The Start Time can also be greater than the End time - in such cases the End time is assumed to be on the following day. For example, if you wish the deployment should happen between 10.00 PM and 4.00 AM, you can specify the Start Time as 22:00:00 and End Time as 04:00:00 Allow Users to Skip Deployment Specify whether the use can skip the deployment at a later time by selecting the "Allow Users to Skip Deployment". When you do not select this option, the deployment will be forced and the user will not have any control on the deployment. When you allow users to skip deployment, you can also specify whether they can skip it as long as they wish or force deployment after a specific date. Reboot Policy Do not reboot: Select this option if the client computers should not be rebooted after installing the patches. Force Reboot when the user has logged in: Select this option to force the user to reboot the computer. Specify the time within which the client machines will be rebooted and the message that has to displayed in the client machines. Force Shutdown when the user has logged in: Select this option to force the user to shutdown the computer. Specify the time within which the client machines will be shutdown and the message that has to displayed in the client machines. Allow user to skip Reboot: Select this option to allow users to reboot later. Specify the message that has to displayed in the client machines. Allow user to skip Shutdown:Select this option to allow users to shutdown later. Specify the message that has to displayed in the client machines.

Parameter

Description

Add the Patches

Click the Add More Patches button to invoke the Patch Browser. From the patch browser select the patches that have to be applied. The patch browser has an option to view the missing patches or all patches, which can then be filtered based on the application and service pack.

If you have reached this configuration page from the Patch Management tab by selecting the patches, the selected patches automatically gets added to the List of Patches.

Scheduler Settings

Install After

Select this option and specify the date and time after which the patches have to be installed. The patches will be installed based on the Install Options selected after the scheduled time.

Deployment Settings

Specify the following Deployment Settings:

Installation/Uninstallation Option:

Install during computer startup: Select this option if the patches have to be deployed during computer startup.
Install during 90 minutes refresh interval: Select this option if the patches have to be installed after the computer startup when the next update happens (within 90 minutes)
Either of the above, whichever is earlier

Install Between

If you want the installation to happen only between a specified time of a day, you can specify the Start and End time within which the deployment should begin. The Start Time can also be greater than the End time - in such cases the End time is assumed to be on the following day. For example, if you wish the deployment should happen between 10.00 PM and 4.00 AM, you can specify the Start Time as 22:00:00 and End Time as 04:00:00

Allow Users to Skip Deployment

Specify whether the use can skip the deployment at a later time by selecting the "Allow Users to Skip Deployment". When you do not select this option, the deployment will be forced and the user will not have any control on the deployment.
When you allow users to skip deployment, you can also specify whether they can skip it as long as they wish or force deployment after a specific date.

Reboot Policy

Do not reboot: Select this option if the client computers should not be rebooted after installing the patches.
Force Reboot when the user has logged in: Select this option to force the user to reboot the computer. Specify the time within which the client machines will be rebooted and the message that has to displayed in the client machines.
Force Shutdown when the user has logged in: Select this option to force the user to shutdown the computer. Specify the time within which the client machines will be shutdown and the message that has to displayed in the client machines.
Allow user to skip Reboot: Select this option to allow users to reboot later. Specify the message that has to displayed in the client machines.
Allow user to skip Shutdown:Select this option to allow users to shutdown later. Specify the message that has to displayed in the client machines.

Step 3: Define Target

Using the Defining Targets procedure, define the targets for deploying the Install Patches Configuration

Step 4: Deploy Configuration

Click the Deploy button to deploy the defined Install Patches Configuration in the defined targets. Deployment will be initiated during the next system startup.

To save the configuration as draft, click Save as Draft.

Note: Patch Uninstallation is currently not supported for Mac Computers

Creating a configuration from All Patches View

If you are trying to create a configuration from Detailed View under All Patches, then the below mentioned scenarios will come into effect. Detailed view will list every missing patch against every single computer in a separate row, which means if a single patch is missing in 5 computers, 5 rows will be listed.
when you have chosen to deploy more than one patch for more than one computer as mentioned below, then you might end up in deploying the patches to the computers which you never intended to deploy.

Creating a configuration based on the above selection will work as follows:

Selected Patches: Patch 1, Patch 2 and Patch 3.

Defined Target : Computer 1, Computer 2, and Computer 3.

Result of this Deployment:

Patch ID	Included Target	Intended target	Missing Patch	Deployment Initiated	Expected Result
Patch 1	Computer 1	Yes	Yes	Yes	Will be deployed
Patch 1	Computer 2	Yes	Yes	Yes	Will be deployed
Patch 1	Computer 3	No	No	Yes	Will not be deployed
Patch 2	Computer 1	No	Yes	Yes	Will be deployed
Patch 2	Computer 2	Yes	Yes	Yes	Will be deployed
patch 2	Computer 3	No	No	Yes	Will not be deployed
patch 3	Computer 1	No	No	Yes	Will not be deployed
Patch 3	Computer 2	No	No	Yes	Will not be deployed
Patch 3	Computer 3	Yes	Yes	Yes	Will be deployed

As per the above mentioned table, the configuration will be deployed across to all the computers to which the patch is applicable. Patch 2 is applicable for computer 1, but you never intended to deploy it, however the deployment will happen on it, since it is a missing patch.

In order to overcome this, it is recommended to deploy multiple patches to single computer or single patch to multiple computers from "Detailed View". If you want to deploy multiple patches for multiple computers, then it is recommended to create multiple configurations or initiate deployment from Missing Patches View.

Note: When a Patch Management task is initiated, UEM Central agent residing on the client computer scans the computer for the missing patches and downloads only the applicable patches from the UEM Central server.
If you are managing computers in a remote office using a Distribution Server, then WAN agents will download the applicable patches from the Distribution Server. However the deployed patches will be replicated to the Distribution Server irrespective of whether the patch is applicable for the remote office computers or not.