Patch detection and reporting features are always enabled on all Miradore sites, whereas the patch distribution feature is disabled by default. Customers with the Enterprise Plan can enable automated patch deployment for Windows devices as described in this article.
See How to upgrade your subscription if you want to upgrade to the Enterprise Plan.
Enabling automated patch deployment for Windows devices
Navigate to the Management > Patches page and open the Installation settings tab of the page.
On that page, you can enable the automated patching of your Windows devices.
About pilot testing
While enabling the patch management, you'll notice that Miradore offers you a possibility to define separate patch installation settings for a pilot group. It is highly recommended to take advantage of this option to minimize the possible problems caused by patches. See description of the settings on the table below.
| Patch installation settings for devices in pilot group | |
| Install patches | Do you want to verify the functionality of patches on pilot devices before rolling them out to all Windows devices? After enabling the installation of patches for the pilot group, remember to define the Pilot group tags and Installation delay fields as well. |
| Pilot group tags | Use device or user tags to select a group of pilot computers. Try to choose the pilot computers so that they represent all of your Windows devices as well as possible. This is important, because it helps you detect potential patch compatibility issues before deploying patches to more devices. If a device, or its user has any of the specified tags, it is included in to the pilot group. If you're not yet familiar with device tagging, see the article about Device tagging. This field doesn't affect anything if the patch installation for pilot group computers is disabled. |
| Installation delay | This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the devices in the pilot group. This field doesn't affect anything if the patch installation for the pilot group computers is disabled. Make sure that the installation delay for the pilot group is shorter than the installation delay for the rest of your Windows computers. In this way, you have enough time to ensure the correct functionality of the patches. |
| Patch installation settings for devices not in the pilot group | |
| Install patches | Enabling this setting activates automated patch installation for all Windows computers which don't belong to any of the pilot group(s). If the pilot testing is disabled, Miradore deploys patches to all Windows computers when this setting is enabled. |
| Installation delay | This field defines how many days Miradore waits, after a patch appears in Miradore patch feed, before it attempts to install the patch to the Windows computers outside the possible pilot group(s). If the pilot testing is disabled, Miradore deploys patches to all Windows computers according to this installation delay. Installation delay for the devices not in the pilot group should be higher than the installation delay for the pilot group. In this way, you have enough time to ensure the correct functionality of the patches before they are installed to all Windows PCs. Good to know: Managed devices will receive the installation delay setting when they sync with Miradore next time. If you want your devices to get the settings immediately, go to the Devices page and run Actions > Sync now from the page toolbar. |
Configuring Windows Update for the managed computers
In order to ensure the proper functionality of Miradore's patch management feature in your managed computers, it is recommended to configure Windows Update on the managed computers as follows:
- Make sure the Windows Update Service is not disabled
- Set Windows Automatic Updates to Never check for updates (Windows 7 & 8).
- On Windows 10 computers you cannot modify this setting from the Control panel, but you can edit the settings through the Group Policy Editor or use Miradore's Windows Update configuration profile to disable the automatic updates. On domain-joined computers this setting is most likely managed through group policies by your administrator.
Related articles:
Troubleshooting patch deployments
Please send comments to contact@miradore.com.